diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
new file mode 100644
index 0000000000..bea2a113c2
--- /dev/null
+++ b/.github/workflows/coverage.yml
@@ -0,0 +1,81 @@
+# Copyright 2024 The Fuchsia Authors
+#
+# Licensed under a BSD-style license <LICENSE-BSD>, Apache License, Version 2.0
+# <LICENSE-APACHE or https://www.apache.org/licenses/LICENSE-2.0>, or the MIT
+# license <LICENSE-MIT or https://opensource.org/licenses/MIT>, at your option.
+# This file may not be copied, modified, or distributed except according to
+# those terms.
+
+name: Generage code coverage report
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions: read-all
+
+jobs:
+  coverage:
+    name: Generage code coverage report
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - name: Configure environment variables
+        run: |
+          set -eo pipefail
+  
+          # We use toolchain descriptors ("msrv", "stable", "nightly", and
+          # values from the "metadata.build-rs" key in Cargo.toml) in the
+          # matrix. This step converts the current descriptor to a particular
+          # toolchain version by looking up the corresponding key in
+          # `Cargo.toml`. It sets the `ZC_NIGHTLY_TOOLCHAIN` environment
+          # variable for use in the next step (toolchain installation) because
+          # GitHub variable interpolation doesn't support running arbitrary
+          # commands. In other words, we can't rewrite:
+          #
+          #   toolchain: $ {{ env.ZC_NIGHTLY_TOOLCHAIN }}
+          #
+          # ...to:
+          #
+          #   toolchain: $ {{ ./cargo.sh --version matrix.toolchain }} # hypothetical syntax
+          ZC_NIGHTLY_TOOLCHAIN="$(./cargo.sh --version nightly)"
+          echo "Found that the 'nightly' toolchain is $ZC_NIGHTLY_TOOLCHAIN" | tee -a $GITHUB_STEP_SUMMARY
+          echo "ZC_NIGHTLY_TOOLCHAIN=$ZC_NIGHTLY_TOOLCHAIN" >> $GITHUB_ENV
+  
+      # On our MSRV, `cargo` does not know about the `rust-version` field. As a
+      # result, in `cargo.sh`, if we use our MSRV toolchain in order to run `cargo
+      # metadata`, we will not be able to extract the `rust-version` field. Thus,
+      # in `cargo.sh`, we explicitly do `cargo +stable metadata`. This requires a
+      # (more recent) stable toolchain to be installed. As of this writing, this
+      # toolchain is not used for anything else.
+      - name: Install stable Rust for use in 'cargo.sh'
+        uses: dtolnay/rust-toolchain@00b49be78f40fba4e87296b2ead62868750bdd83 # stable
+        with:
+          toolchain: stable
+          # This isn't actually required to generate a coverage report, but
+          # `cargo.sh` checks for it in order to help avoid the subtle UI test
+          # bugs that happen when UI tests are run without it installed.
+          components: rust-src
+  
+      - name: Install Rust with nightly toolchain (${{ env.ZC_NIGHTLY_TOOLCHAIN }})
+        uses: dtolnay/rust-toolchain@00b49be78f40fba4e87296b2ead62868750bdd83 # stable
+        with:
+          toolchain: ${{ env.ZC_NIGHTLY_TOOLCHAIN }}
+          targets: "x86_64-unknown-linux-gnu"
+          # This isn't actually required to generate a coverage report, but
+          # `cargo.sh` checks for it in order to help avoid the subtle UI test
+          # bugs that happen when UI tests are run without it installed.
+          components: rust-src
+
+      - name: Generate code coverage
+        run: |
+          set -eo pipefail
+          ./cargo.sh +nightly install cargo-llvm-cov
+
+          ./cargo.sh +nightly llvm-cov --all-features --doctests --package zerocopy --lcov --output-path lcov.info
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          files: lcov.info