diff --git a/.github/actions/rustup.yml b/.github/actions/rustup.yml
new file mode 100644
index 0000000000..27f739b61b
--- /dev/null
+++ b/.github/actions/rustup.yml
@@ -0,0 +1,84 @@
+name: Rustup
+
+description: Install Rust with minimal profile and additional components
+
+inputs:
+  # See https://rust-lang.github.io/rustup/concepts/components.html
+  clippy:
+    default: false
+    required: false
+    type: boolean
+  fmt:
+    default: false
+    required: false
+    type: boolean
+  docs:
+    default: false
+    required: false
+    type: boolean
+  restore-cache:
+    default: true
+    required: false
+    type: boolean
+  save-cache:
+    default: false
+    required: false
+    type: boolean
+  shared-key:
+    default: 'warm'
+    required: false
+    type: string
+
+runs:
+  using: composite
+  steps:
+    - name: Print Inputs
+      shell: bash
+      run: |
+        echo 'clippy: ${{ inputs.clippy }}'
+        echo 'fmt: ${{ inputs.fmt }}'
+        echo 'docs: ${{ inputs.docs }}'
+        echo 'restore-cache: ${{ inputs.restore-cache }}'
+        echo 'save-cache: ${{ inputs.save-cache }}'
+
+    - name: Remove `profile` line on MacOS
+      shell: bash
+      if: runner.os == 'macOS'
+      run: sed -i '' '/profile/d' rust-toolchain.toml
+
+    - name: Remove `profile` line on non-MacOS
+      shell: bash
+      if: runner.os != 'macOS'
+      run: sed -i '/profile/d' rust-toolchain.toml
+
+    - name: Set minimal
+      shell: bash
+      run: rustup set profile minimal
+
+    - name: Add Clippy
+      shell: bash
+      if: ${{ inputs.clippy == 'true' }}
+      run: rustup component add clippy
+
+    - name: Add Rustfmt
+      shell: bash
+      if: ${{ inputs.fmt == 'true' }}
+      run: rustup component add rustfmt
+
+    - name: Add docs
+      shell: bash
+      if: ${{ inputs.docs == 'true' }}
+      run: rustup component add rust-docs
+
+    - name: Install
+      shell: bash
+      run: |
+        rustup show
+        git restore .
+
+    - name: Cache on ${{ github.ref_name }}
+      uses: Swatinem/rust-cache@v2
+      if: ${{ inputs.restore-cache == 'true' }}
+      with:
+        shared-key: ${{ inputs.shared-key }}
+        save-if: ${{ inputs.save-cache == 'true' }}
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
new file mode 100644
index 0000000000..35420b8f2e
--- /dev/null
+++ b/.github/workflows/codecov.yml
@@ -0,0 +1,74 @@
+# Run cargo-llvm-cov and upload to codecov.io
+
+name: Code Coverage
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - '**.rs'
+      - '.github/workflows/codecov.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref_name != 'main' }}
+
+jobs:
+  coverage:
+    name: Code Coverage
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Clone submodules
+        uses: ./.github/actions/clone-submodules
+
+      - name: Install Rust Toolchain
+        uses: ./.github/actions/rustup
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-llvm-cov
+
+      - name: Install llvm-tools-preview for llvm-cov
+        run: rustup component add llvm-tools-preview
+
+      - name: Run
+        run: cargo codecov --lcov --output-path lcov.info
+
+      - name: Upload Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: codecov
+          path: lcov.info
+
+  # codecov often fails, use another workflow for retry
+  upload-codecov:
+    name: Upload coverage file
+    runs-on: ubuntu-latest
+    needs: coverage
+    # Check if the event is not triggered by a fork by checking whether CODECOV_TOKEN is set
+    env:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+    steps:
+      - name: Checkout
+        if: env.CODECOV_TOKEN
+        uses: actions/checkout@v4
+
+      - name: Download coverage file
+        if: env.CODECOV_TOKEN
+        uses: actions/download-artifact@v4
+        with:
+          name: codecov
+
+      - name: Upload to codecov.io
+        if: env.CODECOV_TOKEN
+        uses: codecov/codecov-action@v4
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: true
+          files: lcov.info