diff --git a/.gitattributes b/.gitattributes
index 0001d2d56..743cd7bf8 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -9,6 +9,7 @@
 /.github/workflows/auto-approve.yml linguist-generated
 /.github/workflows/auto-queue.yml linguist-generated
 /.github/workflows/build.yml linguist-generated
+/.github/workflows/codecov.yml linguist-generated
 /.github/workflows/integ.yml linguist-generated
 /.github/workflows/pull-request-lint.yml linguist-generated
 /.github/workflows/release.yml linguist-generated
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
new file mode 100644
index 000000000..6d72232c6
--- /dev/null
+++ b/.github/workflows/codecov.yml
@@ -0,0 +1,33 @@
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
+
+name: codecov
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+jobs:
+  collect:
+    permissions:
+      id-token: write
+    if: github.repository == 'aws-cdk-cli/aws-cdk-cli'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+      - name: Install dependencies
+        run: yarn install
+      - name: Build and test CLI
+        run: yarn nx run aws-cdk:build
+      - name: Upload results to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          files: packages/aws-cdk/coverage/cobertura-coverage.xml
+          fail_ci_if_error: true
+          flags: suite.unit
+          use_oidc: true
diff --git a/.gitignore b/.gitignore
index b77d722d0..5b69bb868 100644
--- a/.gitignore
+++ b/.gitignore
@@ -47,5 +47,6 @@ jspm_packages/
 !/.eslintrc.json
 !/.github/dependabot.yml
 !/.github/workflows/integ.yml
+!/.github/workflows/codecov.yml
 !/.projenrc.ts
 !/.github/workflows/release.yml
diff --git a/.projen/files.json b/.projen/files.json
index eb5598b37..3d48f9561 100644
--- a/.projen/files.json
+++ b/.projen/files.json
@@ -7,6 +7,7 @@
     ".github/workflows/auto-approve.yml",
     ".github/workflows/auto-queue.yml",
     ".github/workflows/build.yml",
+    ".github/workflows/codecov.yml",
     ".github/workflows/integ.yml",
     ".github/workflows/pull-request-lint.yml",
     ".github/workflows/release.yml",
diff --git a/.projenrc.ts b/.projenrc.ts
index 43286463c..757afeff2 100644
--- a/.projenrc.ts
+++ b/.projenrc.ts
@@ -4,6 +4,7 @@ import { Stability } from 'projen/lib/cdk';
 import { BundleCli } from './projenrc/bundle';
 import { ESLINT_RULES } from './projenrc/eslint';
 import { JsiiBuild } from './projenrc/jsii';
+import { CodeCovWorkflow } from './projenrc/codecov';
 
 // 5.7 sometimes gives a weird error in `ts-jest` in `@aws-cdk/cli-lib-alpha`
 // https://github.com/microsoft/TypeScript/issues/60159
@@ -1093,7 +1094,7 @@ const toolkitLib = configureProject(
         coverageThreshold: {
           // this is very sad but we will get better
           statements: 85,
-          branches: 77,
+          branches: 76,
           functions: 77,
           lines: 85,
         },
@@ -1278,4 +1279,9 @@ new CdkCliIntegTestsWorkflow(repo, {
   ],
 });
 
+new CodeCovWorkflow(repo, {
+  restrictToRepos: ['aws-cdk-cli/aws-cdk-cli'],
+  packages: [cli.name],
+});
+
 repo.synth();
diff --git a/packages/@aws-cdk/toolkit-lib/jest.config.json b/packages/@aws-cdk/toolkit-lib/jest.config.json
index 0c97846db..89a9c20fc 100644
--- a/packages/@aws-cdk/toolkit-lib/jest.config.json
+++ b/packages/@aws-cdk/toolkit-lib/jest.config.json
@@ -9,7 +9,7 @@
   "coverageThreshold": {
     "global": {
       "statements": 85,
-      "branches": 77,
+      "branches": 76,
       "functions": 77,
       "lines": 85
     }
diff --git a/projenrc/codecov.ts b/projenrc/codecov.ts
new file mode 100644
index 000000000..92219c8a3
--- /dev/null
+++ b/projenrc/codecov.ts
@@ -0,0 +1,60 @@
+import { Component, github } from "projen";
+import { JobPermission } from "projen/lib/github/workflows-model";
+import { TypeScriptProject } from "projen/lib/typescript";
+
+export interface CodeCovWorkflowProps {
+  readonly restrictToRepos: string[];
+  readonly packages: string[];
+}
+
+export class CodeCovWorkflow extends Component {
+  public readonly workflow: github.GithubWorkflow;
+
+  constructor(repo: TypeScriptProject, props: CodeCovWorkflowProps) {
+    super(repo);
+
+    if (!repo.github) {
+      throw new Error('Given repository does not have a GitHub component');
+    }
+
+    this.workflow = repo.github.addWorkflow('codecov');
+    this.workflow.on({
+      push: { branches: ['main'] },
+      pullRequest: { branches: ['main'] },
+    });
+
+    this.workflow.addJob('collect', {
+      permissions: { idToken: JobPermission.WRITE },
+      if: props.restrictToRepos.map(r => `github.repository == '${r}'`).join(' || '),
+      steps: [
+        github.WorkflowSteps.checkout(),
+        {
+          name: 'Set up Node',
+          uses: 'actions/setup-node@v4',
+          with: {
+            'node-version': 'lts/*',
+          },
+        },
+        {
+          name: 'Install dependencies',
+          run: 'yarn install',
+        },
+        {
+          name: 'Build and test CLI',
+          // The 'build' job includes running tests
+          run: `yarn nx run ${props.packages.map(p => `${p}:build`).join(' ')}`,
+        },
+        {
+          name: 'Upload results to Codecov',
+          uses: 'codecov/codecov-action@v5',
+          with: {
+            files: props.packages.map(p => `packages/${p}/coverage/cobertura-coverage.xml`).join(','),
+            fail_ci_if_error: true,
+            flags: 'suite.unit',
+            use_oidc: true
+          },
+        },
+      ],
+    });
+  }
+}
\ No newline at end of file