diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 405276b4..4b05e59b 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: https://github.com/actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -38,7 +38,7 @@ jobs:
           ruff check
 
       - name: Checkout pyright diff plugin
-        uses: actions/checkout@v5
+        uses: https://github.com/actions/checkout@v5
         with:
           repository: mx/diff_quality_basedpyright
           path: diff_quality_basedpyright
@@ -58,7 +58,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: https://github.com/actions/checkout@v5
 
       - name: Setup
         uses: ./.gitea/actions/install
@@ -84,7 +84,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: https://github.com/actions/checkout@v5
 
       - name: Setup
         uses: ./.gitea/actions/install
@@ -115,7 +115,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: https://github.com/actions/checkout@v5
 
       - name: Setup
         uses: ./.gitea/actions/install
@@ -131,3 +131,59 @@ jobs:
         run: |
           source .venv/bin/activate
           pytest --cov=aare --cov-config=./pyproject.toml --cov-branch --cov-report=xml --no-cov-on-fail ./tests/unit
+
+      # Rendered here rather than in coverage-analysis: this is the job that has
+      # the venv and the .coverage data file.
+      - name: Build coverage summary
+        run: |
+          source .venv/bin/activate
+          {
+            echo "<!-- coverage-report -->"
+            echo "### Coverage report"
+            echo
+            echo "**Total line + branch coverage: $(coverage report --format=total)%**"
+            echo
+            echo "<details><summary>Per-file breakdown</summary>"
+            echo
+            coverage report --format=markdown
+            echo
+            echo "</details>"
+          } > coverage-summary.md
+
+      - name: Upload coverage
+        uses: https://github.com/actions/upload-artifact@v4
+        with:
+          name: coverage
+          path: |
+            coverage.xml
+            coverage-summary.md
+          if-no-files-found: error
+
+  coverage-analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    needs: ["test-with-coverage"]
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Download coverage
+        uses: https://github.com/actions/download-artifact@v4
+        with:
+          name: coverage
+
+      - name: Find Comment
+        uses: https://github.com/peter-evans/find-comment@v3
+        id: fc
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          comment-author: "github-actions[bot]"
+          body-includes: "<!-- coverage-report -->"
+
+      - name: Create or update comment
+        uses: https://github.com/peter-evans/create-or-update-comment@v5
+        with:
+          comment-id: ${{ steps.fc.outputs.comment-id }}
+          issue-number: ${{ github.event.pull_request.number }}
+          body-path: coverage-summary.md
+          edit-mode: replace