diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9495771c..9a4b00e0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -188,10 +188,14 @@ jobs:
     needs: changes
     if: needs.changes.outputs.platform == 'true'
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
+          fetch-depth: 0
           persist-credentials: false
           submodules: false
 
@@ -214,6 +218,28 @@ jobs:
           --all-features
           --fail-under-lines 80
 
+      - name: Export platform coverage
+        run: |
+          set -euo pipefail
+          coverage_dir="target/platform-coverage"
+          mkdir -p "${coverage_dir}"
+          cargo llvm-cov report --locked \
+            -p registry-config-report \
+            -p 'registry-platform-*' \
+            --lcov \
+            --output-path "${coverage_dir}/platform.lcov"
+
+      - name: Upload platform coverage to Codecov
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          disable_search: true
+          fail_ci_if_error: false
+          files: target/platform-coverage/platform.lcov
+          flags: platform
+          name: platform
+          use_oidc: true
+          version: v11.3.1
+
   platform-hygiene:
     name: Platform hygiene and config inventory
     needs: changes
diff --git a/.github/workflows/notary-postgres-conformance.yml b/.github/workflows/notary-postgres-conformance.yml
index 5db5d1b9..6aaf69f8 100644
--- a/.github/workflows/notary-postgres-conformance.yml
+++ b/.github/workflows/notary-postgres-conformance.yml
@@ -56,6 +56,7 @@ env:
 jobs:
   state-plane:
     name: Notary state plane (PostgreSQL ${{ matrix.postgresql }})
+    if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     strategy:
@@ -76,12 +77,79 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           fetch-depth: 0
+          persist-credentials: false
           submodules: false
 
       - name: Cache Cargo registry and build artifacts
         uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
-          key: notary-postgresql-${{ matrix.postgresql }}
+          key: notary-postgresql-pr-${{ matrix.postgresql }}
+
+      - name: Build Registry Notary with CEL support
+        run: cargo build --locked -p registry-notary --features registry-notary-cel
+
+      - name: Precompile PostgreSQL conformance tests before service startup
+        run: cargo test --locked -p registry-notary-server --lib --no-run
+
+      - name: Run Notary PostgreSQL conformance
+        env:
+          NOTARY_BIN: target/notary-postgres-conformance/debug/registry-notary
+          NOTARY_POSTGRES_SOURCE_IMAGE: ${{ matrix.source_image }}
+          NOTARY_POSTGRES_TARGET_IMAGE: ${{ matrix.target_image }}
+        run: |
+          set -euo pipefail
+          diagnostics="${RUNNER_TEMP}/notary-postgresql-${{ matrix.postgresql }}-docker-events.log"
+          docker events --format '{{json .}}' >"${diagnostics}" &
+          events_pid=$!
+          trap 'kill "${events_pid}" 2>/dev/null || true; wait "${events_pid}" 2>/dev/null || true' EXIT
+          products/notary/scripts/postgresql-conformance.sh "${{ matrix.postgresql }}"
+
+      - name: Report PostgreSQL Docker diagnostics
+        if: failure()
+        run: |
+          set -euo pipefail
+          diagnostics="${RUNNER_TEMP}/notary-postgresql-${{ matrix.postgresql }}-docker-events.log"
+          if [[ -s "${diagnostics}" ]]; then
+            sed -n '1,400p' "${diagnostics}"
+          else
+            echo "No Docker events were captured."
+          fi
+          docker ps --all --no-trunc
+          docker version
+
+  state-plane-coverage:
+    name: Notary state plane (PostgreSQL ${{ matrix.postgresql }})
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - postgresql: "16"
+            source_image: postgres:16.13-alpine
+            target_image: postgres:16.14-alpine
+          - postgresql: "17"
+            source_image: postgres:17.9-alpine
+            target_image: postgres:17.10-alpine
+          - postgresql: "18"
+            source_image: postgres:18.3-alpine
+            target_image: postgres:18.4-alpine
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          submodules: false
+
+      - name: Cache Cargo registry and build artifacts
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          key: notary-postgresql-coverage-${{ matrix.postgresql }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Install pinned coverage tool
@@ -138,6 +206,17 @@ jobs:
           path: target/notary-postgres-conformance/coverage/
           if-no-files-found: error
 
+      - name: Upload Notary PostgreSQL coverage to Codecov
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          disable_search: true
+          fail_ci_if_error: false
+          files: target/notary-postgres-conformance/coverage/notary-postgresql-${{ matrix.postgresql }}.lcov
+          flags: notary-postgres
+          name: notary-postgresql-${{ matrix.postgresql }}
+          use_oidc: true
+          version: v11.3.1
+
       - name: Report PostgreSQL Docker diagnostics
         if: failure()
         run: |
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 00000000..938c4860
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,42 @@
+coverage:
+  status:
+    default_rules:
+      flag_coverage_not_uploaded_behavior: exclude
+    project:
+      default: off
+      platform:
+        flags:
+          - platform
+        informational: true
+      notary-postgres:
+        flags:
+          - notary-postgres
+        informational: true
+    patch:
+      default: off
+      platform:
+        flags:
+          - platform
+        informational: true
+      notary-postgres:
+        flags:
+          - notary-postgres
+        informational: true
+
+flags:
+  platform:
+    paths:
+      - "crates/registry-config-report/"
+      - "crates/registry-platform-*/**"
+    carryforward: true
+  notary-postgres:
+    paths:
+      - "crates/registry-notary/"
+      - "crates/registry-notary-server/"
+    carryforward: true
+
+comment:
+  layout: "reach, diff, flags, files"
+  behavior: default
+  require_changes: true
+  show_carryforward_flags: true