diff --git a/.github/codecov.yml b/.github/codecov.yml
index cbc4185fa81..36d71df8cf2 100644
--- a/.github/codecov.yml
+++ b/.github/codecov.yml
@@ -1,17 +1,42 @@
-comment:
-  layout: "condensed_header, condensed_files, condensed_footer"
-  behavior: default
-  require_changes: "uncovered_patch" # only post comment if the patch has uncovered lines
-  hide_project_coverage: true # only show coverage on the git diff
+codecov:
+  require_ci_to_pass: false
+  # Wait for all coverage uploads (4 server shards + 1 webapp) before
+  # computing status. Without this, Codecov may report partial coverage
+  # from the first shard to finish, showing a misleading drop on the PR.
+  notify:
+    after_n_builds: 5
+
 coverage:
   status:
-    changes: false
-    patch: false
     project:
       default:
-        threshold: 1.0
-codecov:
-  notify:
-    after_n_builds: 2 # Server and webapp at this point
-ignore:
-  - ^store/storetest.*
+        target: auto
+        threshold: 1%
+        informational: true
+    patch:
+      default:
+        target: 50%
+        informational: true
+
+  # Exclude generated code, mocks, and test infrastructure from reporting.
+  # Go compiles these into the test binary, so they appear in cover.out,
+  # but they aren't production code and inflate the denominator.
+  ignore:
+    - "server/**/retrylayer/**"
+    - "server/**/timerlayer/**"
+    - "server/**/*_serial_gen.go"
+    - "server/**/mocks/**"
+    - "server/**/storetest/**"
+    - "server/**/plugintest/**"
+    - "server/**/searchtest/**"
+
+flags:
+  server:
+    after_n_builds: 4 # 4 server test shards
+  webapp:
+    after_n_builds: 1 # 1 merged webapp upload
+
+comment:
+  layout: "condensed_header,diff,flags"
+  behavior: default
+  require_changes: true
diff --git a/.github/workflows/server-ci.yml b/.github/workflows/server-ci.yml
index 2c80b1761fb..601e5505e8b 100644
--- a/.github/workflows/server-ci.yml
+++ b/.github/workflows/server-ci.yml
@@ -271,22 +271,27 @@ jobs:
       artifact-name: postgres-server-fips-test-logs
 
   test-coverage:
-    name: Generate Test Coverage
-    # Disabled: Running out of memory and causing spurious failures.
-    # Old condition: ${{ github.event_name != 'pull_request' || !startsWith(github.event.pull_request.base.ref, 'release-') }}
-    if: false
+    name: "Coverage (shard ${{ matrix.shard }})"
+    if: ${{ github.event_name != 'pull_request' || !startsWith(github.event.pull_request.base.ref, 'release-') }}
     needs: go
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [0, 1, 2, 3]
     uses: ./.github/workflows/server-test-template.yml
     secrets: inherit
     with:
-      name: Generate Test Coverage
+      name: "Coverage (shard ${{ matrix.shard }})"
       datasource: postgres://mmuser:mostest@postgres:5432/mattermost_test?sslmode=disable&connect_timeout=10
       drivername: postgres
-      logsartifact: coverage-server-test-logs
+      logsartifact: "coverage-server-test-logs-shard-${{ matrix.shard }}"
       fullyparallel: true
       allow-failure: true
       enablecoverage: true
       go-version: ${{ needs.go.outputs.version }}
+      fips-enabled: false
+      shard-index: ${{ matrix.shard }}
+      shard-total: 4
   test-mmctl:
     name: Run mmctl tests
     needs: go
diff --git a/.github/workflows/server-test-template.yml b/.github/workflows/server-test-template.yml
index 2e67e79aa2a..a5ee54e7c63 100644
--- a/.github/workflows/server-test-template.yml
+++ b/.github/workflows/server-test-template.yml
@@ -22,6 +22,10 @@ on:
         required: false
         type: boolean
         default: false
+      allow-failure:
+        required: false
+        type: boolean
+        default: false
       enablecoverage:
         required: false
         type: boolean
@@ -222,6 +226,7 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
           disable_search: true
           files: server/cover.out
+          flags: server
 
       - name: Stop docker compose
         run: |
diff --git a/.github/workflows/webapp-ci.yml b/.github/workflows/webapp-ci.yml
index 65fa9ab9f8d..869413d7e58 100644
--- a/.github/workflows/webapp-ci.yml
+++ b/.github/workflows/webapp-ci.yml
@@ -223,6 +223,7 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
           disable_search: true
           files: ./webapp/channels/coverage/merged/lcov.info
+          flags: webapp
 
   build:
     needs: check-lint
diff --git a/server/scripts/run-shard-tests.sh b/server/scripts/run-shard-tests.sh
index 57c55ab059d..688e3f2019e 100755
--- a/server/scripts/run-shard-tests.sh
+++ b/server/scripts/run-shard-tests.sh
@@ -108,6 +108,20 @@ fi
 
 cat gotestsum-*.json > gotestsum.json 2>/dev/null || true
 
+# ── Merge coverage profiles within this shard (if coverage is enabled) ──
+# A single shard may run multiple gotestsum invocations (light packages +
+# heavy package splits), each producing its own cover-N.out. This merges
+# them into one cover.out per shard. The cross-shard merge (combining all
+# shards into a single report) is handled by Codecov's after_n_builds.
+if [[ "${ENABLE_COVERAGE:-false}" == "true" ]] && ls cover-*.out 1>/dev/null 2>&1; then
+  echo "Merging coverage profiles..."
+  {
+    head -1 cover-0.out  # "mode: atomic" header
+    tail -q -n +2 cover-*.out  # data lines from all files
+  } > cover.out
+  echo "Merged $(ls cover-*.out | wc -l) coverage files into cover.out"
+fi
+
 if [[ $FAILURES -gt 0 ]]; then
   echo "Shard complete: $RUN_IDX gotestsum runs, $FAILURES failed"
   exit 1