diff --git a/.codecov.yml b/.codecov.yml
new file mode 100644
index 0000000000..c7f53f1a5b
--- /dev/null
+++ b/.codecov.yml
@@ -0,0 +1,32 @@
+# Settings for codecov.io checks.
+#
+# Documentation is at https://docs.codecov.io/docs/codecov-yaml; for
+# reference, see https://docs.codecov.io/docs/codecovyml-reference.
+#
+# To validate this file, use:
+#
+#   curl --data-binary @.codecov.yml https://codecov.io/validate
+
+# Allow coverage percentage a precision of zero decimals, and round to
+# the nearest (for example, 89.957 to to 90; 89.497 to 89%).  Coverage
+# above 90% is good, below 80% is bad.
+coverage:
+  round: nearest
+  range: 80..90
+  precision: 0
+
+  # Allow codecov/project a threshold of 90% (always aim for that much
+  # coverage), and allow codecov/patch a threshold of 1% (allow
+  # coverage to drop that much, but not less).  That should be good
+  # enough for us.  The defaults seem to leave red marks in GitHub CI
+  # checks in a rather arbitrary manner, probably because (1) by
+  # default comparison is with the parent commit; (2) computers are
+  # bad with floating point numbers.
+  status:
+    project:
+      default:
+        target: 90%
+        threshold: 1%
+    patch:
+      default:
+        threshold: 1%
diff --git a/.gitignore b/.gitignore
index 8191c173b1..c57aa2ee83 100644
--- a/.gitignore
+++ b/.gitignore
@@ -51,3 +51,9 @@ zope.interface-*.egg
 # This is the plaintext of the private environment needed for some CircleCI
 # operations.  It's never supposed to be checked in.
 secret-env-plain
+
+# coverage 5.x writes a series of sqlite files.
+/.coverage.*
+
+# ignore results of running integration tests.
+/integration.eliot.json
diff --git a/newsfragments/3384.minor b/newsfragments/3384.minor
new file mode 100644
index 0000000000..8592abb6bb
--- /dev/null
+++ b/newsfragments/3384.minor
@@ -0,0 +1 @@
+Coverage is not pinned at ~= 4.5 anymore.