diff --git a/.forgejo/workflows/coverage.yml b/.forgejo/workflows/coverage.yml
index 013285eb..2edba45c 100644
--- a/.forgejo/workflows/coverage.yml
+++ b/.forgejo/workflows/coverage.yml
@@ -1,21 +1,18 @@
 name: coverage
 
-# Manual dispatch ONLY — deliberately not on `pull_request`, and
-# deliberately not nightly.
+# Nightly plus manual dispatch. The report is uploaded as an artifact rather
+# than printed into the run log, so a scheduled run leaves something to fetch.
 #
-# A coverage run needs its own instrumented build: it cannot reuse the
-# normal test artifacts, so it roughly doubles a test job. Coverage here
-# answers "do we have glaring holes", which is a question someone asks
-# occasionally — not a gate every PR pays for, and not a number worth
-# spending farm time on every night whether or not anyone reads it.
-# Manual dispatch costs nothing until someone wants the answer.
+# ⚠️ The hour is deliberate: at the default job capacity of 1
+# (`services.hyperhive.deploy.forgejo.ci.concurrency`) this job holds the
+# runner for its whole timeout and everything else queues behind it.
 #
-# Its own file rather than a job in ci.yml: that workflow already has a
-# `workflow_dispatch` trigger (so `hive-forge ci-rerun` can retrigger
-# without an empty commit), and a trigger there fires EVERY job in the
-# file. A coverage job added to ci.yml would run on every pull request.
+# Separate from ci.yml because a `workflow_dispatch` trigger there fires every
+# job in that file, and this must not run per pull request.
 on:
   workflow_dispatch:
+  schedule:
+    - cron: "0 2 * * *"
 
 jobs:
   coverage:
@@ -37,4 +34,16 @@ jobs:
         # nobody runs directly, and the per-crate default would hide
         # exactly those behind a green summary for the one crate someone
         # happened to name.
-        run: nix develop -c cargo llvm-cov --workspace --summary-only
+        #
+        # `pipefail` or the step reports `tee`'s status, and a failed run
+        # uploads an empty report as a success.
+        run: |
+          set -o pipefail
+          nix develop -c cargo llvm-cov --workspace --summary-only | tee coverage-summary.txt
+      - name: keep the report
+        # `always()`: a failed run should still leave its partial output.
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: coverage-summary
+          path: coverage-summary.txt