diff --git a/.core-services/repository-contract.json b/.core-services/repository-contract.json
index c63b9cc..b87efae 100644
--- a/.core-services/repository-contract.json
+++ b/.core-services/repository-contract.json
@@ -42,14 +42,6 @@
       "rationale": "Every dependency here is a devDependency, which run_npm_audit omits, so the job would audit nothing. App CI runs npm run audit:npm on the full tree instead.",
       "owner": "@OpenSesame/core-domain-operators",
       "isWarning": true
-    },
-    {
-      "id": "no-sonar-project",
-      "requirement": "ci-job:sonar",
-      "paths": [".github/workflows/on_push_ci.yml"],
-      "rationale": "core-github-actions has no SonarCloud project; add the Sonar job when one exists.",
-      "owner": "@OpenSesame/core-domain-operators",
-      "isWarning": true
     }
   ]
 }
diff --git a/.github/workflows/on_push_ci.yml b/.github/workflows/on_push_ci.yml
index 3eb5b53..a6fcb26 100644
--- a/.github/workflows/on_push_ci.yml
+++ b/.github/workflows/on_push_ci.yml
@@ -58,9 +58,19 @@ jobs:
         run: npm run audit:npm
 
       - name: Test
+        id: test
         if: ${{ !cancelled() && steps.install.outcome == 'success' }}
         run: npm run test
 
+      - name: Upload coverage
+        if: ${{ !cancelled() && steps.test.outcome != 'skipped' }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: coverage-core-github-actions
+          path: coverage/lcov.info
+          if-no-files-found: error
+          retention-days: 7
+
   repo-checks:
     name: Repo Checks
     needs: ci-context
@@ -88,9 +98,21 @@ jobs:
       semgrep-targets: './*.js ./*.mjs ./*.json scripts/ .github/actions/'
       semgrep-scan-mode: ${{ github.ref_name == github.event.repository.default_branch && 'full' || 'diff' }}
 
+  sonar:
+    name: Sonar
+    needs: [ci-context, app-ci]
+    if: ${{ !cancelled() && needs.ci-context.outputs.should-run-ci == 'true' }}
+    uses: ./.github/workflows/run_sonar_scan.yml
+    permissions:
+      contents: read # Required to check out the code to scan.
+    with:
+      commit-identifier: ${{ needs.ci-context.outputs.commit-identifier }}
+    secrets:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+
   ci-result:
     name: CI Result
-    needs: [ci-context, app-ci, repo-checks, semgrep]
+    needs: [ci-context, app-ci, repo-checks, semgrep, sonar]
     if: ${{ !cancelled() && needs.ci-context.outputs.should-run-ci != 'false' }}
     runs-on: ubuntu-26.04
     permissions: {}
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..600eaae
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,31 @@
+# SonarQube project settings.
+sonar.organization=opensesame
+sonar.projectKey=OpenSesame_core-github-actions
+sonar.projectName=core-github-actions
+sonar.host.url=https://sonarcloud.io
+sonar.sourceEncoding=UTF-8
+
+# Analyze the reusable workflows, composite actions, and scripts.
+sonar.sources=.
+
+# Jest tests sit under .github/workflows/TESTS (with their helpers) and next to the scripts.
+sonar.tests=.
+sonar.test.inclusions=\
+  **/*.test.js,\
+  .github/workflows/TESTS/**
+
+# Keep the main and test sets disjoint, and skip dependencies and files managed by the
+# repository validator kit.
+sonar.exclusions=\
+  **/*.test.js,\
+  .github/workflows/TESTS/**,\
+  **/node_modules/**,\
+  .vscode/**,\
+  .core-services/*/**,\
+  .core-services/README.md,\
+  .core-services/repository-contract.schema.json,\
+  .core-services/repository-standard.json,\
+  .core-services/validator-manifest.json
+
+# CI downloads the coverage-* artifacts into .sonar-coverage/.
+sonar.javascript.lcov.reportPaths=.sonar-coverage/**/lcov.info