diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index 24fcd3d..31ecc37 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -45,4 +45,4 @@ jobs:
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.xml
-          fail_ci_if_error: false
+          fail_ci_if_error: true
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 0000000..2550eb8
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,28 @@
+# Codecov policy for SmartWealthAI PRs.
+# Complements local coverage settings in pyproject.toml [tool.coverage.*].
+# CI uploads coverage.xml from .github/workflows/pr-ci.yml.
+
+coverage:
+  status:
+    project:
+      default:
+        # Do not let total repo coverage regress vs the base branch.
+        target: auto
+        threshold: 1%
+    patch:
+      default:
+        # New/changed lines in each PR must be adequately tested.
+        target: 85%
+        threshold: 2%
+
+comment:
+  layout: "reach,diff,flags,files"
+  behavior: default
+  require_changes: true
+
+ignore:
+  - "tests/**"
+  # Frozen SEC ETL spike (phase 2) — same omit list as pyproject.toml.
+  - "src/smartwealthai/sec_client.py"
+  - "src/smartwealthai/edgartools_client.py"
+  - "src/smartwealthai/download_fundamentals.py"