diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
new file mode 100644
index 0000000..3a84c41
--- /dev/null
+++ b/.github/workflows/sonar.yml
@@ -0,0 +1,48 @@
+name: Sonar
+
+# SonarCloud analysis runs once per day (07:00 UTC) on main, plus on-demand
+# via the workflow_dispatch button. Kept out of the per-push CI workflow to
+# keep PRs fast and reduce SonarCloud quota usage.
+on:
+  schedule:
+    - cron: '0 7 * * *'
+  workflow_dispatch:
+
+jobs:
+  sonar:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout (with zstd submodule)
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          # Full history needed for line-level blame / new-code computation.
+          fetch-depth: 0
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '25'
+          cache: maven
+
+      - name: Set up Zig
+        uses: mlugg/setup-zig@v2
+        with:
+          version: 0.16.0
+
+      - name: Cache SonarCloud packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.sonar/cache
+          key: ${{ runner.os }}-sonar
+          restore-keys: ${{ runner.os }}-sonar
+
+      - name: Build, test, and Sonar analysis
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          ./mvnw -B -ntp verify -P coverage \
+            org.sonarsource.scanner.maven:sonar-maven-plugin:sonar
diff --git a/README.md b/README.md
index e7888bd..8f10689 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,8 @@
 # zstd-java
 
 [![CI](https://github.com/dfa1/zstd-java/actions/workflows/ci.yml/badge.svg)](https://github.com/dfa1/zstd-java/actions/workflows/ci.yml)
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=dfa1_zstd-java&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=dfa1_zstd-java)
+[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=dfa1_zstd-java&metric=coverage)](https://sonarcloud.io/summary/new_code?id=dfa1_zstd-java)
 [![Maven Central](https://img.shields.io/maven-central/v/io.github.dfa1.zstd/zstd.svg?label=Maven%20Central)](https://central.sonatype.com/artifact/io.github.dfa1.zstd/zstd)
 ![zstd](https://img.shields.io/badge/zstd-1.5.7-green.svg)
 ![Java](https://img.shields.io/badge/Java-25%2B-orange.svg)
diff --git a/integration-tests/pom.xml b/integration-tests/pom.xml
index 1fec416..9e31725 100644
--- a/integration-tests/pom.xml
+++ b/integration-tests/pom.xml
@@ -23,11 +23,13 @@
 	</properties>
 
 	<dependencies>
+		<!-- The library under test. Compile scope (not test) so jacoco
+		     report-aggregate pulls its classes into the integration coverage
+		     report; this module is never published (maven.deploy.skip=true). -->
 		<dependency>
 			<groupId>io.github.dfa1.zstd</groupId>
 			<artifactId>zstd</artifactId>
 			<version>${project.version}</version>
-			<scope>test</scope>
 		</dependency>
 		<dependency>
 			<groupId>com.github.luben</groupId>
@@ -49,6 +51,34 @@
 
 	<!-- The matching native library for the host platform (test scope only). -->
 	<profiles>
+		<!-- Activated by ./mvnw verify -P coverage alongside the parent profile.
+		     This module has no main classes; report-aggregate reads the IT
+		     jacoco.exec produced here and reports hits on the zstd classes the
+		     integration tests exercise, so the library's integration coverage
+		     reaches Sonar (see sonar.coverage.jacoco.xmlReportPaths in the parent). -->
+		<profile>
+			<id>coverage</id>
+			<build>
+				<plugins>
+					<plugin>
+						<groupId>org.jacoco</groupId>
+						<artifactId>jacoco-maven-plugin</artifactId>
+						<executions>
+							<execution>
+								<id>report-aggregate</id>
+								<phase>verify</phase>
+								<goals>
+									<goal>report-aggregate</goal>
+								</goals>
+								<configuration>
+									<outputDirectory>${project.reporting.outputDirectory}/jacoco-aggregate</outputDirectory>
+								</configuration>
+							</execution>
+						</executions>
+					</plugin>
+				</plugins>
+			</build>
+		</profile>
 		<profile>
 			<id>native-osx-aarch64</id>
 			<activation>
diff --git a/pom.xml b/pom.xml
index c10ed6c..e83f275 100644
--- a/pom.xml
+++ b/pom.xml
@@ -57,6 +57,33 @@
 		<maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
 		<maven-release-plugin.version>3.3.1</maven-release-plugin.version>
 		<maven-jar-plugin.version>3.4.2</maven-jar-plugin.version>
+		<jacoco-maven-plugin.version>0.8.15</jacoco-maven-plugin.version>
+
+		<!-- SonarCloud analysis (.github/workflows/sonar.yml). -->
+		<sonar.host.url>https://sonarcloud.io</sonar.host.url>
+		<sonar.organization>dfa11</sonar.organization>
+		<sonar.projectKey>dfa1_zstd-java</sonar.projectKey>
+		<!-- The benchmark module is JMH main code with no tests by design, and the
+		     native modules carry no Java sources — neither should drag the coverage
+		     ratio. Exclude from coverage. -->
+		<sonar.coverage.exclusions>
+			**/benchmark/**
+		</sonar.coverage.exclusions>
+		<!-- Coverage sources Sonar ingests:
+		     1. per-module surefire (unit tests) — target/site/jacoco/jacoco.xml
+		     2. integration-tests aggregate — report-aggregate there reads the IT
+		        jacoco.exec and reports hits on the zstd classes it exercises, so the
+		        library's integration coverage lands on Sonar too. -->
+		<sonar.coverage.jacoco.xmlReportPaths>
+			${project.build.directory}/site/jacoco/jacoco.xml,
+			${maven.multiModuleProjectDirectory}/integration-tests/target/site/jacoco-aggregate/jacoco.xml
+		</sonar.coverage.jacoco.xmlReportPaths>
+
+		<!-- Default for the @{argLine} placeholder in the surefire config below.
+		     JaCoCo's prepare-agent overwrites this property with the agent args when
+		     the coverage profile is active; the empty default keeps surefire from
+		     receiving a literal @{argLine} token when it is not. -->
+		<argLine />
 	</properties>
 
 	<dependencyManagement>
@@ -150,9 +177,16 @@
 					<artifactId>maven-surefire-plugin</artifactId>
 					<version>3.5.6</version>
 					<configuration>
-						<argLine>--enable-native-access=ALL-UNNAMED</argLine>
+						<!-- @{argLine} carries JaCoCo's agent when the coverage profile is
+						     active (empty otherwise); the native-access flag is always on. -->
+						<argLine>@{argLine} --enable-native-access=ALL-UNNAMED</argLine>
 					</configuration>
 				</plugin>
+				<plugin>
+					<groupId>org.jacoco</groupId>
+					<artifactId>jacoco-maven-plugin</artifactId>
+					<version>${jacoco-maven-plugin.version}</version>
+				</plugin>
 				<plugin>
 					<groupId>org.codehaus.mojo</groupId>
 					<artifactId>exec-maven-plugin</artifactId>
@@ -257,6 +291,35 @@
 	</build>
 
 	<profiles>
+		<!-- Activated in CI for Sonar: ./mvnw verify -P coverage
+		     Attaches the JaCoCo agent to surefire (via the @{argLine} placeholder)
+		     and writes one target/site/jacoco/jacoco.xml per module. -->
+		<profile>
+			<id>coverage</id>
+			<build>
+				<plugins>
+					<plugin>
+						<groupId>org.jacoco</groupId>
+						<artifactId>jacoco-maven-plugin</artifactId>
+						<executions>
+							<execution>
+								<id>prepare-agent</id>
+								<goals>
+									<goal>prepare-agent</goal>
+								</goals>
+							</execution>
+							<execution>
+								<id>report</id>
+								<phase>verify</phase>
+								<goals>
+									<goal>report</goal>
+								</goals>
+							</execution>
+						</executions>
+					</plugin>
+				</plugins>
+			</build>
+		</profile>
 		<!-- Cut a release with maven-release-plugin (configured in build above):
 		       ./mvnw release:prepare
 		     drops -SNAPSHOT, commits, tags v<version> (pushChanges=false), then