diff --git a/.github/workflows/java-ci.yaml b/.github/workflows/java-ci.yaml
new file mode 100644
index 0000000..dc5881a
--- /dev/null
+++ b/.github/workflows/java-ci.yaml
@@ -0,0 +1,35 @@
+name: Java CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+    env:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        with:
+          distribution: temurin
+          java-version: '25.0.4+7.0.LTS'
+          cache: maven
+
+      - run: mvn --no-transfer-progress clean verify ${{ env.SONAR_TOKEN != '' && 'sonar:sonar' || '' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
deleted file mode 100644
index 4e6cf2b..0000000
--- a/.github/workflows/pr-build.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Build pull request
-
-on:
-  pull_request:
-    branches:
-      - master
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up Java
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
-        with:
-          distribution: 'temurin'
-          java-version: '25.0.4+7.0.LTS'
-
-      - name: Build pull request
-        run: mvn clean package
diff --git a/AGENTS.md b/AGENTS.md
index dd6b18d..7b5d469 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -11,7 +11,7 @@ mvn -pl library package    # build only the library module
 mvn -pl examples package   # build only the examples module
 ```
 
-The library's JUnit 5 tests use JSON fixtures and Mockito mocks of `KrakenRestRequester`, without network access or API keys. Run them with `mvn -pl library test`. CI runs `mvn clean package` on PRs targeting `master`.
+The library's JUnit 5 tests use JSON fixtures and Mockito mocks of `KrakenRestRequester`, without network access or API keys. Run them with `mvn -pl library test`. CI runs `mvn clean verify` on pushes and PRs targeting `master`, followed by a SonarCloud analysis with JaCoCo coverage of the `library` module.
 
 Java 25 with Temurin is required (configured via `maven-compiler-plugin` with `<release>25</release>`).
 
diff --git a/examples/pom.xml b/examples/pom.xml
index de83be9..1ea528c 100644
--- a/examples/pom.xml
+++ b/examples/pom.xml
@@ -13,6 +13,7 @@
 
     <properties>
         <log4j.version>2.25.3</log4j.version>
+        <sonar.skip>true</sonar.skip>
     </properties>
 
     <dependencies>
diff --git a/pom.xml b/pom.xml
index d6eb280..3b5a3cb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -70,6 +70,13 @@
         <!-- Third-party plugins -->
         <central-publishing-maven-plugin.version>0.11.0</central-publishing-maven-plugin.version>
         <exec-maven-plugin.version>3.6.3</exec-maven-plugin.version>
+        <jacoco-maven-plugin.version>0.8.15</jacoco-maven-plugin.version>
+        <sonar-maven-plugin.version>5.7.0.6970</sonar-maven-plugin.version>
+
+        <sonar.organization>nyg</sonar.organization>
+        <sonar.projectKey>nyg_kraken-api-java</sonar.projectKey>
+        <sonar.host.url>https://sonarcloud.io</sonar.host.url>
+        <sonar.coverage.jacoco.xmlReportPaths>${project.build.directory}/site/jacoco/jacoco.xml</sonar.coverage.jacoco.xmlReportPaths>
     </properties>
 
     <dependencyManagement>
@@ -176,6 +183,30 @@
                     <executable>./scripts/generate-changelog.sh</executable>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.jacoco</groupId>
+                <artifactId>jacoco-maven-plugin</artifactId>
+                <version>${jacoco-maven-plugin.version}</version>
+                <executions>
+                    <execution>
+                        <id>prepare-agent</id>
+                        <goals>
+                            <goal>prepare-agent</goal>
+                        </goals>
+                    </execution>
+                    <execution>
+                        <id>report</id>
+                        <goals>
+                            <goal>report</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.sonarsource.scanner.maven</groupId>
+                <artifactId>sonar-maven-plugin</artifactId>
+                <version>${sonar-maven-plugin.version}</version>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-release-plugin</artifactId>