diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index e8a7d12..ac38531 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -20,8 +20,8 @@ jobs:
           git config --unset "http.${GITHUB_SERVER_URL}/.extraHeader"
           git lfs install --local
           git lfs pull
-      - name: Build
-        run: nix build -L .#li7y .#li7y-oci
+      - name: Build and test
+        run: nix build -L .#li7y .#li7y-oci .#li7y-tarpaulin
       - name: Push OCI image
         if: github.ref == 'refs/heads/master'
         run: |
@@ -30,3 +30,8 @@ jobs:
           podman tag li7y git.sbruder.de/simon/li7y:latest
           podman login --username simon --password "${{ secrets.REGISTRY_PASSWORD }}" git.sbruder.de
           podman push git.sbruder.de/simon/li7y:latest
+      - run: nix build -L .#li7y-tarpaulin
+      - uses: actions/upload-artifact@v4
+        with:
+          name: tarpaulin
+          path: result/
diff --git a/flake.nix b/flake.nix
index a5946f3..812d8bc 100644
--- a/flake.nix
+++ b/flake.nix
@@ -74,44 +74,67 @@
         };
       };
 
-      packages = rec {
-        li7y = naersk'.buildPackage {
-          src = self;
+      packages =
+        let
+          # naersk does not easily allow overrideAttrs
+          commonNaerskConfigurarion = {
+            src = self;
 
-          checkInputs = with pkgs; [
-            postgresql
-            postgresqlTestHook
-          ];
+            checkInputs = with pkgs; [
+              postgresql
+              postgresqlTestHook
+            ];
 
-          doCheck = true;
+            doCheck = true;
 
-          # tests need to be able to create and drop databases
-          postgresqlTestUserOptions = "LOGIN SUPERUSER";
+            # tests need to be able to create and drop databases
+            postgresqlTestUserOptions = "LOGIN SUPERUSER";
 
-          postgresqlTestSetupPost = ''
-            export DATABASE_URL="postgres://''${PGUSER}/''${PGDATABASE}?port=5432&host=''${PGHOST}"
-          '';
+            postgresqlTestSetupPost = ''
+              export DATABASE_URL="postgres://''${PGUSER}/''${PGDATABASE}?port=5432&host=''${PGHOST}"
+            '';
 
-          # Otherwise SQLx tries to infer the databse schema from an empty database
-          # (as it can only run the migrations once the test binary is built).
-          # Also, this enforces that the full query cache is included in the repository.
-          SQLX_OFFLINE = true;
-        };
-        default = li7y;
+            # Otherwise SQLx tries to infer the databse schema from an empty database
+            # (as it can only run the migrations once the test binary is built).
+            # Also, this enforces that the full query cache is included in the repository.
+            SQLX_OFFLINE = true;
+          };
+        in
+        rec {
+          li7y = naersk'.buildPackage commonNaerskConfigurarion;
+          default = li7y;
 
-        li7y-oci = pkgs.dockerTools.buildLayeredImage {
-          name = "li7y";
-          tag = "latest";
+          li7y-tarpaulin = naersk'.buildPackage (commonNaerskConfigurarion // {
+            name = "li7y-tarpaulin";
 
-          contents = [
-            li7y
-          ];
+            checkInputs = commonNaerskConfigurarion.checkInputs ++ (with pkgs; [
+              cargo-tarpaulin
+            ]);
 
-          config = {
-            Cmd = [ "${li7y}/bin/li7y" ];
+            dontBuild = true;
+            singleStep = true; # tarpaulin uses different options anyway
+
+            cargoTestCommands = _: [ "cargo tarpaulin" ];
+
+            postInstall = ''
+              rm -r $out
+              cp -r target/tarpaulin $out
+            '';
+          });
+
+          li7y-oci = pkgs.dockerTools.buildLayeredImage {
+            name = "li7y";
+            tag = "latest";
+
+            contents = [
+              li7y
+            ];
+
+            config = {
+              Cmd = [ "${li7y}/bin/li7y" ];
+            };
           };
         };
-      };
 
       devShells.default = pkgs.mkShell {
         buildInputs = [