diff --git a/.codecov.yml b/.codecov.yml
new file mode 100644
index 0000000..f4d1c7a
--- /dev/null
+++ b/.codecov.yml
@@ -0,0 +1,27 @@
+# Codecov configuration
+# Reference: https://docs.codecov.com/docs/codecov-yaml
+
+coverage:
+  precision: 1
+  round: down
+  range: "50...90"
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 2%
+    patch:
+      default:
+        target: auto
+        threshold: 2%
+
+comment:
+  layout: "reach,diff,flags,files,footer"
+  behavior: default
+  require_changes: false
+
+ignore:
+  - "cmd/**/*"      # CLI entry points (serve, migrate, user, reindex CLI flags)
+  - "deploy/**/*"   # Ansible deployment playbooks & templates
+  - "web/**/*"      # React frontend (tested independently)
+  - "test/**/*"     # Integration test helpers
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ecc0051..6bc1a78 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -60,7 +60,7 @@ jobs:
         env:
           DB_DSN: "selfcloud:selfcloud_pass@tcp(127.0.0.1:3306)/selfcloud?parseTime=true"
         run: |
-          go test -v -race -coverprofile=coverage.out ./...
+          go test -v -race -coverpkg=./internal/... -coverprofile=coverage.out ./...
 
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v5
diff --git a/Makefile b/Makefile
index b5f1ccd..7b78920 100644
--- a/Makefile
+++ b/Makefile
@@ -21,7 +21,7 @@ test:
 	$(ENV_PATH) go test -v ./...
 
 test-coverage:
-	$(ENV_PATH) go test -coverprofile=coverage.out ./...
+	$(ENV_PATH) go test -coverpkg=./internal/... -coverprofile=coverage.out ./...
 	$(ENV_PATH) go tool cover -html=coverage.out -o coverage.html
 	@echo "Coverage report: coverage.html"
 	@open coverage.html