diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 7226924bc73..cafd975dd6f 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -230,7 +230,14 @@
 # Language Platform
 /* @DataDog/lang-platform-js
 
+/.github/actions/ @DataDog/lang-platform-js
+
 /integration-tests/bun/ @DataDog/lang-platform-js
+/integration-tests/coverage/ @DataDog/lang-platform-js
+/integration-tests/coverage-child-process.spec.js @DataDog/lang-platform-js
+/integration-tests/coverage-fixtures/parent.js @DataDog/lang-platform-js
+/integration-tests/coverage-fixtures/worker.js @DataDog/lang-platform-js
+/integration-tests/coverage-manual-process.spec.js @DataDog/lang-platform-js
 /integration-tests/init.spec.js @DataDog/lang-platform-js
 /integration-tests/package-guardrails.spec.js @DataDog/lang-platform-js
 /integration-tests/package-guardrails/flush.js @DataDog/lang-platform-js
diff --git a/.github/actions/plugins/upstream/action.yml b/.github/actions/plugins/upstream/action.yml
index eb875f49895..06479545273 100644
--- a/.github/actions/plugins/upstream/action.yml
+++ b/.github/actions/plugins/upstream/action.yml
@@ -13,10 +13,9 @@ runs:
     - uses: ./.github/actions/node/latest
     - run: yarn test:plugins:upstream
       shell: bash
-    - uses: ./.github/actions/coverage
-      with:
-        flags: plugins-upstream-${{ github.job }}
-        dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
+    # `test:plugins:upstream` runs each plugin's upstream test suite (e.g., axios's own tests)
+    # against the unit-test harness, which intentionally does not produce NYC coverage for
+    # dd-trace. Skip the coverage/upload step entirely here.
     - if: always()
       uses: ./.github/actions/testagent/logs
       with:
diff --git a/.github/actions/testagent/logs/action.yml b/.github/actions/testagent/logs/action.yml
index 0dbc06e819a..9b2528883a8 100644
--- a/.github/actions/testagent/logs/action.yml
+++ b/.github/actions/testagent/logs/action.yml
@@ -11,6 +11,11 @@ runs:
   using: composite
   steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        # Preserve untracked artifacts (coverage/, .nyc_output/, node_modules/) produced by earlier
+        # test steps. Without this, the default `git clean -ffdx` wipes them before subsequent
+        # steps such as Codecov upload can pick them up.
+        clean: false
     - name: Create Artifacts Directories
       run: |
         mkdir -p "./artifacts/logs"
diff --git a/.github/workflows/aiguard.yml b/.github/workflows/aiguard.yml
index 6383a30a4dc..cf4d4c9a6d3 100644
--- a/.github/workflows/aiguard.yml
+++ b/.github/workflows/aiguard.yml
@@ -102,7 +102,11 @@ jobs:
         with:
           version: ${{ matrix.version }}
       - uses: ./.github/actions/install
-      - run: yarn test:integration:aiguard
+      - run: yarn test:integration:aiguard:coverage
+      - uses: ./.github/actions/coverage
+        with:
+          flags: aiguard-integration-${{ matrix.version }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
       - uses: ./.github/actions/push_to_test_optimization
         if: "!cancelled()"
         with:
diff --git a/.github/workflows/appsec.yml b/.github/workflows/appsec.yml
index 21148617dfa..a11d17cf62c 100644
--- a/.github/workflows/appsec.yml
+++ b/.github/workflows/appsec.yml
@@ -468,7 +468,11 @@ jobs:
         with:
           version: ${{ matrix.version }}
       - uses: ./.github/actions/install
-      - run: yarn test:integration:appsec
+      - run: yarn test:integration:appsec:coverage
+      - uses: ./.github/actions/coverage
+        with:
+          flags: appsec-integration-${{ matrix.version }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
       - uses: ./.github/actions/push_to_test_optimization
         if: "!cancelled()"
         with:
diff --git a/.github/workflows/debugger.yml b/.github/workflows/debugger.yml
index bcea3b25225..7116ded8ef1 100644
--- a/.github/workflows/debugger.yml
+++ b/.github/workflows/debugger.yml
@@ -34,7 +34,7 @@ jobs:
       - uses: ./.github/actions/install
       - run: yarn test:code-origin:ci
       - run: yarn test:debugger:ci
-      - run: yarn test:integration:debugger
+      - run: yarn test:integration:debugger:coverage
       - if: always()
         uses: ./.github/actions/testagent/logs
         with:
diff --git a/.github/workflows/openfeature.yml b/.github/workflows/openfeature.yml
index a98d0da99ba..ba4bd5d1379 100644
--- a/.github/workflows/openfeature.yml
+++ b/.github/workflows/openfeature.yml
@@ -57,7 +57,11 @@ jobs:
         id: dd-sts
       - uses: ./.github/actions/node/latest
       - uses: ./.github/actions/install
-      - run: yarn test:integration:openfeature
+      - run: yarn test:integration:openfeature:coverage
+      - uses: ./.github/actions/coverage
+        with:
+          flags: openfeature-macos
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
       - uses: ./.github/actions/push_to_test_optimization
         if: "!cancelled()"
         with:
@@ -74,13 +78,17 @@ jobs:
         id: dd-sts
       - uses: ./.github/actions/node/oldest-maintenance-lts
       - uses: ./.github/actions/install
-      - run: yarn test:integration:openfeature
+      - run: yarn test:integration:openfeature:coverage
       - uses: ./.github/actions/node/newest-maintenance-lts
-      - run: yarn test:integration:openfeature
+      - run: yarn test:integration:openfeature:coverage
       - uses: ./.github/actions/node/active-lts
-      - run: yarn test:integration:openfeature
+      - run: yarn test:integration:openfeature:coverage
       - uses: ./.github/actions/node/latest
-      - run: yarn test:integration:openfeature
+      - run: yarn test:integration:openfeature:coverage
+      - uses: ./.github/actions/coverage
+        with:
+          flags: openfeature-ubuntu
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
       - uses: ./.github/actions/push_to_test_optimization
         if: "!cancelled()"
         with:
@@ -99,7 +107,11 @@ jobs:
       - uses: ./.github/actions/install
         with:
           cache: "true"
-      - run: yarn test:integration:openfeature
+      - run: yarn test:integration:openfeature:coverage
+      - uses: ./.github/actions/coverage
+        with:
+          flags: openfeature-windows
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
       - uses: ./.github/actions/push_to_test_optimization
         if: "!cancelled()"
         with:
diff --git a/.github/workflows/platform.yml b/.github/workflows/platform.yml
index b38cb931012..af63cf53ec7 100644
--- a/.github/workflows/platform.yml
+++ b/.github/workflows/platform.yml
@@ -494,9 +494,13 @@ jobs:
       # Disable core dumps since some integration tests intentionally abort and core dump generation takes around 5-10s
       - uses: ./.github/actions/install
       - run: sudo sysctl -w kernel.core_pattern='|/bin/false'
-      - run: yarn test:integration
+      - run: yarn test:integration:coverage
       - run: yarn test:integration:esbuild
       - run: yarn test:integration:webpack
+      - uses: ./.github/actions/coverage
+        with:
+          flags: platform-integration-${{ matrix.version }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
       - uses: ./.github/actions/push_to_test_optimization
         if: "!cancelled()"
         with:
diff --git a/.github/workflows/profiling.yml b/.github/workflows/profiling.yml
index b871f196482..626574dd4de 100644
--- a/.github/workflows/profiling.yml
+++ b/.github/workflows/profiling.yml
@@ -34,7 +34,7 @@ jobs:
       - uses: ./.github/actions/node/latest
       - uses: ./.github/actions/install
       - run: yarn test:profiler:ci
-      - run: yarn test:integration:profiler
+      - run: yarn test:integration:profiler:coverage
       - uses: ./.github/actions/coverage
         with:
           flags: profiling-macos
@@ -56,16 +56,16 @@ jobs:
       - uses: ./.github/actions/node/oldest-maintenance-lts
       - uses: ./.github/actions/install
       - run: yarn test:profiler:ci
-      - run: yarn test:integration:profiler
+      - run: yarn test:integration:profiler:coverage
       - uses: ./.github/actions/node/newest-maintenance-lts
       - run: yarn test:profiler:ci
-      - run: yarn test:integration:profiler
+      - run: yarn test:integration:profiler:coverage
       - uses: ./.github/actions/node/active-lts
       - run: yarn test:profiler:ci
-      - run: yarn test:integration:profiler
+      - run: yarn test:integration:profiler:coverage
       - uses: ./.github/actions/node/latest
       - run: yarn test:profiler:ci
-      - run: yarn test:integration:profiler
+      - run: yarn test:integration:profiler:coverage
       - uses: ./.github/actions/coverage
         with:
           flags: profiling-ubuntu
@@ -89,7 +89,7 @@ jobs:
         with:
           cache: "true"
       - run: yarn test:profiler:ci
-      - run: yarn test:integration:profiler
+      - run: yarn test:integration:profiler:coverage
       - uses: ./.github/actions/coverage
         with:
           flags: profiling-windows
diff --git a/.github/workflows/test-optimization.yml b/.github/workflows/test-optimization.yml
index 5aab207089e..1a62a009535 100644
--- a/.github/workflows/test-optimization.yml
+++ b/.github/workflows/test-optimization.yml
@@ -41,8 +41,12 @@ jobs:
         version: [oldest, maintenance, active, latest]
     name: ${{ github.workflow }} / integration (node-${{ matrix.version }})
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/dd-sts-api-key
+        id: dd-sts
       - uses: ./.github/actions/node
         with:
           version: ${{ matrix.version }}
@@ -58,7 +62,11 @@ jobs:
         with:
           path: ~/.cache/ms-playwright
           key: playwright-browsers-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}
-      - run: yarn test:integration:testopt
+      - run: yarn test:integration:testopt:coverage
+      - uses: ./.github/actions/coverage
+        with:
+          flags: test-optimization-testopt-${{ matrix.version }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
 
   integration-playwright:
     strategy:
@@ -103,10 +111,14 @@ jobs:
         with:
           path: /github/home/.cache/ms-playwright
           key: playwright-browsers-oldest-dd${{ steps.dd-version.outputs.major }}
-      - run: yarn test:integration:playwright
+      - run: yarn test:integration:playwright:coverage
         env:
           NODE_OPTIONS: "-r ./ci/init"
           DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+      - uses: ./.github/actions/coverage
+        with:
+          flags: test-optimization-playwright-${{ matrix.node-version }}-${{ matrix.playwright-version }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
 
   integration-mocha:
     strategy:
@@ -127,11 +139,15 @@ jobs:
         with:
           version: ${{ matrix.version }}
       - uses: ./.github/actions/install
-      - run: yarn test:integration:mocha
+      - run: yarn test:integration:mocha:coverage
         env:
           NODE_OPTIONS: "-r ./ci/init"
           MOCHA_VERSION: ${{ matrix.mocha-version }}
           DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+      - uses: ./.github/actions/coverage
+        with:
+          flags: test-optimization-mocha-${{ matrix.version }}-${{ matrix.mocha-version }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
 
   integration-jest:
     strategy:
@@ -152,11 +168,15 @@ jobs:
         with:
           version: ${{ matrix.version }}
       - uses: ./.github/actions/install
-      - run: yarn test:integration:jest
+      - run: yarn test:integration:jest:coverage
         env:
           NODE_OPTIONS: "-r ./ci/init"
           JEST_VERSION: ${{ matrix.jest-version }}
           DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+      - uses: ./.github/actions/coverage
+        with:
+          flags: test-optimization-jest-${{ matrix.version }}-${{ matrix.jest-version }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
 
   integration-cucumber:
     strategy:
@@ -177,11 +197,15 @@ jobs:
         with:
           version: ${{ matrix.version }}
       - uses: ./.github/actions/install
-      - run: yarn test:integration:cucumber
+      - run: yarn test:integration:cucumber:coverage
         env:
           NODE_OPTIONS: "-r ./ci/init"
           CUCUMBER_VERSION: ${{ matrix.cucumber-version }}
           DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+      - uses: ./.github/actions/coverage
+        with:
+          flags: test-optimization-cucumber-${{ matrix.version }}-${{ matrix.cucumber-version }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
 
   integration-selenium:
     strategy:
@@ -219,10 +243,14 @@ jobs:
           sudo mv chromedriver-linux64/chromedriver /usr/bin/chromedriver
           sudo chmod +x /usr/bin/chromedriver
       - uses: ./.github/actions/install
-      - run: yarn test:integration:selenium
+      - run: yarn test:integration:selenium:coverage
         env:
           NODE_OPTIONS: "-r ./ci/init"
           DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+      - uses: ./.github/actions/coverage
+        with:
+          flags: test-optimization-selenium-${{ matrix.version }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
 
   integration-cypress:
     strategy:
@@ -257,13 +285,17 @@ jobs:
           path: ~/.cache/Cypress
           key: cypress-binary-${{ matrix.cypress-version }}
       - run: yarn config set ignore-engines true
-      - run: yarn test:integration:cypress --ignore-engines
+      - run: yarn test:integration:cypress:coverage --ignore-engines
         env:
           CYPRESS_VERSION: ${{ matrix.cypress-version }}
           NODE_OPTIONS: "-r ./ci/init"
           CYPRESS_MODULE_TYPE: ${{ matrix.module-type }}
           OPTIONS_OVERRIDE: 1
           DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+      - uses: ./.github/actions/coverage
+        with:
+          flags: test-optimization-cypress-${{ matrix.version }}-${{ matrix.cypress-version }}-${{ matrix.module-type }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
 
   integration-vitest:
     runs-on: ubuntu-latest
@@ -284,7 +316,11 @@ jobs:
         with:
           version: ${{ matrix.version }}
       - uses: ./.github/actions/install
-      - run: yarn test:integration:vitest
+      - run: yarn test:integration:vitest:coverage
         env:
           NODE_OPTIONS: "-r ./ci/init"
           DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+      - uses: ./.github/actions/coverage
+        with:
+          flags: test-optimization-vitest-${{ matrix.version }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
diff --git a/.gitignore b/.gitignore
index 01f82f977cf..015de8bf422 100644
--- a/.gitignore
+++ b/.gitignore
@@ -47,6 +47,8 @@ lib-cov
 
 # Coverage directory used by tools like istanbul
 coverage/
+!integration-tests/coverage/
+!integration-tests/coverage/**
 *.lcov
 
 # nyc test coverage
diff --git a/.mocharc.js b/.mocharc.js
index e311d7558e2..b28193d417c 100644
--- a/.mocharc.js
+++ b/.mocharc.js
@@ -1,10 +1,15 @@
 'use strict'
 
+// Bump default timeout under NYC / the integration coverage harness; require-hook overhead
+// can push otherwise-fast tests past 5s without indicating a real regression.
+// eslint-disable-next-line eslint-rules/eslint-process-env
+const coverageActive = Boolean(process.env.NYC_CONFIG || process.env.DD_TRACE_INTEGRATION_COVERAGE_ROOT)
+
 module.exports = {
   allowUncaught: true,
   color: true,
   exit: true,
-  timeout: 5000,
+  timeout: coverageActive ? 7500 : 5000,
   require: ['packages/dd-trace/test/setup/mocha.js'],
   reporter: 'mocha-multi-reporters',
   reporterOption: [
diff --git a/eslint.config.mjs b/eslint.config.mjs
index bb79b34eafe..1a1392ee880 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -463,6 +463,18 @@ export default [
       'eslint-rules/eslint-env-aliases': 'error',
       'eslint-rules/eslint-log-printf-style': 'error',
 
+      // Inline `.evaluate(<fn>)` callbacks (Playwright/Puppeteer) are serialized with
+      // `toString()` and run in chromium — NYC counter bumps inside would ReferenceError.
+      // Import the helper from a `*-browser-scripts.js` file (excluded from NYC) instead.
+      'no-restricted-syntax': ['error', {
+        selector:
+          "CallExpression[callee.property.name='evaluate']" +
+          ":matches([arguments.0.type='ArrowFunctionExpression'], [arguments.0.type='FunctionExpression'])",
+        message:
+          'Move the inline `.evaluate(...)` callback into a `*-browser-scripts.js` file ' +
+          '(NYC-excluded in nyc.config.js) and import it here.',
+      }],
+
       'n/no-restricted-require': ['error', [
         ...GLOBAL_RESTRICTED_REQUIRES,
         {
diff --git a/integration-tests/ci-visibility-intake.js b/integration-tests/ci-visibility-intake.js
index 07f19ce3b84..4efef0c4c58 100644
--- a/integration-tests/ci-visibility-intake.js
+++ b/integration-tests/ci-visibility-intake.js
@@ -9,6 +9,7 @@ const multer = require('multer')
 const upload = multer()
 
 const { FakeAgent } = require('./helpers')
+const { COVERAGE_SLOWDOWN } = require('./coverage/runtime')
 
 const DEFAULT_SETTINGS = {
   code_coverage: true,
@@ -363,6 +364,7 @@ class FakeCiVisIntake extends FakeAgent {
   // to make the assertions pass. It times out after maxGatheringTime so it should
   // always be faster or as fast as gatherPayloads
   gatherPayloadsMaxTimeout (payloadMatch, onPayload, maxGatheringTime = 15000) {
+    maxGatheringTime *= COVERAGE_SLOWDOWN
     const payloads = []
     return new Promise((resolve, reject) => {
       const timeoutId = setTimeout(() => {
@@ -394,6 +396,7 @@ class FakeCiVisIntake extends FakeAgent {
   }
 
   gatherPayloads (payloadMatch, gatheringTime = 15000) {
+    gatheringTime *= COVERAGE_SLOWDOWN
     const payloads = []
     return new Promise((resolve, reject) => {
       setTimeout(() => {
diff --git a/integration-tests/code-origin.spec.js b/integration-tests/code-origin.spec.js
index 3363465ba7f..08f72f22338 100644
--- a/integration-tests/code-origin.spec.js
+++ b/integration-tests/code-origin.spec.js
@@ -20,6 +20,9 @@ describe('Code Origin for Spans', function () {
     proc = await spawnProc(appFile, {
       cwd,
       env: {
+        // NYC rewrites the compiled JS which breaks --enable-source-maps resolution
+        // back to typescript.ts, so opt the child out of the coverage harness.
+        DD_TRACE_INTEGRATION_COVERAGE_DISABLE: '1',
         NODE_OPTIONS: '--enable-source-maps',
         DD_TRACE_AGENT_URL: `http://localhost:${agent.port}`,
       },
diff --git a/integration-tests/coverage-child-process.spec.js b/integration-tests/coverage-child-process.spec.js
new file mode 100644
index 00000000000..8f2bf6ec7fc
--- /dev/null
+++ b/integration-tests/coverage-child-process.spec.js
@@ -0,0 +1,500 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const childProcess = require('node:child_process')
+const fs = require('node:fs')
+const fsp = require('node:fs/promises')
+const os = require('node:os')
+const path = require('node:path')
+
+const { installPatch } = require('./coverage/patch-child-process')
+const finalizeSandboxCoverage = require('./coverage/finalize-sandbox')
+const {
+  DISABLE_ENV,
+  FLUSH_SIGNAL_KEY,
+  ROOT_ENV,
+  canonicalizePath,
+  getCollectorRoot,
+  getMergedReportDir,
+  getSandboxCollectorDir,
+  resolveCoverageRoot,
+} = require('./coverage/runtime')
+
+describe('integration coverage child process hook', () => {
+  let appRoot
+  let coverageRoot
+  let prevRoot
+
+  before(async () => {
+    appRoot = await fsp.mkdtemp(path.join(os.tmpdir(), 'dd-trace-coverage-'))
+    coverageRoot = path.join(appRoot, 'node_modules', 'dd-trace')
+    await fsp.mkdir(path.join(coverageRoot, 'packages', 'dd-trace', 'src'), { recursive: true })
+    await fsp.mkdir(path.join(coverageRoot, 'integration-tests', 'coverage'), { recursive: true })
+    await fsp.mkdir(path.join(appRoot, 'coverage-fixtures'), { recursive: true })
+
+    await fsp.copyFile(
+      path.join(process.cwd(), 'package.json'),
+      path.join(coverageRoot, 'package.json')
+    )
+    await fsp.writeFile(path.join(coverageRoot, 'packages', 'dd-trace', 'src', 'id.js'), `
+'use strict'
+
+let next = 1
+
+module.exports = function id () {
+  return next++
+}
+`)
+    await fsp.copyFile(
+      path.join(process.cwd(), 'integration-tests', 'coverage', 'nyc.sandbox.config.js'),
+      path.join(coverageRoot, 'integration-tests', 'coverage', 'nyc.sandbox.config.js')
+    )
+    await fsp.writeFile(path.join(appRoot, 'coverage-fixtures', 'parent.js'), `
+'use strict'
+
+const fs = require('node:fs')
+const path = require('node:path')
+const { fork } = require('node:child_process')
+
+const id = require('../node_modules/dd-trace/packages/dd-trace/src/id')
+
+id()
+fs.writeFileSync(path.join(__dirname, 'parent-debug.json'), JSON.stringify({
+  coverageKeys: Object.keys(global.__coverage__ || {}),
+  hasNycConfig: Boolean(process.env.NYC_CONFIG),
+  nodeOptions: process.env.NODE_OPTIONS || '',
+}))
+
+const child = fork(path.join(__dirname, 'worker.js'), { stdio: 'pipe' })
+
+child.on('message', message => {
+  if (message === 'ready') {
+    process.exitCode = 0
+    child.send({ ${JSON.stringify(FLUSH_SIGNAL_KEY)}: true })
+  }
+})
+
+child.on('exit', code => {
+  process.exit(code)
+})
+`)
+    await fsp.writeFile(path.join(appRoot, 'coverage-fixtures', 'worker.js'), `
+'use strict'
+
+const fs = require('node:fs')
+const path = require('node:path')
+const id = require('../node_modules/dd-trace/packages/dd-trace/src/id')
+
+id()
+fs.writeFileSync(path.join(__dirname, 'worker-debug.json'), JSON.stringify({
+  coverageKeys: Object.keys(global.__coverage__ || {}),
+  hasNycConfig: Boolean(process.env.NYC_CONFIG),
+  nodeOptions: process.env.NODE_OPTIONS || '',
+}))
+process.send('ready')
+`)
+
+    prevRoot = process.env[ROOT_ENV]
+    process.env[ROOT_ENV] = coverageRoot
+    installPatch()
+  })
+
+  after(async () => {
+    if (prevRoot === undefined) {
+      delete process.env[ROOT_ENV]
+    } else {
+      process.env[ROOT_ENV] = prevRoot
+    }
+
+    await fsp.rm(appRoot, { force: true, recursive: true })
+  })
+
+  it('preserves fork IPC and finalizes sandbox coverage artifacts', async () => {
+    childProcess.execFileSync(process.execPath, [path.join(appRoot, 'coverage-fixtures', 'parent.js')], {
+      cwd: appRoot,
+      env: process.env,
+      stdio: 'pipe',
+    })
+
+    const fixturesDir = path.join(appRoot, 'coverage-fixtures')
+    const parentDebug = JSON.parse(fs.readFileSync(path.join(fixturesDir, 'parent-debug.json'), 'utf8'))
+    const workerDebug = JSON.parse(fs.readFileSync(path.join(fixturesDir, 'worker-debug.json'), 'utf8'))
+    assert.strictEqual(parentDebug.hasNycConfig, true)
+    assert.strictEqual(workerDebug.hasNycConfig, true)
+    assert.ok(parentDebug.nodeOptions.includes('child-bootstrap.js'))
+    assert.ok(workerDebug.nodeOptions.includes('child-bootstrap.js'))
+    assert.ok(parentDebug.coverageKeys.length > 0, 'expected parent process coverage to be populated')
+    assert.ok(workerDebug.coverageKeys.length > 0, 'expected worker process coverage to be populated')
+
+    const tempDir = path.join(coverageRoot, '.nyc_output', 'integration-tests')
+    const tempEntries = fs.existsSync(tempDir) ? fs.readdirSync(tempDir) : []
+    assert.ok(tempEntries.length > 0, `expected raw coverage files in ${tempDir}`)
+    const coverageEntries = tempEntries.filter(name => name.endsWith('.json') && !name.includes('processinfo'))
+    assert.ok(coverageEntries.length > 0, `expected coverage json files in ${tempDir}`)
+    const rawCoverage = JSON.parse(fs.readFileSync(path.join(tempDir, coverageEntries[0]), 'utf8'))
+    assert.ok(Object.keys(rawCoverage).length > 0, 'expected raw coverage payload to contain files')
+
+    await finalizeSandboxCoverage(appRoot, coverageRoot)
+
+    const mergeScript = path.join(process.cwd(), 'integration-tests', 'coverage', 'merge-lcov.js')
+    childProcess.execFileSync(process.execPath, [mergeScript], { stdio: 'pipe' })
+
+    const lcovPath = path.join(getSandboxCollectorDir(appRoot), 'lcov.info')
+    const mergedLcovPath = path.join(getMergedReportDir(), 'lcov.info')
+
+    assert.ok(fs.existsSync(lcovPath), `expected coverage report at ${lcovPath}`)
+    assert.ok(fs.existsSync(mergedLcovPath), `expected merged coverage report at ${mergedLcovPath}`)
+    assert.ok(getCollectorRoot().includes(path.join('.nyc_output', 'integration-tests-collector')),
+      'collector scratch should live under .nyc_output/ so it does not collide with final reports in coverage/')
+
+    const lcov = fs.readFileSync(lcovPath, 'utf8')
+    assert.match(lcov, /SF:packages\/dd-trace\/src\/id\.js/)
+  })
+
+  // Regression: `fork(modulePath, undefined, options)` and `fork(modulePath, options)` must
+  // both preserve the caller's `options.env`. An earlier normalization bug silently dropped
+  // the options when the 2nd positional was nullish, stripping `env` (and everything else)
+  // so callers using that overload shape saw an empty environment in the child.
+  it('preserves options.env across both fork overloads', async () => {
+    const fixtureDir = path.join(appRoot, 'fork-overload-fixtures')
+    await fsp.mkdir(fixtureDir, { recursive: true })
+    const outputPath = path.join(fixtureDir, 'child-env.json')
+    const fixturePath = path.join(fixtureDir, 'print-env.js')
+    await fsp.writeFile(fixturePath, `
+'use strict'
+require('node:fs').writeFileSync(${JSON.stringify(outputPath)}, JSON.stringify({
+  marker: process.env.FORK_MARKER || null,
+  bootstrap: (process.env.NODE_OPTIONS || '').includes('child-bootstrap.js'),
+}))
+// Close the IPC channel so the child exits naturally once its top-level script is done.
+// The bootstrap intentionally no longer \`unref()\`s the channel — doing so broke fork-based
+// worker pools (mocha \`--parallel\`) by letting idle workers die mid-run.
+process.disconnect()
+`)
+
+    const runFork = (args) => new Promise((resolve, reject) => {
+      const child = childProcess.fork(...args)
+      child.on('exit', code => code === 0 ? resolve() : reject(new Error(`exit ${code}`)))
+      child.on('error', reject)
+    })
+
+    await runFork([fixturePath, undefined, { env: { ...process.env, FORK_MARKER: 'three-arg' } }])
+    assert.deepStrictEqual(
+      JSON.parse(fs.readFileSync(outputPath, 'utf8')),
+      { marker: 'three-arg', bootstrap: true }
+    )
+
+    await runFork([fixturePath, { env: { ...process.env, FORK_MARKER: 'two-arg' } }])
+    assert.deepStrictEqual(
+      JSON.parse(fs.readFileSync(outputPath, 'utf8')),
+      { marker: 'two-arg', bootstrap: true }
+    )
+  })
+
+  // Regression: `exec`/`execSync` run the command through `/bin/sh -c`, so our `argv[0] === node`
+  // detection in `patchSpawnOptions` misses them entirely. The mocha integration suite relies on
+  // this path (every `node node_modules/mocha/bin/mocha …` spawn goes through `exec`), so we
+  // overlay `NODE_OPTIONS` unconditionally and rely on the fact that only Node descendants
+  // consume it. Without the patch, the asserts below fail with `bootstrap: false`.
+  it('propagates the bootstrap through exec/execSync shell commands', async () => {
+    const fixtureDir = path.join(appRoot, 'exec-fixtures')
+    await fsp.mkdir(fixtureDir, { recursive: true })
+    const asyncOut = path.join(fixtureDir, 'async.json')
+    const syncOut = path.join(fixtureDir, 'sync.json')
+    const fixturePath = path.join(fixtureDir, 'print-env.js')
+    await fsp.writeFile(fixturePath, `
+'use strict'
+require('node:fs').writeFileSync(process.argv[2], JSON.stringify({
+  bootstrap: (process.env.NODE_OPTIONS || '').includes('child-bootstrap.js'),
+  hasNycConfig: Boolean(process.env.NYC_CONFIG),
+}))
+`)
+
+    await new Promise(/** @type {(resolve: (value?: void) => void, reject: (reason?: Error) => void) => void} */
+      (resolve, reject) => {
+        childProcess.exec(
+          `node ${JSON.stringify(fixturePath)} ${JSON.stringify(asyncOut)}`,
+          { cwd: appRoot },
+          err => err ? reject(err) : resolve()
+        )
+      })
+    childProcess.execSync(
+      `node ${JSON.stringify(fixturePath)} ${JSON.stringify(syncOut)}`,
+      { cwd: appRoot, stdio: 'pipe' }
+    )
+
+    assert.deepStrictEqual(
+      JSON.parse(fs.readFileSync(asyncOut, 'utf8')),
+      { bootstrap: true, hasNycConfig: true }
+    )
+    assert.deepStrictEqual(
+      JSON.parse(fs.readFileSync(syncOut, 'utf8')),
+      { bootstrap: true, hasNycConfig: true }
+    )
+  })
+
+  // Regression: during sandbox bring-up we patch `execSync` (used by `bun add`, `cp`, etc.), so
+  // `resolveCoverageRoot` gets called with the sandbox folder _before_ dd-trace has been
+  // installed into it. We must NOT cache that miss — otherwise every later lookup (including
+  // the teardown one that locates the sandbox's NYC output) returns the cached miss and falls
+  // back to the repo root, and the sandbox's coverage JSON files are silently orphaned.
+  it('probes fresh when a sandbox path has no dd-trace yet', async () => {
+    const sandbox = await fsp.mkdtemp(path.join(os.tmpdir(), 'dd-trace-late-install-'))
+    try {
+      assert.strictEqual(
+        resolveCoverageRoot({ cwd: sandbox }),
+        canonicalizePath(coverageRoot),
+        'empty sandbox should fall back to the seeded ROOT_ENV, not cache the miss'
+      )
+
+      const installedRoot = path.join(sandbox, 'node_modules', 'dd-trace')
+      await fsp.mkdir(installedRoot, { recursive: true })
+      await fsp.copyFile(
+        path.join(coverageRoot, 'package.json'),
+        path.join(installedRoot, 'package.json')
+      )
+
+      assert.strictEqual(resolveCoverageRoot({ cwd: sandbox }), canonicalizePath(installedRoot))
+    } finally {
+      await fsp.rm(sandbox, { force: true, recursive: true })
+    }
+  })
+
+  // Regression: the bootstrap must not force fork'd children to exit early. An earlier
+  // attempt called `process.channel?.unref()` + `process.once('disconnect', process.exit)`,
+  // which yanked idle workers out of mocha's `--parallel` pool mid-run.
+  it('keeps fork children alive while the parent holds the IPC channel', async () => {
+    const fixtureDir = path.join(appRoot, 'idle-fork-fixtures')
+    await fsp.mkdir(fixtureDir, { recursive: true })
+    const fixturePath = path.join(fixtureDir, 'idle-worker.js')
+    await fsp.writeFile(fixturePath,
+      "'use strict'\nprocess.on('message', msg => process.send({ echo: msg }))\n")
+
+    const child = childProcess.fork(fixturePath)
+    try {
+      await new Promise(resolve => setTimeout(resolve, 150))
+      assert.strictEqual(child.exitCode, null,
+        'child must not exit while parent still holds the channel')
+
+      const reply = await new Promise(resolve => {
+        child.once('message', resolve)
+        child.send('ping')
+      })
+      assert.deepStrictEqual(reply, { echo: 'ping' })
+    } finally {
+      if (child.exitCode === null) child.kill()
+    }
+  })
+
+  // Windows `proc.kill('SIGTERM')` is forceful and skips nyc's exit hook, so the bootstrap
+  // listens for an IPC sentinel from `helpers#stopProc` to flush coverage gracefully. On
+  // POSIX the listener is intentionally absent (any `message` listener refs the IPC channel
+  // and keeps mocha `--parallel` workers alive after their pool is drained).
+  const ifWin32 = process.platform === 'win32' ? it : it.skip
+  ifWin32('flushes coverage when the parent sends FLUSH_SIGNAL_KEY (Windows only)', async () => {
+    const fixtureDir = path.join(appRoot, 'flush-fixtures')
+    await fsp.mkdir(fixtureDir, { recursive: true })
+    const fixturePath = path.join(fixtureDir, 'idle.js')
+    await fsp.writeFile(fixturePath, "'use strict'\nsetInterval(() => {}, 1000)\n")
+
+    const child = childProcess.fork(fixturePath)
+    try {
+      const exitCode = await new Promise(resolve => {
+        child.once('exit', resolve)
+        setTimeout(() => child.send({ [FLUSH_SIGNAL_KEY]: true }), 50)
+      })
+      assert.strictEqual(exitCode, 0, 'flush sentinel must trigger a clean exit')
+    } finally {
+      if (child.exitCode === null) child.kill()
+    }
+  })
+
+  // Regression: the Windows flush listener must not keep short-lived fork'd fixtures alive.
+  // `unrefCounted` is what allows the bootstrap to register a `message` handler without
+  // blocking natural exit; dropping it stranded every profiler/SSI fixture on Windows.
+  ifWin32('does not keep listener-free fork children alive (Windows only)', async () => {
+    const fixtureDir = path.join(appRoot, 'short-lived-fixtures')
+    await fsp.mkdir(fixtureDir, { recursive: true })
+    const fixturePath = path.join(fixtureDir, 'short-lived.js')
+    await fsp.writeFile(fixturePath, "'use strict'\nsetTimeout(() => {}, 100)\n")
+
+    const child = childProcess.fork(fixturePath)
+    const start = Date.now()
+    try {
+      const exitCode = await new Promise(resolve => {
+        child.once('exit', resolve)
+        setTimeout(() => resolve('timeout'), 5000)
+      })
+      assert.strictEqual(exitCode, 0, `child must exit naturally (${Date.now() - start}ms)`)
+    } finally {
+      if (child.exitCode === null) child.kill()
+    }
+  })
+
+  // Debugger-worker style: caller strips NODE_OPTIONS to block foreign `-r` hooks. The bootstrap
+  // re-adds only its own `-r`, so NYC reaches the worker without leaking customer preloads.
+  it('injects only the coverage bootstrap into Worker NODE_OPTIONS, not customer `-r`', async () => {
+    const fixtureDir = path.join(appRoot, 'worker-env-fixtures')
+    await fsp.mkdir(fixtureDir, { recursive: true })
+    const outPath = path.join(fixtureDir, 'worker-env.json')
+    const customerHookPath = path.join(fixtureDir, 'customer-hook.js')
+    const workerPath = path.join(fixtureDir, 'worker.js')
+    const parentPath = path.join(fixtureDir, 'parent.js')
+
+    await fsp.writeFile(customerHookPath, "'use strict'\n")
+    await fsp.writeFile(workerPath, `
+'use strict'
+require('node:fs').writeFileSync(${JSON.stringify(outPath)}, JSON.stringify({
+  nodeOptions: process.env.NODE_OPTIONS || '',
+  stripped: process.env.STRIPPED_MARKER || '',
+}))
+`)
+    await fsp.writeFile(parentPath, `
+'use strict'
+const { Worker } = require('node:worker_threads')
+const w = new Worker(${JSON.stringify(workerPath)}, {
+  execArgv: [],
+  env: { STRIPPED_MARKER: 'yes' },
+})
+w.once('exit', code => process.exit(code))
+`)
+    const bootstrapPath = path.join(process.cwd(), 'integration-tests', 'coverage', 'child-bootstrap.js')
+    childProcess.execFileSync(process.execPath, [parentPath], {
+      cwd: appRoot,
+      env: {
+        ...process.env,
+        NODE_OPTIONS: `--require=${bootstrapPath} --require=${customerHookPath}`,
+      },
+      stdio: 'pipe',
+    })
+
+    const workerEnv = JSON.parse(fs.readFileSync(outPath, 'utf8'))
+    assert.strictEqual(workerEnv.stripped, 'yes', 'caller-provided env entries must be preserved')
+    assert.ok(
+      workerEnv.nodeOptions.includes('child-bootstrap.js'),
+      `Worker should get the coverage bootstrap (got: ${workerEnv.nodeOptions})`
+    )
+    assert.ok(
+      !workerEnv.nodeOptions.includes('customer-hook.js'),
+      `Worker must not inherit customer \`-r\` hooks from the parent (got: ${workerEnv.nodeOptions})`
+    )
+  })
+
+  // Regression: the bootstrap used to assign `process.env.NYC_CWD = coverageRoot`. nyc's
+  // `register-env.js` propagates `NYC_CWD` to every grandchild, so this leaked into any
+  // nested `nyc` CLI in a fixture (e.g. mocha fixtures calling `nyc --all`). Those nested
+  // instances then `guessCWD()`'d our sandbox root and globbed for sources in the wrong
+  // place, reporting zero coverage and breaking `nyc --all` fixture tests.
+  it('does not inject NYC_CWD — nested nyc CLIs would misuse it', async () => {
+    const fixtureDir = path.join(appRoot, 'nyc-cwd-fixtures')
+    await fsp.mkdir(fixtureDir, { recursive: true })
+    const outputPath = path.join(fixtureDir, 'env.json')
+    const fixturePath = path.join(fixtureDir, 'dump-env.js')
+    await fsp.writeFile(fixturePath, "'use strict'\n" +
+      "require('node:fs').writeFileSync(process.argv[2], JSON.stringify({\n" +
+      '  nycCwd: process.env.NYC_CWD ?? null,\n' +
+      '  hasNycConfig: Boolean(process.env.NYC_CONFIG),\n' +
+      "  bootstrap: (process.env.NODE_OPTIONS || '').includes('child-bootstrap.js'),\n" +
+      '}))\n')
+
+    const env = { ...process.env }
+    delete env.NYC_CWD
+    delete env.NYC_CONFIG
+
+    await new Promise(/** @type {(resolve: (value?: void) => void, reject: (reason?: Error) => void) => void} */
+      (resolve, reject) => {
+        childProcess.execFile(process.execPath, [fixturePath, outputPath], { cwd: appRoot, env },
+          err => err ? reject(err) : resolve())
+      })
+
+    assert.deepStrictEqual(
+      JSON.parse(fs.readFileSync(outputPath, 'utf8')),
+      { nycCwd: null, hasNycConfig: true, bootstrap: true }
+    )
+  })
+
+  // Regression: tests whose semantics depend on child startup latency (e.g. DI's Inspector
+  // breakpoint race) must be able to opt their children out. Setting `DISABLE_ENV` on the
+  // child env must strip `NODE_OPTIONS=-r child-bootstrap.js` and any inherited ROOT_ENV so
+  // the child runs without nyc instrumentation.
+  it('honors the per-spawn opt-out env var', async () => {
+    const fixtureDir = path.join(appRoot, 'disable-fixtures')
+    await fsp.mkdir(fixtureDir, { recursive: true })
+    const outputPath = path.join(fixtureDir, 'env.json')
+    const fixturePath = path.join(fixtureDir, 'dump-env.js')
+    await fsp.writeFile(fixturePath, "'use strict'\n" +
+      "require('node:fs').writeFileSync(process.argv[2], JSON.stringify({\n" +
+      '  hasRoot: Boolean(process.env.DD_TRACE_INTEGRATION_COVERAGE_ROOT),\n' +
+      '  hasNycConfig: Boolean(process.env.NYC_CONFIG),\n' +
+      "  bootstrap: (process.env.NODE_OPTIONS || '').includes('child-bootstrap.js'),\n" +
+      '}))\n')
+
+    /** @type {NodeJS.ProcessEnv} */
+    const env = { ...process.env, [DISABLE_ENV]: '1' }
+    delete env.NYC_CONFIG
+
+    await new Promise(/** @type {(resolve: (value?: void) => void, reject: (reason?: Error) => void) => void} */
+      (resolve, reject) => {
+        childProcess.execFile(process.execPath, [fixturePath, outputPath], { cwd: appRoot, env },
+          err => err ? reject(err) : resolve())
+      })
+
+    assert.deepStrictEqual(
+      JSON.parse(fs.readFileSync(outputPath, 'utf8')),
+      { hasRoot: false, hasNycConfig: false, bootstrap: false }
+    )
+  })
+
+  // Matrix combinations can legitimately filter every spec at runtime (e.g. cucumber's
+  // `NODE_MAJOR`/`version` guard). `merge-lcov.js` drops a `.skipped` sentinel when it
+  // finds no sandboxes, and `verify-coverage.js` honors it so CI jobs with 0 specs don't
+  // fail on "non-empty lcov required".
+  it('treats a .skipped sentinel as a no-op coverage report', async () => {
+    const root = await fsp.mkdtemp(path.join(os.tmpdir(), 'dd-trace-skip-'))
+    try {
+      const reportDir = path.join(root, 'coverage', 'node-v18.0.0-test-example')
+      await fsp.mkdir(reportDir, { recursive: true })
+      await fsp.writeFile(path.join(reportDir, '.skipped'), '')
+
+      const verifyScript = path.join(process.cwd(), 'scripts', 'verify-coverage.js')
+      const { status } = childProcess.spawnSync(process.execPath, [verifyScript, '--flags', 'test'], {
+        cwd: root,
+        stdio: 'pipe',
+      })
+
+      assert.strictEqual(status, 0)
+      assert.strictEqual(fs.existsSync(reportDir), false, 'skipped report dir should be cleaned up')
+    } finally {
+      await fsp.rm(root, { force: true, recursive: true })
+    }
+  })
+
+  // Two `*:coverage` runs in the same checkout must not clobber each other's scratch dirs
+  // or final reports. Everything per-run is keyed on `npm_lifecycle_event` (both the
+  // collector root and the merged report dir) so a single env var change isolates them.
+  it('isolates collector and report paths per npm_lifecycle_event', () => {
+    const originalEvent = process.env.npm_lifecycle_event
+    const originalCollector = process.env.DD_TRACE_INTEGRATION_COVERAGE_COLLECTOR
+    delete process.env.DD_TRACE_INTEGRATION_COVERAGE_COLLECTOR
+    try {
+      process.env.npm_lifecycle_event = 'test:integration:foo:coverage'
+      const foo = { collector: getCollectorRoot(), merged: getMergedReportDir() }
+
+      process.env.npm_lifecycle_event = 'test:integration:bar:coverage'
+      const bar = { collector: getCollectorRoot(), merged: getMergedReportDir() }
+
+      assert.notStrictEqual(foo.collector, bar.collector)
+      assert.notStrictEqual(foo.merged, bar.merged)
+      assert.match(foo.collector, /integration-tests-collector-test-integration-foo-coverage$/)
+      assert.match(bar.collector, /integration-tests-collector-test-integration-bar-coverage$/)
+
+      delete process.env.npm_lifecycle_event
+      assert.match(getCollectorRoot(), /integration-tests-collector$/)
+    } finally {
+      if (originalEvent === undefined) delete process.env.npm_lifecycle_event
+      else process.env.npm_lifecycle_event = originalEvent
+      if (originalCollector === undefined) delete process.env.DD_TRACE_INTEGRATION_COVERAGE_COLLECTOR
+      else process.env.DD_TRACE_INTEGRATION_COVERAGE_COLLECTOR = originalCollector
+    }
+  })
+})
diff --git a/integration-tests/coverage-fixtures/parent.js b/integration-tests/coverage-fixtures/parent.js
new file mode 100644
index 00000000000..064761874c8
--- /dev/null
+++ b/integration-tests/coverage-fixtures/parent.js
@@ -0,0 +1,22 @@
+'use strict'
+
+const path = require('node:path')
+const { fork } = require('node:child_process')
+
+const id = require('../../packages/dd-trace/src/id')
+
+id()
+
+const child = fork(path.join(__dirname, 'worker.js'), { stdio: 'pipe' })
+
+child.on('message', message => {
+  if (message === 'ready') {
+    process.exitCode = 0
+    child.disconnect()
+    child.kill()
+  }
+})
+
+child.on('exit', code => {
+  process.exit(code)
+})
diff --git a/integration-tests/coverage-fixtures/worker.js b/integration-tests/coverage-fixtures/worker.js
new file mode 100644
index 00000000000..96f5b718c3a
--- /dev/null
+++ b/integration-tests/coverage-fixtures/worker.js
@@ -0,0 +1,6 @@
+'use strict'
+
+const id = require('../../packages/dd-trace/src/id')
+
+id()
+process.send('ready')
diff --git a/integration-tests/coverage-manual-process.spec.js b/integration-tests/coverage-manual-process.spec.js
new file mode 100644
index 00000000000..93238b5fad6
--- /dev/null
+++ b/integration-tests/coverage-manual-process.spec.js
@@ -0,0 +1,51 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const fs = require('node:fs')
+const fsp = require('node:fs/promises')
+const os = require('node:os')
+const path = require('node:path')
+
+const { buildManualCoverageEnv } = require('./coverage/manual-process')
+const { ROOT_ENV } = require('./coverage/runtime')
+
+describe('integration coverage manual process helper', () => {
+  let appRoot
+  let coverageRoot
+  let prevRoot
+
+  before(async () => {
+    appRoot = await fsp.mkdtemp(path.join(os.tmpdir(), 'dd-trace-manual-env-'))
+    coverageRoot = path.join(appRoot, 'node_modules', 'dd-trace')
+    await fsp.mkdir(path.join(coverageRoot, 'packages', 'dd-trace', 'src'), { recursive: true })
+    await fsp.writeFile(path.join(coverageRoot, 'package.json'), JSON.stringify({ name: 'dd-trace' }))
+
+    prevRoot = process.env[ROOT_ENV]
+    process.env[ROOT_ENV] = coverageRoot
+  })
+
+  after(async () => {
+    if (prevRoot === undefined) {
+      delete process.env[ROOT_ENV]
+    } else {
+      process.env[ROOT_ENV] = prevRoot
+    }
+
+    await fsp.rm(appRoot, { force: true, recursive: true })
+  })
+
+  it('adds coverage bootstrap env for manual spawn wrappers', () => {
+    const env = buildManualCoverageEnv({
+      cwd: appRoot,
+      env: {
+        NODE_OPTIONS: '--loader=dd-trace/loader-hook.mjs',
+        PATH: process.env.PATH,
+      },
+      scriptPath: path.join(coverageRoot, 'loader-hook.mjs'),
+    })
+
+    assert.strictEqual(env.DD_TRACE_INTEGRATION_COVERAGE_ROOT, fs.realpathSync(coverageRoot))
+    assert.ok(env.NODE_OPTIONS.includes('--loader=dd-trace/loader-hook.mjs'))
+    assert.ok(env.NODE_OPTIONS.includes('child-bootstrap.js'))
+  })
+})
diff --git a/integration-tests/coverage/README.md b/integration-tests/coverage/README.md
new file mode 100644
index 00000000000..fb509879c42
--- /dev/null
+++ b/integration-tests/coverage/README.md
@@ -0,0 +1,137 @@
+# Integration Test Coverage Harness
+
+How the `*:coverage` scripts under `integration-tests/` collect code coverage
+across every child process they spawn.
+
+## Why a custom harness?
+
+Integration tests frequently `fork`, `spawn`, or `exec` new Node processes
+(`run-mocha.js`, `createSandbox`, plugin fixtures, etc.). The standard
+`nyc ./node_modules/.bin/mocha …` flow only instruments the direct children,
+so most real production code runs uninstrumented.
+
+The harness solves that by injecting NYC into *every* Node descendant and
+merging their reports back into a single repo-level LCOV that Codecov picks up
+the same way it picks up unit-test coverage.
+
+All sources live in `integration-tests/coverage/`.
+
+## High-level flow
+
+```md
+npm run test:integration:mocha:coverage
+   │
+   ▼
+integration-tests/coverage/run-suite.js
+   │  (spawns mocha with --require register.js)
+   ▼
+register.js  ──▶ patch-child-process.js  (monkey-patches child_process)
+   │
+   ▼  each spawn/fork/exec of Node
+child-bootstrap.js  ──▶ require('nyc').wrap()
+   │  (child runs, writes raw coverage JSON to per-sandbox temp dir)
+   ▼
+useSandbox teardown
+   │
+   ▼
+finalize-sandbox.js  (reads sandbox JSON, rebases paths to repo root,
+                     writes coverage into the collector)
+   │
+   ▼
+merge-lcov.js  (called by run-suite.js after mocha exits; merges every
+                sandbox into coverage/node-<version>-<script>/lcov.info)
+```
+
+## Key files
+
+| File | Role |
+| --- | --- |
+| `runtime.js` | Shared constants/helpers (paths, env vars, `applyCoverageEnv`, `resolveCoverageRoot`). |
+| `run-suite.js` | Entry point. Runs mocha then the merger. |
+| `register.js` | Preloaded into mocha; installs the `child_process` patches. |
+| `patch-child-process.js` | Rewrites options for `fork`/`spawn`/`exec` so every Node descendant preloads the bootstrap. |
+| `child-bootstrap.js` | Preloaded into every child. Bootstraps NYC and propagates itself into grandchildren via `node-preload`. |
+| `finalize-sandbox.js` | Called before a sandbox is removed. Reads the sandbox's raw coverage, rebases absolute paths from `<sandbox>/…` to `<repo>/…`, writes into the collector. |
+| `merge-lcov.js` | Merges all per-sandbox `coverage-final.json` into a single LCOV + HTML report. |
+| `nyc.sandbox.config.js` | NYC config used *inside* the sandboxes. Inherits `include`/`exclude` from the root `nyc.config.js`. |
+| `manual-process.js` | Escape hatch for integrations where `child_process` patching can't reach the inner Node process (e.g. `func`, wrapped CLI tools). |
+
+## Environment variables
+
+| Name | Purpose |
+| --- | --- |
+| `DD_TRACE_INTEGRATION_COVERAGE_ROOT` | Set to the resolved dd-trace root. Presence activates the harness for the whole process tree. |
+| `DD_TRACE_INTEGRATION_COVERAGE_COLLECTOR` | Optional override for the collector directory. |
+| `DD_TRACE_INTEGRATION_COVERAGE_DISABLE` | Per-spawn opt-out. Set in the child env you pass to `fork`/`exec`/`spawn` when NYC's require-hook would break the fixture (e.g. timing-sensitive DI breakpoint races). The subtree runs without instrumentation. |
+| `NYC_CONFIG` / `NYC_PROCESS_ID` | Standard NYC variables propagated to children. |
+
+## Output layout
+
+```sh
+.nyc_output/integration-tests-collector-<script>/
+    sandboxes/<sandbox-hash>/coverage-final.json    # per-sandbox intermediate
+
+coverage/node-<version>-<script>/
+    lcov.info          # merged LCOV Codecov uploads
+    coverage-final.json
+    html/              # HTML report for local inspection
+```
+
+The output path intentionally matches `nyc.config.js` (`coverage/node-<version>-<label>`)
+so Codecov and `scripts/verify-coverage.js` treat integration and unit reports identically.
+
+## Running multiple `*:coverage` scripts in parallel
+
+Every per-run artifact (collector dir, tarball cache, final LCOV) is scoped by
+`npm_lifecycle_event`, so running e.g. `npm run test:integration:mocha:coverage`
+and `npm run test:integration:cucumber:coverage` simultaneously in the same
+checkout does not race on shared state.
+
+## Coverage-sensitive timeouts
+
+NYC instrumentation slows hot paths meaningfully. The `COVERAGE_SLOWDOWN`
+constant in `runtime.js` (3x when coverage is active, 1x otherwise) is applied
+in tests that poll telemetry endpoints or the intake. Use it instead of
+bumping a single test's timeout.
+
+## Known gaps
+
+- **Mocha `ci:mocha:session:finish`**: LCOV shows the inner closure of
+  `getOnEndHandler()` as never executed even though the plugin demonstrably
+  receives the event (assertions on `test_session_end` payloads pass). The
+  closure body writes its counter increments before the child exits, but NYC's
+  exit hook writes coverage before those increments land in the file — a
+  subtle ordering issue with mocha's synchronous `'end'` emission. Not an
+  issue with the harness itself; fixing it would require changes to the
+  instrumentation (e.g. synchronously flushing a marker before mocha's
+  `run()` callback).
+- **Dynamic-instrumentation retry test**: `mocha@*:runs retries with dynamic
+  instrumentation` opts out via `DD_TRACE_INTEGRATION_COVERAGE_DISABLE`
+  because NYC's require-hook delays child startup enough that DI's Inspector
+  breakpoint isn't armed before the single retry completes.
+- **Jest `calculates executable lines even if there have been skipped suites`**:
+  also opts out via `DD_TRACE_INTEGRATION_COVERAGE_DISABLE`. NYC and jest both
+  write to `global.__coverage__`, so jest's coverage map picks up every dd-trace
+  file NYC instrumented in the same worker and the asserted `LINES_PCT` drops.
+
+## Zero-test matrix combinations
+
+Some matrix combos filter every spec at runtime (e.g. cucumber's
+`NODE_MAJOR === 18 && version === 'latest'` guard, cypress's
+`shouldTestsRun()`). When no sandbox was spawned, `merge-lcov.js` writes
+a `.skipped` marker file and `scripts/verify-coverage.js` honors it so
+the CI job passes without trying to upload an empty report.
+
+## Troubleshooting
+
+- **"No sandbox coverage reports found to merge"** — either coverage isn't
+  active (`DD_TRACE_INTEGRATION_COVERAGE_ROOT` not set) or every sandbox
+  exited without writing `.json` files. Confirm `child-bootstrap.js` is
+  preloaded (grep the failing command's `NODE_OPTIONS` in logs).
+- **Coverage from a sandbox is missing** — the sandbox's `tempDir` under
+  `.nyc_output/integration-tests/` should contain one JSON per Node process.
+  Empty means NYC never wrapped, which usually indicates a *foreign* NYC
+  already set `NYC_CONFIG` pointing outside our tree (see `hasForeignNyc`
+  in `child-bootstrap.js`).
+- **Tests flake under coverage** — bump `COVERAGE_SLOWDOWN` usage in the
+  affected spec before raising the whole-file timeout.
diff --git a/integration-tests/coverage/child-bootstrap.js b/integration-tests/coverage/child-bootstrap.js
new file mode 100644
index 00000000000..6984ffb135f
--- /dev/null
+++ b/integration-tests/coverage/child-bootstrap.js
@@ -0,0 +1,110 @@
+'use strict'
+
+const { mkdirSync } = require('node:fs')
+const path = require('node:path')
+
+const NYC = require('nyc')
+const preloadList = require('node-preload')
+
+const {
+  BOOTSTRAP_REQUIRE_ARG,
+  DISABLE_ENV,
+  FLUSH_SIGNAL_KEY,
+  ROOT_ENV,
+  canonicalizePath,
+  isCoverageActive,
+  prependBootstrapRequire,
+  resolveCoverageRoot,
+} = require('./runtime')
+
+const BOOTSTRAPPED = Symbol.for('dd-trace.integration-coverage.bootstrapped')
+// Our NYC tempDirs live under this segment. An inherited NYC_CONFIG pointing elsewhere means
+// an external NYC owns the tree — bail out.
+const OWN_TEMPDIR_MARKER = `${path.sep}.nyc_output${path.sep}integration-tests`
+
+/** @typedef {{ unrefCounted?: () => void } | null | undefined} RefCountedChannel */
+
+if (isCoverageActive() && !process.env[DISABLE_ENV] && !globalThis[BOOTSTRAPPED]) {
+  globalThis[BOOTSTRAPPED] = true
+  if (!hasForeignNyc()) bootstrapCoverage()
+}
+
+function hasForeignNyc () {
+  const config = process.env.NYC_CONFIG
+  if (!config) return false
+  try {
+    const parsed = JSON.parse(config)
+    return typeof parsed.tempDir !== 'string' || !parsed.tempDir.includes(OWN_TEMPDIR_MARKER)
+  } catch {
+    return true
+  }
+}
+
+function bootstrapCoverage () {
+  const coverageRoot = resolveCoverageRoot({ cwd: process.env[ROOT_ENV] || process.cwd() })
+  if (!coverageRoot) return
+
+  const { createConfig } = require('./nyc.sandbox.config')
+  const config = { ...createConfig(coverageRoot), cwd: coverageRoot }
+
+  const nyc = new NYC({
+    ...config,
+    isChildProcess: Boolean(process.env.NYC_PROCESS_ID),
+    _processInfo: {
+      pid: process.pid,
+      ppid: process.ppid,
+      parent: process.env.NYC_PROCESS_ID || null,
+    },
+  })
+
+  mkdirSync(nyc.tempDirectory(), { recursive: true })
+  mkdirSync(nyc.processInfo.directory, { recursive: true })
+
+  process.env[ROOT_ENV] = canonicalizePath(coverageRoot)
+  process.env.NYC_CONFIG = JSON.stringify(config)
+  process.env.NODE_OPTIONS = prependBootstrapRequire(process.env.NODE_OPTIONS)
+
+  // Propagate NYC's env registration and this bootstrap into every grandchild Node process.
+  const registerEnvPath = require.resolve('nyc/lib/register-env.js')
+  if (!preloadList.includes(registerEnvPath)) preloadList.push(registerEnvPath)
+  if (!preloadList.includes(__filename)) preloadList.push(__filename)
+
+  require(registerEnvPath)('NYC_PROCESS_ID')
+  nyc.wrap()
+  patchWorkerThreads()
+
+  // Windows only: `proc.kill('SIGTERM')` is forceful and skips nyc's exit hook, so flush on an
+  // explicit IPC sentinel from `helpers#stopProc`. `unrefCounted` decrements Node's internal
+  // listener ref so our handler doesn't keep otherwise-idle fixtures alive while still allowing
+  // user-code listeners to re-ref the channel normally. POSIX omits this entirely.
+  if (process.platform === 'win32') {
+    process.on('message', message => {
+      if (message?.[FLUSH_SIGNAL_KEY] === true) {
+        process.exit(0)
+      }
+    })
+    const channel = /** @type {RefCountedChannel} */ (/** @type {unknown} */ (process.channel))
+    channel?.unrefCounted?.()
+  }
+}
+
+/**
+ * Re-inject the bootstrap `-r` into Worker options when the caller stripped `NODE_OPTIONS`
+ * (e.g. dd-trace's debugger worker). Only our own bootstrap is added — never inherited
+ * foreign `-r` hooks.
+ *
+ * @returns {void}
+ */
+function patchWorkerThreads () {
+  const workerThreads = require('node:worker_threads')
+  const OriginalWorker = workerThreads.Worker
+  workerThreads.Worker = class extends OriginalWorker {
+    constructor (filename, options) {
+      const env = options?.env
+      if (!env?.NODE_OPTIONS) {
+        options = { ...options, env: { ...env, NODE_OPTIONS: BOOTSTRAP_REQUIRE_ARG } }
+      }
+      super(filename, options)
+    }
+  }
+}
diff --git a/integration-tests/coverage/finalize-sandbox.js b/integration-tests/coverage/finalize-sandbox.js
new file mode 100644
index 00000000000..12bc16de62b
--- /dev/null
+++ b/integration-tests/coverage/finalize-sandbox.js
@@ -0,0 +1,123 @@
+'use strict'
+
+const fs = require('node:fs/promises')
+const path = require('node:path')
+const { setTimeout } = require('node:timers/promises')
+
+const libCoverage = require('istanbul-lib-coverage')
+const libReport = require('istanbul-lib-report')
+const reports = require('istanbul-reports')
+
+const {
+  REPO_ROOT,
+  canonicalizePath,
+  getSandboxCollectorDir,
+  getSandboxNycPaths,
+  isCoverageActive,
+} = require('./runtime')
+
+// A child mid-writing its coverage JSON briefly exposes an empty (O_TRUNC) or partial file;
+// a tiny bounded retry lets the writer finish.
+const MAX_READ_ATTEMPTS = 5
+const READ_RETRY_DELAY_MS = 10
+
+async function readCoverageJsonWhenStable (filePath) {
+  for (let attempt = 0; attempt < MAX_READ_ATTEMPTS; attempt++) {
+    let content
+    try {
+      content = await fs.readFile(filePath, 'utf8')
+    } catch (err) {
+      if (err.code === 'ENOENT') return
+      throw err
+    }
+    if (content.length > 0) {
+      try {
+        return JSON.parse(content)
+      } catch {}
+    }
+    await setTimeout(READ_RETRY_DELAY_MS)
+  }
+}
+
+async function loadSandboxCoverage (tempDir) {
+  const map = libCoverage.createCoverageMap({})
+
+  let entries
+  try {
+    entries = await fs.readdir(tempDir, { withFileTypes: true })
+  } catch (err) {
+    if (err.code === 'ENOENT') return map
+    throw err
+  }
+
+  const reads = []
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith('.json')) continue
+    reads.push(readCoverageJsonWhenStable(path.join(tempDir, entry.name)))
+  }
+  for (const report of await Promise.all(reads)) {
+    if (report) map.merge(report)
+  }
+  return map
+}
+
+// Re-keys each file coverage from its sandbox-local path to the repo path so merged reports
+// link to checked-out sources even after sandbox teardown.
+function serializeRebasedCoverage (coverageMap, coverageRoot) {
+  const result = {}
+  for (const file of coverageMap.files()) {
+    const relative = path.relative(coverageRoot, file)
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) continue
+    const rebased = path.join(REPO_ROOT, relative)
+    result[rebased] = { ...coverageMap.fileCoverageFor(file).data, path: rebased }
+  }
+  return JSON.stringify(result)
+}
+
+/**
+ * Generates sandbox-local LCOV/summary artifacts plus a repo-keyed `coverage-final.json`
+ * and copies everything into the repo-side collector directory for this sandbox.
+ *
+ * @param {string} folder - sandbox folder about to be removed
+ * @param {string | undefined} coverageRoot
+ * @returns {Promise<void>}
+ */
+async function finalizeSandbox (folder, coverageRoot) {
+  if (!isCoverageActive() || !coverageRoot) return
+  coverageRoot = canonicalizePath(coverageRoot)
+
+  const { reportDir, tempDir } = getSandboxNycPaths(coverageRoot)
+  const coverageMap = await loadSandboxCoverage(tempDir)
+  if (coverageMap.files().length === 0) return
+
+  await fs.mkdir(reportDir, { recursive: true })
+
+  const context = libReport.createContext({ coverageMap, dir: reportDir })
+  reports.create('lcovonly', { file: 'lcov.info', projectRoot: coverageRoot }).execute(context)
+  reports.create('text-summary').execute(context)
+
+  let reportEntries
+  try {
+    reportEntries = await fs.readdir(reportDir, { withFileTypes: true })
+  } catch {
+    return
+  }
+
+  const outputDir = getSandboxCollectorDir(folder)
+  await fs.rm(outputDir, { force: true, recursive: true })
+  await fs.mkdir(outputDir, { recursive: true })
+
+  const pending = [
+    fs.writeFile(path.join(outputDir, 'coverage-final.json'), serializeRebasedCoverage(coverageMap, coverageRoot)),
+  ]
+  for (const entry of reportEntries) {
+    pending.push(fs.cp(
+      path.join(reportDir, entry.name),
+      path.join(outputDir, entry.name),
+      { recursive: entry.isDirectory() },
+    ))
+  }
+  await Promise.all(pending)
+}
+
+module.exports = finalizeSandbox
diff --git a/integration-tests/coverage/manual-process.js b/integration-tests/coverage/manual-process.js
new file mode 100644
index 00000000000..e9805d8a25c
--- /dev/null
+++ b/integration-tests/coverage/manual-process.js
@@ -0,0 +1,22 @@
+'use strict'
+
+const path = require('node:path')
+
+const { applyCoverageEnv } = require('./runtime')
+
+/**
+ * For wrappers that spawn Node indirectly (e.g. `func`, `cypress`, `playwright`) where
+ * `child_process` patching can't reach the inner Node process.
+ *
+ * @param {object} options
+ * @param {string} options.cwd
+ * @param {NodeJS.ProcessEnv} [options.env]
+ * @param {string} [options.scriptPath]
+ * @returns {NodeJS.ProcessEnv}
+ */
+function buildManualCoverageEnv ({ cwd, env = {}, scriptPath }) {
+  const resolved = scriptPath || path.join(cwd, 'node_modules', 'dd-trace', 'loader-hook.mjs')
+  return applyCoverageEnv(env, { cwd, scriptPath: resolved }) || { ...env }
+}
+
+module.exports = { buildManualCoverageEnv }
diff --git a/integration-tests/coverage/merge-lcov.js b/integration-tests/coverage/merge-lcov.js
new file mode 100644
index 00000000000..bbbd3e485e9
--- /dev/null
+++ b/integration-tests/coverage/merge-lcov.js
@@ -0,0 +1,87 @@
+'use strict'
+
+const fs = require('node:fs/promises')
+const path = require('node:path')
+
+const libCoverage = require('istanbul-lib-coverage')
+const libReport = require('istanbul-lib-report')
+const reports = require('istanbul-reports')
+
+const { REPO_ROOT, getCollectorRoot, getMergedReportDir } = require('./runtime')
+
+async function loadMergedCoverage (sandboxesDir) {
+  const merged = libCoverage.createCoverageMap({})
+
+  let entries
+  try {
+    entries = await fs.readdir(sandboxesDir, { withFileTypes: true })
+  } catch {
+    return { coverageMap: merged, sandboxCount: 0 }
+  }
+
+  const reads = []
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue
+    reads.push(readSandboxCoverage(path.join(sandboxesDir, entry.name, 'coverage-final.json')))
+  }
+
+  let sandboxCount = 0
+  for (const data of await Promise.all(reads)) {
+    if (!data) continue
+    merged.merge(data)
+    sandboxCount++
+  }
+
+  return { coverageMap: merged, sandboxCount }
+}
+
+async function readSandboxCoverage (jsonPath) {
+  let content
+  try {
+    content = await fs.readFile(jsonPath, 'utf8')
+  } catch {
+    return
+  }
+  try {
+    return JSON.parse(content)
+  } catch (err) {
+    process.stderr.write(`Skipping unreadable coverage file ${jsonPath}: ${err.message}\n`)
+  }
+}
+
+async function main () {
+  const sandboxesDir = path.join(getCollectorRoot(), 'sandboxes')
+  const outputDir = getMergedReportDir()
+
+  await fs.mkdir(outputDir, { recursive: true })
+
+  const { coverageMap, sandboxCount } = await loadMergedCoverage(sandboxesDir)
+
+  if (sandboxCount === 0) {
+    // Matrix combinations may filter out every test at runtime (e.g. cucumber/cypress
+    // version guards). Drop the sentinel so `verify-coverage.js` can skip upload cleanly
+    // instead of failing on an empty lcov report.
+    await fs.writeFile(path.join(outputDir, '.skipped'), '')
+    process.stdout.write('No sandbox coverage reports found to merge.\n')
+    return
+  }
+
+  // The merged CoverageMap uses absolute repo paths, so HTML resolves sources directly;
+  // `lcovonly`'s `projectRoot` strips the prefix to produce repo-relative `SF:` lines.
+  const context = libReport.createContext({ coverageMap, dir: outputDir, defaultSummarizer: 'nested' })
+  reports.create('lcovonly', { file: 'lcov.info', projectRoot: REPO_ROOT }).execute(context)
+  reports.create('html', { subdir: 'html' }).execute(context)
+  reports.create('text-summary', { file: 'text-summary.txt' }).execute(context)
+
+  await fs.writeFile(path.join(outputDir, 'coverage-final.json'), JSON.stringify(coverageMap.toJSON()))
+
+  process.stdout.write(
+    `Merged ${sandboxCount} sandbox report(s) across ${coverageMap.files().length} file section(s). ` +
+    `HTML report: ${path.join(outputDir, 'html', 'index.html')}\n`
+  )
+}
+
+main().catch(err => {
+  process.stderr.write(`${err.stack || err.message}\n`)
+  process.exitCode = 1
+})
diff --git a/integration-tests/coverage/nyc.sandbox.config.js b/integration-tests/coverage/nyc.sandbox.config.js
new file mode 100644
index 00000000000..d8088464f21
--- /dev/null
+++ b/integration-tests/coverage/nyc.sandbox.config.js
@@ -0,0 +1,29 @@
+'use strict'
+
+const baseConfig = require('../../nyc.config')
+const { canonicalizePath, getSandboxNycPaths } = require('./runtime')
+
+/**
+ * Sandbox NYC config inheriting `include`/`exclude` from the top-level `nyc.config.js` so
+ * adjustments in one place propagate here.
+ *
+ * @param {string} [coverageRoot]
+ * @returns {Record<string, unknown>}
+ */
+function createConfig (coverageRoot = process.env.DD_TRACE_INTEGRATION_COVERAGE_ROOT || process.cwd()) {
+  const { reportDir, tempDir } = getSandboxNycPaths(canonicalizePath(coverageRoot))
+  return {
+    ...baseConfig,
+    cache: false,
+    hookRequire: true,
+    hookRunInContext: false,
+    hookRunInThisContext: false,
+    reporter: ['lcov', 'text-summary'],
+    reportDir,
+    tempDir,
+    useSpawnWrap: false,
+  }
+}
+
+module.exports = createConfig()
+module.exports.createConfig = createConfig
diff --git a/integration-tests/coverage/patch-child-process.js b/integration-tests/coverage/patch-child-process.js
new file mode 100644
index 00000000000..240d0c32a65
--- /dev/null
+++ b/integration-tests/coverage/patch-child-process.js
@@ -0,0 +1,113 @@
+'use strict'
+
+const childProcess = require('node:child_process')
+const path = require('node:path')
+
+const { applyCoverageEnv, isCoverageActive, resolveCoverageRoot } = require('./runtime')
+
+const PATCHED = Symbol.for('dd-trace.integration-coverage.child-process-patched')
+
+function isNodeCommand (command) {
+  if (!command) return false
+  const normalized = command.toLowerCase()
+  if (normalized === process.execPath.toLowerCase()) return true
+  const basename = path.basename(normalized)
+  return basename === 'node' || basename === 'node.exe'
+}
+
+// Mirrors Node's own `fork`/`spawn` arg normalization.
+function normalizeArgs (args, options) {
+  if (args == null) return { args: [], options: options || {} }
+  if (Array.isArray(args)) return { args, options: options || {} }
+  return { args: [], options: args }
+}
+
+function patchOptions (options, scriptPath) {
+  const ctx = { cwd: options.cwd, scriptPath }
+  if (!resolveCoverageRoot(ctx)) return options
+  return { ...options, env: applyCoverageEnv(options.env, ctx) }
+}
+
+function patchSpawnOptions (options, command, args) {
+  if (!isNodeCommand(command)) return options
+  let scriptPath
+  for (const arg of args) {
+    if (typeof arg === 'string' && !arg.startsWith('-')) {
+      scriptPath = arg
+      break
+    }
+  }
+  return patchOptions(options, scriptPath)
+}
+
+// `exec`/`execSync` run through a shell, so argv[0] is the shell. Overlay unconditionally;
+// `NODE_OPTIONS` only affects Node descendants.
+function patchExecOptions (options) {
+  const base = options || {}
+  const env = applyCoverageEnv(base.env, { cwd: base.cwd })
+  if (env === base.env) return options
+  return { ...base, env }
+}
+
+/**
+ * Installs monkey-patches on `child_process` so every Node.js descendant inherits the
+ * coverage bootstrap. Idempotent.
+ *
+ * @returns {void}
+ */
+function installPatch () {
+  if (!isCoverageActive() || childProcess[PATCHED]) return
+
+  const originalFork = childProcess.fork
+  const originalSpawn = childProcess.spawn
+  const originalSpawnSync = childProcess.spawnSync
+  const originalExecFile = childProcess.execFile
+  const originalExecFileSync = childProcess.execFileSync
+  const originalExec = childProcess.exec
+  const originalExecSync = childProcess.execSync
+
+  childProcess.fork = function (modulePath, args, options) {
+    const n = normalizeArgs(args, options)
+    return originalFork.call(this, modulePath, n.args, patchOptions(n.options, modulePath))
+  }
+
+  const wrapSpawnLike = original => function (command, args, options) {
+    const n = normalizeArgs(args, options)
+    return original.call(this, command, n.args, patchSpawnOptions(n.options, command, n.args))
+  }
+
+  childProcess.spawn = wrapSpawnLike(originalSpawn)
+  childProcess.spawnSync = wrapSpawnLike(originalSpawnSync)
+  childProcess.execFileSync = wrapSpawnLike(originalExecFileSync)
+  function execFile (file, args, options, callback) {
+    if (typeof args === 'function') {
+      callback = args
+      args = []
+      options = {}
+    } else if (typeof options === 'function') {
+      callback = options
+      options = {}
+    }
+    const n = normalizeArgs(args, options)
+    return originalExecFile.call(this, file, n.args, patchSpawnOptions(n.options, file, n.args), callback)
+  }
+  execFile.__promisify__ = originalExecFile.__promisify__
+  childProcess.execFile = execFile
+  function exec (command, options, callback) {
+    if (typeof options === 'function') {
+      callback = options
+      options = undefined
+    }
+    return originalExec.call(this, command, patchExecOptions(options), callback)
+  }
+  exec.__promisify__ = originalExec.__promisify__
+  childProcess.exec = exec
+
+  childProcess.execSync = function (command, options) {
+    return originalExecSync.call(this, command, patchExecOptions(options))
+  }
+
+  childProcess[PATCHED] = true
+}
+
+module.exports = { installPatch }
diff --git a/integration-tests/coverage/register.js b/integration-tests/coverage/register.js
new file mode 100644
index 00000000000..3ec51691570
--- /dev/null
+++ b/integration-tests/coverage/register.js
@@ -0,0 +1,13 @@
+'use strict'
+
+// Seed ROOT_ENV before loading `./runtime` so module-scope consumers (e.g. `COVERAGE_SLOWDOWN`)
+// observe coverage as active from the first require.
+const { realpathSync } = require('node:fs')
+const path = require('node:path')
+process.env.DD_TRACE_INTEGRATION_COVERAGE_ROOT = realpathSync(path.resolve(__dirname, '..', '..'))
+
+const { installPatch } = require('./patch-child-process')
+const { resetCollectorRoot } = require('./runtime')
+
+resetCollectorRoot()
+installPatch()
diff --git a/integration-tests/coverage/run-suite.js b/integration-tests/coverage/run-suite.js
new file mode 100644
index 00000000000..5a26588d21a
--- /dev/null
+++ b/integration-tests/coverage/run-suite.js
@@ -0,0 +1,32 @@
+'use strict'
+
+// Entry point for coverage-enabled integration test runs. Forwards CLI args to Mocha, then
+// always invokes the merge step so partial coverage is produced even if some tests fail.
+const { spawnSync } = require('node:child_process')
+const os = require('node:os')
+const path = require('node:path')
+
+const { scriptLabel } = require('./runtime')
+
+const repoRoot = path.resolve(__dirname, '..', '..')
+const mochaBin = path.join(repoRoot, 'node_modules', 'mocha', 'bin', 'mocha.js')
+const mergeScript = path.join(__dirname, 'merge-lcov.js')
+const registerScript = path.join(__dirname, 'register.js')
+
+// Per-script tarball cache so two `*:coverage` runs in the same checkout don't race on a
+// single `/tmp` file; `createSandbox` reuses the tarball if it exists, skipping `bun pm pack`.
+if (!process.env.DD_TEST_SANDBOX_TARBALL_PATH) {
+  const label = scriptLabel() || 'default'
+  process.env.DD_TEST_SANDBOX_TARBALL_PATH = path.join(os.tmpdir(), `dd-trace-coverage-sandbox-${label}.tgz`)
+}
+
+const spawnOptions = { cwd: repoRoot, env: process.env, stdio: 'inherit' }
+const mochaResult = spawnSync(
+  process.execPath,
+  [mochaBin, '--require', registerScript, ...process.argv.slice(2)],
+  spawnOptions,
+)
+const mergeResult = spawnSync(process.execPath, [mergeScript], spawnOptions)
+
+// Fall through to the merger's status only when mocha passed cleanly; preserve signal deaths as 1.
+process.exitCode = (mochaResult.status ?? 1) || (mergeResult.status ?? 1)
diff --git a/integration-tests/coverage/runtime.js b/integration-tests/coverage/runtime.js
new file mode 100644
index 00000000000..2016ef2a43b
--- /dev/null
+++ b/integration-tests/coverage/runtime.js
@@ -0,0 +1,254 @@
+'use strict'
+
+const { existsSync, mkdirSync, readFileSync, realpathSync, rmSync } = require('node:fs')
+const path = require('node:path')
+const { fileURLToPath } = require('node:url')
+
+// IPC sentinel `helpers#stopProc` sends on Windows to trigger nyc's exit hook.
+const FLUSH_SIGNAL_KEY = '__ddCovFlush'
+const COLLECTOR_ENV = 'DD_TRACE_INTEGRATION_COVERAGE_COLLECTOR'
+// Per-spawn opt-out. Callers set this in the child env they pass to `fork`/`exec`/`spawn`
+// when the child must not carry the coverage bootstrap (e.g. timing-sensitive fixtures
+// whose semantics break once nyc's require-hook doubles child startup time).
+const DISABLE_ENV = 'DD_TRACE_INTEGRATION_COVERAGE_DISABLE'
+// Presence of ROOT_ENV activates the coverage harness for a process tree.
+const ROOT_ENV = 'DD_TRACE_INTEGRATION_COVERAGE_ROOT'
+const REPO_ROOT = path.resolve(__dirname, '..', '..')
+const CHILD_BOOTSTRAP_PATH = path.join(__dirname, 'child-bootstrap.js')
+const BOOTSTRAP_REQUIRE_ARG = `--require=${CHILD_BOOTSTRAP_PATH}`
+
+// Multiplier applied to coverage-sensitive test timeouts. 3x is the smallest factor that
+// stays green for NYC-instrumented children on the GitHub runners we target.
+const COVERAGE_SLOWDOWN = process.env[ROOT_ENV] ? 3 : 1
+
+const packageNameCache = new Map()
+const rootCache = new Map()
+
+/**
+ * @param {string} value
+ * @returns {string}
+ */
+function canonicalizePath (value) {
+  try { return realpathSync(value) } catch { return value }
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {boolean}
+ */
+function isCoverageActive (env = process.env) {
+  return Boolean(env[ROOT_ENV])
+}
+
+/**
+ * Slug of the active `npm_lifecycle_event`. Used to scope every per-run artifact so parallel
+ * `*:coverage` scripts never share scratch or final output.
+ *
+ * @returns {string}
+ */
+function scriptLabel () {
+  const event = process.env.npm_lifecycle_event ?? ''
+  return event.replaceAll(/[^a-zA-Z0-9._-]+/g, '-')
+}
+
+/**
+ * `"-<label>"` when `npm_lifecycle_event` is set, `""` otherwise. Used to suffix per-run paths.
+ *
+ * @returns {string}
+ */
+function labelSuffix () {
+  const label = scriptLabel()
+  return label ? `-${label}` : ''
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string}
+ */
+function getCollectorRoot (env = process.env) {
+  if (env[COLLECTOR_ENV]) return env[COLLECTOR_ENV]
+  return path.join(REPO_ROOT, '.nyc_output', `integration-tests-collector${labelSuffix()}`)
+}
+
+/**
+ * @returns {string}
+ */
+function resetCollectorRoot () {
+  const root = getCollectorRoot()
+  rmSync(root, { force: true, recursive: true })
+  mkdirSync(path.join(root, 'sandboxes'), { recursive: true })
+  return root
+}
+
+/**
+ * @param {string} folder
+ * @returns {string}
+ */
+function getSandboxCollectorDir (folder) {
+  return path.join(getCollectorRoot(), 'sandboxes', path.basename(folder))
+}
+
+/**
+ * Mirrors `nyc.config.js` (`coverage/node-${version}${label}`) so Codecov discovery and
+ * `scripts/verify-coverage.js` treat integration and unit reports identically.
+ *
+ * @returns {string}
+ */
+function getMergedReportDir () {
+  return path.join(REPO_ROOT, 'coverage', `node-${process.version}${labelSuffix()}`)
+}
+
+/**
+ * @param {string} coverageRoot
+ * @returns {{ reportDir: string, tempDir: string }}
+ */
+function getSandboxNycPaths (coverageRoot) {
+  return {
+    reportDir: path.join(coverageRoot, 'coverage', 'integration-tests'),
+    tempDir: path.join(coverageRoot, '.nyc_output', 'integration-tests'),
+  }
+}
+
+/**
+ * @param {string | URL | undefined} value
+ * @param {string} [cwd]
+ * @returns {string | undefined}
+ */
+function toPath (value, cwd) {
+  if (!value) return
+  if (value instanceof URL) return canonicalizePath(fileURLToPath(value))
+  if (typeof value !== 'string') return
+  return canonicalizePath(path.resolve(cwd || process.cwd(), value))
+}
+
+/**
+ * @param {string} filename
+ * @returns {string | undefined}
+ */
+function readPackageName (filename) {
+  if (packageNameCache.has(filename)) return packageNameCache.get(filename)
+  let name
+  try { name = JSON.parse(readFileSync(filename, 'utf8')).name } catch {}
+  packageNameCache.set(filename, name)
+  return name
+}
+
+/**
+ * Walks up from `directory` looking for a `dd-trace` package root, either at the directory
+ * itself or nested as `<dir>/node_modules/dd-trace/`. Only positive results are cached —
+ * `execSync` patching re-enters here during sandbox bring-up before dd-trace is installed,
+ * and caching that miss would blind later tear-down lookups.
+ *
+ * @param {string} directory
+ * @returns {string | undefined}
+ */
+function findDdTraceRoot (directory) {
+  const normalized = canonicalizePath(directory)
+  const cached = rootCache.get(normalized)
+  if (cached) return cached
+
+  let current = normalized
+  while (true) {
+    const nested = path.join(current, 'node_modules', 'dd-trace', 'package.json')
+    if (existsSync(nested) && readPackageName(nested) === 'dd-trace') {
+      const result = path.dirname(nested)
+      rootCache.set(normalized, result)
+      return result
+    }
+    const own = path.join(current, 'package.json')
+    if (existsSync(own) && readPackageName(own) === 'dd-trace') {
+      rootCache.set(normalized, current)
+      return current
+    }
+    const parent = path.dirname(current)
+    if (parent === current) return
+    current = parent
+  }
+}
+
+/**
+ * @param {object} [options]
+ * @param {string} [options.cwd]
+ * @param {string | URL} [options.scriptPath]
+ * @returns {string | undefined}
+ */
+function resolveCoverageRoot (options = {}) {
+  const scriptPath = toPath(options.scriptPath, options.cwd)
+  const candidates = [
+    scriptPath ? path.dirname(scriptPath) : undefined,
+    toPath(options.cwd),
+    process.env[ROOT_ENV],
+    process.cwd(),
+  ]
+
+  const seen = new Set()
+  for (const candidate of candidates) {
+    if (!candidate || seen.has(candidate)) continue
+    seen.add(candidate)
+    const root = findDdTraceRoot(candidate)
+    if (root) return root
+  }
+}
+
+/**
+ * Must be Node's FIRST `--require`. Otherwise a caller-provided preloader (e.g.
+ * `-r dd-trace/ci/init`) runs before nyc's require hook, leaving its module graph
+ * uninstrumented.
+ *
+ * @param {string | undefined} nodeOptions
+ * @returns {string}
+ */
+function prependBootstrapRequire (nodeOptions) {
+  if (nodeOptions?.includes(CHILD_BOOTSTRAP_PATH)) return nodeOptions
+  return nodeOptions ? `${BOOTSTRAP_REQUIRE_ARG} ${nodeOptions}` : BOOTSTRAP_REQUIRE_ARG
+}
+
+/**
+ * Returns a new env with the coverage activation flags + a `NODE_OPTIONS` that preloads
+ * `child-bootstrap.js`. Returns the original env unchanged when coverage is off or the
+ * dd-trace root can't be resolved from the given context.
+ *
+ * @param {NodeJS.ProcessEnv | undefined} env
+ * @param {object} [options]
+ * @param {string} [options.cwd]
+ * @param {string | URL} [options.scriptPath]
+ * @returns {NodeJS.ProcessEnv | undefined}
+ */
+function applyCoverageEnv (env, options = {}) {
+  if (!isCoverageActive()) return env
+  const baseEnv = env || process.env
+  if (baseEnv[DISABLE_ENV]) {
+    // Strip any inherited ROOT_ENV so a stray bootstrap load short-circuits for grandchildren.
+    const { [ROOT_ENV]: _omit, ...rest } = baseEnv
+    return rest
+  }
+  const root = resolveCoverageRoot(options)
+  if (!root) return env
+  return {
+    ...baseEnv,
+    [ROOT_ENV]: canonicalizePath(root),
+    NODE_OPTIONS: prependBootstrapRequire(baseEnv.NODE_OPTIONS),
+  }
+}
+
+module.exports = {
+  BOOTSTRAP_REQUIRE_ARG,
+  CHILD_BOOTSTRAP_PATH,
+  COLLECTOR_ENV,
+  COVERAGE_SLOWDOWN,
+  DISABLE_ENV,
+  FLUSH_SIGNAL_KEY,
+  REPO_ROOT,
+  ROOT_ENV,
+  applyCoverageEnv,
+  canonicalizePath,
+  getCollectorRoot,
+  getMergedReportDir,
+  getSandboxCollectorDir,
+  getSandboxNycPaths,
+  isCoverageActive,
+  prependBootstrapRequire,
+  resetCollectorRoot,
+  resolveCoverageRoot,
+  scriptLabel,
+}
diff --git a/integration-tests/cypress/cypress.spec.js b/integration-tests/cypress/cypress.spec.js
index aa4ca0a0acd..0feafc4e174 100644
--- a/integration-tests/cypress/cypress.spec.js
+++ b/integration-tests/cypress/cypress.spec.js
@@ -144,7 +144,6 @@ moduleTypes.forEach(({
       return
     }
 
-    this.retries(2)
     this.timeout(80000)
     let cwd, receiver, childProcess, webAppPort, webAppServer, secondWebAppServer
 
diff --git a/integration-tests/debugger/diagnostics.spec.js b/integration-tests/debugger/diagnostics.spec.js
index 7718807c2a1..b21a94276ed 100644
--- a/integration-tests/debugger/diagnostics.spec.js
+++ b/integration-tests/debugger/diagnostics.spec.js
@@ -208,6 +208,9 @@ describe('Dynamic Instrumentation', function () {
         let receivedAckUpdate = false
 
         t.agent.on('remote-config-ack-update', (id, version, state, error) => {
+          // Transitional UNACKNOWLEDGED can arrive before the worker transitions to ERROR.
+          if (state === UNACKNOWLEDGED) return
+
           assert.strictEqual(id, `logProbe_${config.id}`)
           assert.strictEqual(version, 1)
           assert.strictEqual(state, ERROR)
diff --git a/integration-tests/debugger/re-evaluation.spec.js b/integration-tests/debugger/re-evaluation.spec.js
index da033889539..f2fbcc1e368 100644
--- a/integration-tests/debugger/re-evaluation.spec.js
+++ b/integration-tests/debugger/re-evaluation.spec.js
@@ -24,7 +24,10 @@ const { generateProbeConfig } = require('../../packages/dd-trace/test/debugger/d
 // purely a CommonJS application, this race condition will probably never be triggered.
 //
 // This test tries to trigger the race condition. However, it doesn't always happen, so it runs multiple times.
-describe('Dynamic Instrumentation Probe Re-Evaluation', function () {
+// NYC preloaded into the sandbox child injects a `node_modules/ms/index.js` that deterministically defeats the
+// suffix-match picker in `findScriptFromPartialPath`, so the suite is skipped under the coverage harness.
+const describeOrSkip = process.env.DD_TRACE_INTEGRATION_COVERAGE_ROOT ? describe.skip : describe
+describeOrSkip('Dynamic Instrumentation Probe Re-Evaluation', function () {
   useSandbox(
     undefined,
     undefined,
diff --git a/integration-tests/debugger/snapshot-time-budget.spec.js b/integration-tests/debugger/snapshot-time-budget.spec.js
index e155e9d6d4f..6ffb4d0020a 100644
--- a/integration-tests/debugger/snapshot-time-budget.spec.js
+++ b/integration-tests/debugger/snapshot-time-budget.spec.js
@@ -7,6 +7,11 @@ const {
 } = require('../../packages/dd-trace/src/debugger/devtools_client/snapshot/constants')
 const { setup } = require('./utils')
 
+// Budget covers spawning fastify, installing a probe, and collecting one snapshot. NYC
+// preloaded into the sandbox child inflates startup enough to blow past 2s, so we bump it
+// just enough to stay reliable while still catching a crashed debugger worker thread.
+const FUZZ_TEST_TIMEOUT_MS = process.env.DD_TRACE_INTEGRATION_COVERAGE_ROOT ? 4000 : 2000
+
 describe('Dynamic Instrumentation', function () {
   describe('input messages', function () {
     describe('with snapshot under time budget', function () {
@@ -156,7 +161,7 @@ describe('Dynamic Instrumentation', function () {
           context(`graceful handling with time budget of ${budget}ms`, function () {
             // Anything longer than this, and the debugger worker thread most likely crashed.
             // Run test with `DD_TRACE_DEBUG=true` to see more.
-            this.timeout(2000)
+            this.timeout(FUZZ_TEST_TIMEOUT_MS)
 
             const t = setup({
               testApp: 'target-app/time-budget.js',
diff --git a/integration-tests/helpers/index.js b/integration-tests/helpers/index.js
index ecdc8444b58..1d647b95992 100644
--- a/integration-tests/helpers/index.js
+++ b/integration-tests/helpers/index.js
@@ -13,6 +13,13 @@ const { inspect } = require('util')
 
 const id = require('../../packages/dd-trace/src/id')
 const { getCappedRange } = require('../../packages/dd-trace/test/plugins/versions')
+const finalizeSandboxCoverage = require('../coverage/finalize-sandbox')
+const {
+  FLUSH_SIGNAL_KEY,
+  applyCoverageEnv,
+  isCoverageActive,
+  resolveCoverageRoot,
+} = require('../coverage/runtime')
 const FakeAgent = require('./fake-agent')
 const { BUN, withBun } = require('./bun')
 
@@ -37,7 +44,11 @@ const defaultStopProcTimeoutMs = 2_000
  * @param {string} expectedSource
  */
 async function runAndCheckOutput (filename, cwd, expectedOut, expectedSource) {
-  const proc = spawn(process.execPath, [filename], { cwd, stdio: 'pipe' })
+  const proc = spawn(process.execPath, [filename], {
+    cwd,
+    env: applyCoverageEnv(undefined, { cwd, scriptPath: filename }),
+    stdio: 'pipe',
+  })
   assert(proc.pid !== undefined, 'Process PID is not available')
   const pid = proc.pid
   let out = await new Promise((resolve, reject) => {
@@ -280,6 +291,13 @@ async function stopProc (proc, options = {}) {
   const signal = options.signal ?? 'SIGTERM'
   const timeoutMs = options.timeoutMs ?? defaultStopProcTimeoutMs
 
+  // Windows `proc.kill('SIGTERM')` is forceful, so nyc's exit hook never runs. Ask the
+  // bootstrap to flush via the explicit sentinel; POSIX SIGTERM flushes on its own.
+  if (process.platform === 'win32' && isCoverageActive() && proc.connected) {
+    proc.send({ [FLUSH_SIGNAL_KEY]: true }, () => {})
+    if (await waitForProcExit(proc, timeoutMs)) return
+  }
+
   proc.kill(signal)
 
   const exitedAfterInitialSignal = await waitForProcExit(proc, timeoutMs)
@@ -330,8 +348,18 @@ function waitForProcExit (proc, timeoutMs) {
  * @returns {SpawnedProcess}
  */
 function spawnProcImpl (filename, options, stdioHandler, stderrHandler) {
+  const cwd = typeof options.cwd === 'string' ? options.cwd : undefined
+  const scriptPath = typeof filename === 'string' ? filename : undefined
   // Cast to SpawnedProcess type - when stdio is 'pipe', stdout/stderr are guaranteed non-null
-  const proc = /** @type {SpawnedProcess} */ (fork(filename, { ...options, stdio: 'pipe' }))
+  const proc = /** @type {SpawnedProcess} */ (fork(filename, {
+    ...options,
+    env: applyCoverageEnv(options.env, {
+      cwd,
+      scriptPath,
+    }),
+    execArgv: options.execArgv,
+    stdio: 'pipe',
+  }))
 
   proc.stdout.on('data', data => {
     if (stdioHandler) {
@@ -483,7 +511,11 @@ async function createSandbox (
     execHelper('yarn link')
     execHelper('yarn link dd-trace')
     // ... run the tests in the current directory.
-    return { folder: path.join(process.cwd(), 'integration-tests'), remove: async () => {} }
+    return {
+      coverageRoot: resolveCoverageRoot({ cwd: process.cwd() }),
+      folder: path.join(process.cwd(), 'integration-tests'),
+      remove: async () => {},
+    }
   }
   const folder = path.join(sandboxRoot, id().toString())
   const tarballEnv = process.env.DD_TEST_SANDBOX_TARBALL_PATH
@@ -553,8 +585,11 @@ async function createSandbox (
   }
 
   return {
+    coverageRoot: resolveCoverageRoot({ cwd: folder }),
     folder,
-    remove: () => {
+    remove: async () => {
+      await finalizeSandboxCoverage(folder, resolveCoverageRoot({ cwd: folder }))
+
       // Use `exec` below, instead of `fs.rm` to keep support for older Node.js versions, since this code is called in
       // our `integration-guardrails` GitHub Actions workflow
       if (process.platform === 'win32') {
@@ -684,7 +719,7 @@ function telemetryForwarder (shouldExpectTelemetryPoints = true) {
         if (!data && retries < 10) {
           return tryAgain()
         }
-        throw new SyntaxError(`error parsing data: ${e.message}\n${data}`)
+        throw new SyntaxError(`error parsing data: ${e.message}\n${data}`, { cause: e })
       }
       msgs.push([telemetryType, parsed])
     }
@@ -811,17 +846,19 @@ function preparePluginIntegrationTestSpawnOptions (
     delete additionalEnvArgs.NODE_OPTIONS
   }
 
+  const scriptPath = path.join(cwd, serverFile)
+
   return {
-    filename: path.join(cwd, serverFile),
+    filename: scriptPath,
     options: {
       cwd,
-      env: {
+      env: applyCoverageEnv({
         ...process.env,
         NODE_OPTIONS,
         DD_TRACE_AGENT_PORT: String(agentPort),
         DD_TRACE_FLUSH_INTERVAL: '0',
         ...additionalEnvArgs,
-      },
+      }, { cwd, scriptPath }),
       execArgv,
     },
     stdioHandler,
@@ -898,7 +935,7 @@ function useSandbox (...args) {
 
   after(function () {
     this.timeout(30_000)
-    return sandbox.remove()
+    return sandbox?.remove()
   })
 }
 
diff --git a/integration-tests/jest/jest.spec.js b/integration-tests/jest/jest.spec.js
index 0ac1f220848..2c71f0c3ae2 100644
--- a/integration-tests/jest/jest.spec.js
+++ b/integration-tests/jest/jest.spec.js
@@ -2250,6 +2250,10 @@ describe(`jest@${JEST_VERSION} commonJS`, () => {
             TESTS_TO_RUN: 'ci-visibility/test-total-code-coverage/test-',
             COLLECT_COVERAGE_FROM: '**/test-total-code-coverage/**',
             ENABLE_CODE_COVERAGE: '1',
+            // NYC and jest share `global.__coverage__`, so running this child under the integration
+            // coverage harness inflates jest's coverage map with dd-trace internals and skews the
+            // asserted percentage. Opt this child out to keep the assertion meaningful.
+            DD_TRACE_INTEGRATION_COVERAGE_DISABLE: '1',
           },
         }
       )
diff --git a/integration-tests/mocha/mocha.spec.js b/integration-tests/mocha/mocha.spec.js
index 19dc3d34536..5537db4ceec 100644
--- a/integration-tests/mocha/mocha.spec.js
+++ b/integration-tests/mocha/mocha.spec.js
@@ -7,6 +7,7 @@ const { once } = require('node:events')
 const path = require('path')
 const { assertObjectContains } = require('../helpers')
 
+const { COVERAGE_SLOWDOWN } = require('../coverage/runtime')
 const {
   sandboxCwd,
   useSandbox,
@@ -93,6 +94,8 @@ const MOCHA_VERSION = process.env.MOCHA_VERSION || 'latest'
 const onlyLatestIt = MOCHA_VERSION === 'latest' ? it : it.skip
 
 describe(`mocha@${MOCHA_VERSION}`, function () {
+  this.timeout(this.timeout() * COVERAGE_SLOWDOWN)
+
   let receiver
   let childProcess
   let cwd
@@ -3747,6 +3750,10 @@ describe(`mocha@${MOCHA_VERSION}`, function () {
               './dynamic-instrumentation/test-hit-breakpoint',
             ]),
             DD_CIVISIBILITY_FLAKY_RETRY_COUNT: '1',
+            // DI breakpoints arm asynchronously via Inspector. nyc's require-hook slows
+            // child startup enough that the single retry finishes before the probe is
+            // live, so we opt this child out of the coverage harness.
+            DD_TRACE_INTEGRATION_COVERAGE_DISABLE: '1',
           },
         }
       )
diff --git a/integration-tests/opentelemetry.spec.js b/integration-tests/opentelemetry.spec.js
index b0feff6328e..fdbf0bda9df 100644
--- a/integration-tests/opentelemetry.spec.js
+++ b/integration-tests/opentelemetry.spec.js
@@ -6,6 +6,7 @@ const { fork } = require('child_process')
 const { join } = require('path')
 const axios = require('axios')
 const { FakeAgent, sandboxCwd, useSandbox, stopProc } = require('./helpers')
+const { COVERAGE_SLOWDOWN } = require('./coverage/runtime')
 
 async function check (agent, proc, timeout, onMessage = () => { }, isMetrics) {
   const messageReceiver = isMetrics
@@ -50,8 +51,22 @@ function nearNow (ts, now = Date.now(), range = 1000) {
   return delta < range && delta >= 0
 }
 
+async function getWithRetry (url, timeoutMs) {
+  const deadline = Date.now() + timeoutMs
+  let lastErr
+  while (Date.now() < deadline) {
+    try {
+      return await axios.get(url)
+    } catch (err) {
+      lastErr = err
+      await new Promise(resolve => setTimeout(resolve, 100))
+    }
+  }
+  throw lastErr
+}
+
 describe('opentelemetry', function () {
-  this.timeout(20000)
+  this.timeout(20_000 * COVERAGE_SLOWDOWN)
 
   let agent = /** @type {FakeAgent | null} */ (null)
   let proc
@@ -242,17 +257,19 @@ describe('opentelemetry', function () {
   })
 
   it('should capture telemetry', async () => {
+    // Coverage slows child boot/OTel init; delay the first heartbeat so it lands after
+    // span creation and scale the child's hold window + `check` timeout accordingly.
     proc = fork(join(cwd, 'opentelemetry/basic.js'), {
       cwd,
       env: {
         DD_TRACE_AGENT_PORT: agent?.port,
         DD_TRACE_OTEL_ENABLED: '1',
-        DD_TELEMETRY_HEARTBEAT_INTERVAL: '1',
-        TIMEOUT: '1500',
+        DD_TELEMETRY_HEARTBEAT_INTERVAL: String(COVERAGE_SLOWDOWN),
+        TIMEOUT: String(1500 * COVERAGE_SLOWDOWN),
       },
     })
 
-    await check(agent, proc, timeout, ({ payload }) => {
+    await check(agent, proc, timeout * COVERAGE_SLOWDOWN, ({ payload }) => {
       assert.strictEqual(payload.request_type, 'generate-metrics')
 
       const metrics = payload.payload
@@ -294,10 +311,10 @@ describe('opentelemetry', function () {
         DD_TELEMETRY_HEARTBEAT_INTERVAL: '1',
       },
     })
-    await new Promise(resolve => setTimeout(resolve, 1000)) // Adjust the delay as necessary
-    await axios.get(`http://localhost:${SERVER_PORT}/first-endpoint`)
+    // Wait for the child to bind; coverage-instrumented boots can exceed a fixed timeout.
+    await getWithRetry(`http://localhost:${SERVER_PORT}/first-endpoint`, 10_000 * COVERAGE_SLOWDOWN)
 
-    await check(agent, proc, 10000, ({ payload }) => {
+    await check(agent, proc, 10_000 * COVERAGE_SLOWDOWN, ({ payload }) => {
       assert.strictEqual(payload.request_type, 'generate-metrics')
 
       const metrics = payload.payload
@@ -366,10 +383,9 @@ describe('opentelemetry', function () {
         DD_TRACE_DISABLED_INSTRUMENTATIONS: 'http,dns,express,net',
       },
     })
-    await new Promise(resolve => setTimeout(resolve, 1000)) // Adjust the delay as necessary
-    await axios.get(`http://localhost:${SERVER_PORT}/first-endpoint`)
+    await getWithRetry(`http://localhost:${SERVER_PORT}/first-endpoint`, 10_000 * COVERAGE_SLOWDOWN)
 
-    await check(agent, proc, 10000, ({ payload }) => {
+    await check(agent, proc, 10_000 * COVERAGE_SLOWDOWN, ({ payload }) => {
       assert.strictEqual(payload.length, 2)
       // combine the traces
       const trace = payload.flat()
diff --git a/integration-tests/package-guardrails.spec.js b/integration-tests/package-guardrails.spec.js
index 563a5beab41..c14a52079ae 100644
--- a/integration-tests/package-guardrails.spec.js
+++ b/integration-tests/package-guardrails.spec.js
@@ -24,7 +24,9 @@ delete process.env.DD_INJECTION_ENABLED
 delete process.env.DD_INJECT_FORCE
 
 describe('package guardrails', () => {
-  useEnv({ NODE_OPTIONS })
+  // NYC's signal-exit hook can beat our `beforeExit` handlers, dropping the abort.integration
+  // telemetry / log output these assertions rely on. Opt children out of the coverage harness.
+  useEnv({ NODE_OPTIONS, DD_TRACE_INTEGRATION_COVERAGE_DISABLE: '1' })
   const runTest = (expectedOut, expectedTelemetryPoints, expectedSource = '') =>
     testFile('package-guardrails/index.js', expectedOut, expectedTelemetryPoints, expectedSource)
 
diff --git a/integration-tests/playwright.config.js b/integration-tests/playwright.config.js
index 0efce106a30..ad9610d1b1a 100644
--- a/integration-tests/playwright.config.js
+++ b/integration-tests/playwright.config.js
@@ -2,6 +2,7 @@
 
 // Playwright config file for integration tests
 const { devices } = require('@playwright/test')
+const { COVERAGE_SLOWDOWN } = require('./coverage/runtime')
 
 const projects = [
   {
@@ -26,7 +27,7 @@ if (process.env.ADD_EXTRA_PLAYWRIGHT_PROJECT) {
 const config = {
   baseURL: process.env.PW_BASE_URL,
   testDir: process.env.TEST_DIR || './ci-visibility/playwright-tests',
-  timeout: Number(process.env.TEST_TIMEOUT) || 30000,
+  timeout: Number(process.env.TEST_TIMEOUT) || 30000 * COVERAGE_SLOWDOWN,
   fullyParallel: process.env.FULLY_PARALLEL === 'true',
   workers: process.env.PLAYWRIGHT_WORKERS ? Number(process.env.PLAYWRIGHT_WORKERS) : undefined,
   reporter: 'line',
diff --git a/integration-tests/playwright/playwright.spec.js b/integration-tests/playwright/playwright.spec.js
index b1c7010c7e3..21f97e324f2 100644
--- a/integration-tests/playwright/playwright.spec.js
+++ b/integration-tests/playwright/playwright.spec.js
@@ -14,6 +14,7 @@ const {
   getCiVisEvpProxyConfig,
   assertObjectContains,
 } = require('../helpers')
+const { COVERAGE_SLOWDOWN } = require('../coverage/runtime')
 const { FakeCiVisIntake } = require('../ci-visibility-intake')
 const { createWebAppServer } = require('../ci-visibility/web-app-server')
 const { createWebAppServerWithRedirect } = require('../ci-visibility/web-app-server-with-redirect')
@@ -81,15 +82,14 @@ versions.forEach((version) => {
   describe(`playwright@${version}`, function () {
     let cwd, receiver, childProcess, webAppPort, webPortWithRedirect, webAppServer, webAppServerWithRedirect
 
-    this.retries(2)
-    this.timeout(80000)
+    this.timeout(80000 * COVERAGE_SLOWDOWN)
 
     // TODO: Update tests files accordingly and test with different TS versions
     useSandbox([`@playwright/test@${version}`, '@types/node', 'typescript@5'], true)
 
     before(function (done) {
       // Increase timeout for this hook specifically to account for slow chromium installation in CI
-      this.timeout(120000)
+      this.timeout(120000 * COVERAGE_SLOWDOWN)
 
       cwd = sandboxCwd()
       const { NODE_OPTIONS, ...restOfEnv } = process.env
diff --git a/integration-tests/profiler/oom.js b/integration-tests/profiler/oom.js
index 5348c933704..6092e67dea2 100644
--- a/integration-tests/profiler/oom.js
+++ b/integration-tests/profiler/oom.js
@@ -6,10 +6,10 @@ require('dd-trace').init()
 const { Worker, isMainThread, threadId } = require('worker_threads')
 
 const nworkers = Number(process.argv[2] || 0)
-const workerMaxOldGenerationSizeMb = process.argv[3]
+const workerMaxOldGenerationSizeMb = Number(process.argv[3]) || 0
 const maxCount = process.argv[4] || 12
 const sleepMs = process.argv[5] || 50
-const sizeQuantum = process.argv[6] || 5 * 1024 * 1024
+const sizeQuantum = Number(process.argv[6]) || Number(process.env.OOM_SIZE_QUANTUM_BYTES) || 5 * 1024 * 1024
 
 console.log(`${isMainThread ? 'Main thread' : `Worker ${threadId}`}: \
 nworkers=${nworkers} workerMaxOldGenerationSizeMb=${workerMaxOldGenerationSizeMb} \
@@ -20,7 +20,9 @@ if (isMainThread) {
     const worker = new Worker(__filename,
       {
         argv: [0, ...process.argv.slice(3)],
-        ...(workerMaxOldGenerationSizeMb ? { resourceLimits: { maxOldGenerationSizeMb: 50 } } : {}),
+        ...(workerMaxOldGenerationSizeMb
+          ? { resourceLimits: { maxOldGenerationSizeMb: workerMaxOldGenerationSizeMb } }
+          : {}),
       })
     const threadId = worker.threadId
     worker
diff --git a/integration-tests/profiler/profiler.spec.js b/integration-tests/profiler/profiler.spec.js
index fa1980a901d..70b47faa071 100644
--- a/integration-tests/profiler/profiler.spec.js
+++ b/integration-tests/profiler/profiler.spec.js
@@ -11,6 +11,7 @@ const net = require('net')
 const zlib = require('zlib')
 const satisfies = require('semifies')
 const { Profile } = require('../../vendor/dist/pprof-format')
+const { COVERAGE_SLOWDOWN } = require('../coverage/runtime')
 const {
   FakeAgent,
   sandboxCwd,
@@ -24,9 +25,26 @@ if (process.platform !== 'win32') {
   DEFAULT_PROFILE_TYPES.push('events')
 }
 
-const TIMEOUT = 30000
+// NYC instrumentation roughly doubles child-process startup cost; Windows adds even more
+// overhead. Scale the baseline timeout so the same scenarios have headroom under coverage.
+const TIMEOUT = 30000 * COVERAGE_SLOWDOWN
 const isAtLeast24 = satisfies(process.versions.node, '>=24.0.0')
 
+// When the integration-test coverage harness preloads NYC into forked children, both startup
+// latency and heap footprint increase. The knobs below keep the profiler scenarios exercising
+// the same failure modes (timeline events inside the process lifetime; OOM under a tight heap
+// budget) without disabling coverage for the child.
+const COVERAGE_ACTIVE = COVERAGE_SLOWDOWN > 1
+// Slack on each side of [procStart, procEnd] that absorbs NYC's require-hook + module-transform
+// overhead, which can otherwise push early timeline samples before `procStart`.
+const TIMELINE_WINDOW_SLACK_NS = COVERAGE_ACTIVE ? 3_000_000_000n : 0n
+// NYC's instrumented require cache eats ~40-50MB before any user code runs. The budget needs to
+// leave enough headroom for the extension-based recovery tests (+45MB in aggregate) to complete
+// before the kernel/V8 reap the child, while still being tight enough for the fail-fast tests
+// (+10MB) to exceed the budget once user allocations land on top of NYC's instrumented graph.
+const OOM_HEAP_MB = COVERAGE_ACTIVE ? 110 : 50
+const OOM_SIZE_QUANTUM_BYTES = (COVERAGE_ACTIVE ? 8 : 5) * 1024 * 1024
+
 function checkProfiles (agent, proc, timeout,
   expectedProfileTypes = DEFAULT_PROFILE_TYPES, expectBadExit = false, expectSeq = true
 ) {
@@ -270,11 +288,11 @@ async function gatherTimelineEvents (cwd, scriptFilePath, agentPort, eventType,
           }
       }
     }
-    // Timestamp must be defined and be between process start and end time
+    // Timestamp must be defined and within the process lifetime (plus coverage slack).
     assert.notStrictEqual(ts, undefined, encoded)
     assert.strictEqual(typeof ts, 'bigint', encoded)
-    assert.ok(ts <= procEnd, encoded)
-    assert.ok(ts >= procStart, encoded)
+    assert.ok(ts <= procEnd + TIMELINE_WINDOW_SLACK_NS, encoded)
+    assert.ok(ts >= procStart - TIMELINE_WINDOW_SLACK_NS, encoded)
     // Gather only tested events
     if (event === eventValue) {
       if (process.platform !== 'win32') {
@@ -330,7 +348,7 @@ describe('profiler', () => {
     profilerTestFile = path.join(cwd, 'profiler/index.js')
     ssiTestFile = path.join(cwd, 'profiler/ssi.js')
     oomTestFile = path.join(cwd, 'profiler/oom.js')
-    oomExecArgv = ['--max-old-space-size=50']
+    oomExecArgv = [`--max-old-space-size=${OOM_HEAP_MB}`]
   })
 
   beforeEach(async () => {
@@ -564,6 +582,7 @@ describe('profiler', () => {
         DD_PROFILING_ENABLED: '1',
         DD_TRACE_DEBUG: '1',
         DD_TRACE_LOG_LEVEL: 'warn',
+        OOM_SIZE_QUANTUM_BYTES: String(OOM_SIZE_QUANTUM_BYTES),
       }
     })
 
@@ -602,7 +621,7 @@ describe('profiler', () => {
       })
 
       it('sends a heap profile on OOM in worker thread and exits successfully', () => {
-        proc = fork(oomTestFile, [1, 50], {
+        proc = fork(oomTestFile, [1, OOM_HEAP_MB], {
           cwd,
           env: { ...oomEnv, DD_PROFILING_WALLTIME_ENABLED: '0' },
         })
diff --git a/nyc.config.js b/nyc.config.js
index 3ff611feb5b..1e0ed774324 100644
--- a/nyc.config.js
+++ b/nyc.config.js
@@ -30,6 +30,7 @@ module.exports = {
   ],
   exclude: [
     '**/.bun/**',
+    '**/*-browser-scripts.js', // Serialized into browsers; NYC counter bumps would ReferenceError.
     '**/*.spec.*',
     '**/fixtures/**',
     '**/integration-tests/**',
diff --git a/package.json b/package.json
index 9602c68fdb1..3dd7d8258f3 100644
--- a/package.json
+++ b/package.json
@@ -64,23 +64,38 @@
     "test:profiler": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- packages/dd-trace/test/profiling/**/*.spec.js",
     "test:profiler:ci": "nyc -- npm run test:profiler",
     "test:integration": "mocha --timeout 60000 \"integration-tests/*.spec.js\"",
+    "test:integration:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 60000 \"integration-tests/*.spec.js\"",
     "test:integration:aiguard": "mocha --timeout 60000 \"integration-tests/aiguard/*.spec.js\"",
+    "test:integration:aiguard:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 60000 \"integration-tests/aiguard/*.spec.js\"",
     "test:integration:appsec": "mocha --timeout 60000 \"integration-tests/appsec/*.spec.js\"",
+    "test:integration:appsec:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 60000 \"integration-tests/appsec/*.spec.js\"",
     "test:integration:bun": "mocha --timeout 60000 \"integration-tests/bun/*.spec.js\"",
     "test:integration:cucumber": "mocha --timeout 60000 \"integration-tests/cucumber/*.spec.js\"",
+    "test:integration:cucumber:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 60000 \"integration-tests/cucumber/*.spec.js\"",
     "test:integration:cypress": "mocha --timeout 60000 \"integration-tests/cypress/*.spec.js\"",
+    "test:integration:cypress:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 60000 \"integration-tests/cypress/*.spec.js\"",
     "test:integration:debugger": "mocha --timeout 60000 \"integration-tests/debugger/*.spec.js\"",
+    "test:integration:debugger:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 60000 \"integration-tests/debugger/*.spec.js\"",
     "test:integration:esbuild": "mocha --timeout 60000 \"integration-tests/esbuild/*.spec.js\"",
     "test:integration:webpack": "mocha --timeout 60000 \"integration-tests/webpack/*.spec.js\"",
     "test:integration:openfeature": "mocha --timeout 60000 \"integration-tests/openfeature/*.spec.js\"",
+    "test:integration:openfeature:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 60000 \"integration-tests/openfeature/*.spec.js\"",
     "test:integration:jest": "mocha --timeout 60000 \"integration-tests/jest/*.spec.js\"",
+    "test:integration:jest:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 60000 \"integration-tests/jest/*.spec.js\"",
     "test:integration:mocha": "mocha --timeout 60000 \"integration-tests/mocha/*.spec.js\"",
+    "test:integration:mocha:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 60000 \"integration-tests/mocha/*.spec.js\"",
     "test:integration:playwright": "mocha --timeout 60000 \"integration-tests/playwright/*.spec.js\"",
+    "test:integration:playwright:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 60000 \"integration-tests/playwright/*.spec.js\"",
     "test:integration:selenium": "mocha --timeout 60000 \"integration-tests/selenium/*.spec.js\"",
+    "test:integration:selenium:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 60000 \"integration-tests/selenium/*.spec.js\"",
     "test:integration:vitest": "mocha --timeout 60000 \"integration-tests/vitest/*.spec.js\"",
+    "test:integration:vitest:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 60000 \"integration-tests/vitest/*.spec.js\"",
     "test:integration:testopt": "mocha --timeout 120000 \"integration-tests/ci-visibility/*.spec.js\"",
+    "test:integration:testopt:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 120000 \"integration-tests/ci-visibility/*.spec.js\"",
     "test:integration:profiler": "mocha --timeout 180000 \"integration-tests/profiler/*.spec.js\"",
+    "test:integration:profiler:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 180000 \"integration-tests/profiler/*.spec.js\"",
     "test:integration:plugins": "mocha \"packages/datadog-plugin-@(${PLUGINS})/test/integration-test/**/*.spec.js\"",
+    "test:integration:plugins:coverage": "node ./integration-tests/coverage/run-suite.js \"packages/datadog-plugin-@(${PLUGINS})/test/integration-test/**/*.spec.js\"",
     "test:unit:plugins": "mocha \"packages/datadog-instrumentations/test/@(${PLUGINS}).spec.js\" \"packages/datadog-plugin-@(${PLUGINS})/test/**/*.spec.js\" --exclude \"packages/datadog-plugin-@(${PLUGINS})/test/integration-test/**/*.spec.js\"",
     "test:shimmer": "mocha \"packages/datadog-shimmer/test/**/*.spec.js\"",
     "test:shimmer:ci": "nyc -- npm run test:shimmer",
diff --git a/packages/datadog-instrumentations/src/playwright-browser-scripts.js b/packages/datadog-instrumentations/src/playwright-browser-scripts.js
new file mode 100644
index 00000000000..2053a8c6a2a
--- /dev/null
+++ b/packages/datadog-instrumentations/src/playwright-browser-scripts.js
@@ -0,0 +1,27 @@
+'use strict'
+
+// Serialized into chromium via Playwright's `page.evaluate`. Excluded from NYC by filename in
+// `nyc.config.js` — rename only if you update that glob too.
+
+/** @returns {{ isRumInstrumented: boolean, isRumActive: boolean, rumSamplingRate: number | null }} */
+function detectRum () {
+  const isRumInstrumented = !!window.DD_RUM
+  const isRumActive = window.DD_RUM && window.DD_RUM.getInternalContext
+    ? !!window.DD_RUM.getInternalContext()
+    : false
+  const rumSamplingRate = window.DD_RUM && window.DD_RUM.getInitConfiguration
+    ? window.DD_RUM.getInitConfiguration().sessionSampleRate
+    : null
+  return { isRumInstrumented, isRumActive, rumSamplingRate }
+}
+
+/** @returns {boolean} */
+function stopRumSession () {
+  if (window.DD_RUM && window.DD_RUM.stopSession) {
+    window.DD_RUM.stopSession()
+    return true
+  }
+  return false
+}
+
+module.exports = { detectRum, stopRumSession }
diff --git a/packages/datadog-instrumentations/src/playwright.js b/packages/datadog-instrumentations/src/playwright.js
index 31b04eee3a6..56a592ef77c 100644
--- a/packages/datadog-instrumentations/src/playwright.js
+++ b/packages/datadog-instrumentations/src/playwright.js
@@ -52,6 +52,9 @@ let applyRepeatEachIndex = null
 
 let startedSuites = []
 
+// Browser-side callbacks live in a NYC-excluded file so counter bumps can't reach chromium.
+const { detectRum, stopRumSession } = require('./playwright-browser-scripts')
+
 const STATUS_TO_TEST_STATUS = {
   passed: 'pass',
   failed: 'fail',
@@ -1117,16 +1120,7 @@ addHook({
 
     try {
       if (page) {
-        const { isRumInstrumented, isRumActive, rumSamplingRate } = await page.evaluate(() => {
-          const isRumInstrumented = !!window.DD_RUM
-          const isRumActive = window.DD_RUM && window.DD_RUM.getInternalContext
-            ? !!window.DD_RUM.getInternalContext()
-            : false
-          const rumSamplingRate = window.DD_RUM && window.DD_RUM.getInitConfiguration
-            ? window.DD_RUM.getInitConfiguration().sessionSampleRate
-            : null
-          return { isRumInstrumented, isRumActive, rumSamplingRate }
-        })
+        const { isRumInstrumented, isRumActive, rumSamplingRate } = await page.evaluate(detectRum)
         if (isRumInstrumented && rumSamplingRate < 100 && !isRumActive) {
           log.debug("RUM was detected on the page, but it isn't active because the sampling rate is below 100%")
         }
@@ -1209,13 +1203,7 @@ addHook({
           fn: async function ({ page }) {
             try {
               if (page) {
-                const isRumActive = await page.evaluate(() => {
-                  if (window.DD_RUM && window.DD_RUM.stopSession) {
-                    window.DD_RUM.stopSession()
-                    return true
-                  }
-                  return false
-                })
+                const isRumActive = await page.evaluate(stopRumSession)
 
                 if (isRumActive) {
                   // Give some time RUM to flush data, similar to what we do in selenium
diff --git a/packages/datadog-plugin-azure-durable-functions/test/integration-test/client.spec.js b/packages/datadog-plugin-azure-durable-functions/test/integration-test/client.spec.js
index 3f99b4450a3..efa55ca84f5 100644
--- a/packages/datadog-plugin-azure-durable-functions/test/integration-test/client.spec.js
+++ b/packages/datadog-plugin-azure-durable-functions/test/integration-test/client.spec.js
@@ -1,6 +1,7 @@
 'use strict'
 
 const assert = require('node:assert/strict')
+const path = require('node:path')
 
 const { spawn } = require('child_process')
 const { describe, it } = require('mocha')
@@ -13,6 +14,7 @@ const {
   assertObjectContains,
   stopProc,
 } = require('../../../../integration-tests/helpers')
+const { buildManualCoverageEnv } = require('../../../../integration-tests/coverage/manual-process')
 const { withVersions } = require('../../../dd-trace/test/setup/mocha')
 
 describe('esm', () => {
@@ -101,12 +103,16 @@ describe('esm', () => {
  */
 async function spawnPluginIntegrationTestProc (agentPort) {
   const cwd = sandboxCwd()
-  const env = {
-    NODE_OPTIONS: `--loader=${hookFile}`,
-    DD_TRACE_AGENT_PORT: agentPort,
-    DD_TRACE_DISABLED_PLUGINS: 'amqplib,amqp10,rhea,net',
-    PATH: `${cwd}/node_modules/azure-functions-core-tools/bin:${process.env.PATH}`,
-  }
+  const env = buildManualCoverageEnv({
+    cwd,
+    env: {
+      NODE_OPTIONS: `--loader=${hookFile}`,
+      DD_TRACE_AGENT_PORT: agentPort,
+      DD_TRACE_DISABLED_PLUGINS: 'amqplib,amqp10,rhea,net',
+      PATH: `${cwd}/node_modules/azure-functions-core-tools/bin:${process.env.PATH}`,
+    },
+    scriptPath: path.join(cwd, 'node_modules', 'dd-trace', 'loader-hook.mjs'),
+  })
 
   const options = { cwd, env }
 
diff --git a/packages/datadog-plugin-azure-functions/test/integration-test/eventhubs-test/eventhubs.spec.js b/packages/datadog-plugin-azure-functions/test/integration-test/eventhubs-test/eventhubs.spec.js
index 18eef9de5d1..9851cb240c3 100644
--- a/packages/datadog-plugin-azure-functions/test/integration-test/eventhubs-test/eventhubs.spec.js
+++ b/packages/datadog-plugin-azure-functions/test/integration-test/eventhubs-test/eventhubs.spec.js
@@ -1,6 +1,7 @@
 'use strict'
 
 const assert = require('node:assert/strict')
+const path = require('node:path')
 
 const { spawn } = require('child_process')
 const {
@@ -12,6 +13,7 @@ const {
   curlAndAssertMessage,
   stopProc,
 } = require('../../../../../integration-tests/helpers')
+const { buildManualCoverageEnv } = require('../../../../../integration-tests/coverage/manual-process')
 const { withVersions } = require('../../../../dd-trace/test/setup/mocha')
 
 describe('esm', () => {
@@ -400,6 +402,11 @@ async function spawnPluginIntegrationTestProc (cwd, command, args, agentPort, st
     DD_TRACE_DISABLED_PLUGINS: 'amqplib,amqp10,rhea,net',
   }
   env = { ...env, ...additionalEnvArgs }
+  env = buildManualCoverageEnv({
+    cwd,
+    env,
+    scriptPath: path.join(cwd, 'node_modules', 'dd-trace', 'loader-hook.mjs'),
+  })
   return spawnProc(command, args, {
     cwd,
     env,
diff --git a/packages/datadog-plugin-azure-functions/test/integration-test/http-test/client.spec.js b/packages/datadog-plugin-azure-functions/test/integration-test/http-test/client.spec.js
index 09a729772ba..a588c392287 100644
--- a/packages/datadog-plugin-azure-functions/test/integration-test/http-test/client.spec.js
+++ b/packages/datadog-plugin-azure-functions/test/integration-test/http-test/client.spec.js
@@ -1,6 +1,7 @@
 'use strict'
 
 const assert = require('node:assert/strict')
+const path = require('node:path')
 
 const { spawn } = require('child_process')
 const {
@@ -12,6 +13,7 @@ const {
   curlAndAssertMessage,
   stopProc,
 } = require('../../../../../integration-tests/helpers')
+const { buildManualCoverageEnv } = require('../../../../../integration-tests/coverage/manual-process')
 const { withVersions } = require('../../../../dd-trace/test/setup/mocha')
 
 describe('esm', () => {
@@ -83,6 +85,11 @@ async function spawnPluginIntegrationTestProc (cwd, command, args, agentPort, st
     DD_TRACE_AGENT_PORT: agentPort,
   }
   env = { ...env, ...additionalEnvArgs }
+  env = buildManualCoverageEnv({
+    cwd,
+    env,
+    scriptPath: path.join(cwd, 'node_modules', 'dd-trace', 'loader-hook.mjs'),
+  })
   return spawnProc(command, args, {
     cwd,
     env,
diff --git a/packages/datadog-plugin-azure-functions/test/integration-test/servicebus-test/servicebus.spec.js b/packages/datadog-plugin-azure-functions/test/integration-test/servicebus-test/servicebus.spec.js
index 9e197db2e1b..0dee0d4f63f 100644
--- a/packages/datadog-plugin-azure-functions/test/integration-test/servicebus-test/servicebus.spec.js
+++ b/packages/datadog-plugin-azure-functions/test/integration-test/servicebus-test/servicebus.spec.js
@@ -1,6 +1,7 @@
 'use strict'
 
 const assert = require('node:assert/strict')
+const path = require('node:path')
 
 const { spawn } = require('child_process')
 const {
@@ -12,6 +13,7 @@ const {
   curlAndAssertMessage,
   stopProc,
 } = require('../../../../../integration-tests/helpers')
+const { buildManualCoverageEnv } = require('../../../../../integration-tests/coverage/manual-process')
 const { withVersions } = require('../../../../dd-trace/test/setup/mocha')
 
 describe('esm', () => {
@@ -329,6 +331,11 @@ async function spawnPluginIntegrationTestProc (cwd, command, args, agentPort, st
     DD_TRACE_DISABLED_PLUGINS: 'amqplib,amqp10,rhea,net',
   }
   env = { ...env, ...additionalEnvArgs }
+  env = buildManualCoverageEnv({
+    cwd,
+    env,
+    scriptPath: path.join(cwd, 'node_modules', 'dd-trace', 'loader-hook.mjs'),
+  })
   return spawnProc(command, args, {
     cwd,
     env,
diff --git a/scripts/verify-coverage.js b/scripts/verify-coverage.js
index 5917ca3ca23..a47e30a1244 100644
--- a/scripts/verify-coverage.js
+++ b/scripts/verify-coverage.js
@@ -14,38 +14,56 @@ const { values } = parseArgs({
 })
 
 const cwd = process.cwd()
+const coverageDir = path.join(cwd, 'coverage')
 
 /** @type {string[]} */
 const reportDirsAbs = []
 
-// If the default report dir is being used, prefer checking all top-level `coverage-node-*` directories.
+// Match `nyc.config.js` and `integration-tests/coverage/runtime.js` (`getMergedReportDir()`),
+// which both emit `coverage/node-${version}${label}` directories so Codecov can attribute each
+// test script/Node.js combination independently.
 try {
-  const entries = fs.readdirSync(cwd, { withFileTypes: true })
-  for (const entry of entries) {
-    if (entry.isDirectory() && entry.name.startsWith('coverage-node-')) {
-      reportDirsAbs.push(path.join(cwd, entry.name))
+  for (const entry of fs.readdirSync(coverageDir, { withFileTypes: true })) {
+    if (entry.isDirectory() && entry.name.startsWith('node-')) {
+      reportDirsAbs.push(path.join(coverageDir, entry.name))
     }
   }
-} catch {
-  // ignore
+} catch {}
+
+if (reportDirsAbs.length === 0) {
+  throw new Error(
+    format(
+      'No coverage report directories found under %s. ' +
+      'Expected at least one `node-<version>-<script>` subdirectory with an `lcov.info` ' +
+      '(check that the test step produced coverage and that no later step wiped it). Flags: %s.',
+      path.relative(cwd, coverageDir) || '.',
+      values.flags
+    )
+  )
 }
 
 const emptyReportDirs = []
 
 for (const dirAbs of reportDirsAbs) {
+  // Runtime matrix filters (e.g. cucumber/cypress version guards) can legitimately skip
+  // every test. `merge-lcov.js` drops a `.skipped` sentinel in that case so we stay silent
+  // instead of failing on an empty report.
+  if (fs.existsSync(path.join(dirAbs, '.skipped'))) {
+    try {
+      fs.rmSync(dirAbs, { recursive: true, force: true })
+    } catch {}
+    continue
+  }
+
   const lcovPath = path.join(dirAbs, 'lcov.info')
   let lcovContent
   try {
     lcovContent = fs.readFileSync(lcovPath, 'utf8')
-  } catch {
-    // ignore
-  }
+  } catch {}
 
   // Consider it empty unless we see at least one `SF:` record.
   const isMissingOrEmpty = lcovContent === undefined || !/(^|\n)SF:/.test(lcovContent)
-  if (!isMissingOrEmpty) {
-    continue
-  }
+  if (!isMissingOrEmpty) continue
 
   emptyReportDirs.push(dirAbs)
 
@@ -53,20 +71,13 @@ for (const dirAbs of reportDirsAbs) {
   if (lcovContent !== undefined) {
     try {
       fs.unlinkSync(lcovPath)
-    } catch {
-      // ignore
-    }
+    } catch {}
   }
 
   // If we deleted the last artifact, avoid leaving an empty coverage directory behind.
   try {
-    const entries = fs.readdirSync(dirAbs)
-    if (entries.length === 0) {
-      fs.rmdirSync(dirAbs)
-    }
-  } catch {
-    // ignore
-  }
+    if (fs.readdirSync(dirAbs).length === 0) fs.rmdirSync(dirAbs)
+  } catch {}
 }
 
 if (emptyReportDirs.length > 0) {
diff --git a/scripts/verify-exercised-tests.js b/scripts/verify-exercised-tests.js
index d2949658548..7a6d4a3c416 100644
--- a/scripts/verify-exercised-tests.js
+++ b/scripts/verify-exercised-tests.js
@@ -912,6 +912,22 @@ function main () {
 
   const invokedScripts = new Set(invoked.map(i => i.script))
 
+  /**
+   * A script counts as "invoked" when either itself or its `:coverage` sibling (or base, if the
+   * script is the `:coverage` variant) is referenced by CI. Pair-matching keeps duplicate
+   * coverage/non-coverage definitions from each forcing their own CI step.
+   *
+   * @param {string} scriptName
+   * @returns {boolean}
+   */
+  const isInvokedOrCoverageSibling = (scriptName) => {
+    if (invokedScripts.has(scriptName)) return true
+    if (scriptName.endsWith(':coverage')) {
+      return invokedScripts.has(scriptName.slice(0, -':coverage'.length))
+    }
+    return invokedScripts.has(`${scriptName}:coverage`)
+  }
+
   // CI must not invoke missing scripts.
   for (const i of invoked) {
     if (!scripts[i.script]) {
@@ -923,7 +939,7 @@ function main () {
   // All :ci scripts should be referenced by CI.
   for (const name of Object.keys(scripts).sort((a, b) => a.localeCompare(b, 'en'))) {
     if (!name.endsWith(':ci')) continue
-    if (!invokedScripts.has(name)) {
+    if (!isInvokedOrCoverageSibling(name)) {
       pushError(`package.json: script "${name}" is not invoked by any GitHub Actions workflow`)
     }
   }
@@ -931,11 +947,11 @@ function main () {
   // All test:integration* scripts should be referenced by CI (except test:integration:plugins).
   for (const name of Object.keys(scripts).sort((a, b) => a.localeCompare(b, 'en'))) {
     if (!name.startsWith('test:integration')) continue
-    // Skip test:integration:plugins - it's a convenience script for running only plugin integration
-    // tests locally, but in CI these are already covered by test:plugins:ci (which runs all plugin
-    // tests including integration tests).
-    if (name === 'test:integration:plugins') continue
-    if (!invokedScripts.has(name)) {
+    // Skip test:integration:plugins (and its coverage sibling) - it's a convenience script for
+    // running only plugin integration tests locally, but in CI these are already covered by
+    // test:plugins:ci (which runs all plugin tests including integration tests).
+    if (name === 'test:integration:plugins' || name === 'test:integration:plugins:coverage') continue
+    if (!isInvokedOrCoverageSibling(name)) {
       pushError(`package.json: script "${name}" is not invoked by any GitHub Actions workflow`)
     }
   }