diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index fd48c6bae..9fa6d0a9e 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -48,10 +48,53 @@ jobs:
       - name: test
         if: runner.os != 'Linux'
         run: make test
+
+  cover:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-go@v2
+        with:
+          go-version: 1.16.x
+
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: set env vars
+        run: echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
+
+      - name: cache go binaries
+        uses: actions/cache@v2
+        id: cache-go-bin
+        with:
+          path: ~/go/bin
+          key: ${{ runner.os }}-${{ hashFiles('**/go.mod') }}
+          restore-keys: ${{ runner.os }}-go-bin
+
+      - uses: actions/cache@v2
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+            ~/Library/Caches/go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: ${{ runner.os }}-go-
+
       - name: cover
-        if: runner.os == 'Linux'
         run: make cover
 
+      - uses: jandelgado/gcov2lcov-action@v1.0.8
+        name: convert coverage to lcov
+        with:
+          infile: coverage.txt
+          outfile: coverage.lcov
+
+      - name: upload to coveralls
+        uses: coverallsapp/github-action@v1.1.2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          path-to-lcov: coverage.lcov
+
   integration:
     strategy:
       matrix:
diff --git a/Makefile b/Makefile
index 737ab2048..fbbe4b7c6 100644
--- a/Makefile
+++ b/Makefile
@@ -45,19 +45,24 @@ generate-mocks: ## Generate mocks
 	@echo "==> $@"
 	@go run github.com/golang/mock/mockgen -destination internal/directory/auth0/mock_auth0/mock.go github.com/pomerium/pomerium/internal/directory/auth0 RoleManager
 
-.PHONY: deps-lint
-deps-lint: ## Install lint dependencies
+
+.PHONY: get-envoy
+get-envoy: ## Fetch envoy binaries
+	@echo "==> $@"
+	@./scripts/get-envoy.bash
+
+.PHONY: deps-lint
+deps-lint: get-envoy ## Install lint dependencies
 	@echo "==> $@"
-	./scripts/get-envoy.bash
 	@$(GO) install github.com/client9/misspell/cmd/misspell@${MISSPELL_VERSION}
 	@$(GO) install github.com/golangci/golangci-lint/cmd/golangci-lint@${GOLANGCI_VERSION}
 
 .PHONY: deps-build
-deps-build: ## Install build dependencies
+deps-build: get-envoy ## Install build dependencies
 	@echo "==> $@"
 
 .PHONY: deps-release
-deps-release: ## Install release dependencies
+deps-release: get-envoy ## Install release dependencies
 	@echo "==> $@"
 	@cd /tmp; GO111MODULE=on $(GO) get github.com/goreleaser/goreleaser@${GORELEASER_VERSION}
 
@@ -81,15 +86,13 @@ frontend: ## Runs go generate on the static assets package.
 	@CGO_ENABLED=0 GO111MODULE=on $(GO) generate github.com/pomerium/pomerium/internal/frontend
 
 .PHONY: build
-build: ## Builds dynamic executables and/or packages.
+build: build-deps ## Builds dynamic executables and/or packages.
 	@echo "==> $@"
-	./scripts/get-envoy.bash
 	@CGO_ENABLED=0 GO111MODULE=on $(GO) build -tags "$(BUILDTAGS)" ${GO_LDFLAGS} -o $(BINDIR)/$(NAME) ./cmd/"$(NAME)"
 
 .PHONY: build-debug
-build-debug: ## Builds binaries appropriate for debugging
+build-debug: build-deps ## Builds binaries appropriate for debugging
 	@echo "==> $@"
-	./scripts/get-envoy.bash
 	@CGO_ENABLED=0 GO111MODULE=on $(GO) build -gcflags="all=-N -l" -o $(BINDIR)/$(NAME) ./cmd/"$(NAME)"
 
 
@@ -99,7 +102,7 @@ lint: deps-lint ## Verifies `golint` passes.
 	@golangci-lint run ./...
 
 .PHONY: test
-test: ## Runs the go tests.
+test: get-envoy ## Runs the go tests.
 	@echo "==> $@"
 	@$(GO) test -tags "$(BUILDTAGS)" $(shell $(GO) list ./... | grep -v vendor | grep -v github.com/pomerium/pomerium/integration)
 
@@ -110,7 +113,7 @@ spellcheck: # Spellcheck docs
 
 
 .PHONY: cover
-cover: ## Runs go test with coverage
+cover: get-envoy ## Runs go test with coverage
 	@echo "==> $@"
 	$(GO) test -race -coverprofile=coverage.txt -tags "$(BUILDTAGS)" $(shell $(GO) list ./... | grep -v vendor | grep -v github.com/pomerium/pomerium/integration)
 	@sed -i.bak '/\.pb\.go\:/d' coverage.txt
@@ -124,7 +127,7 @@ clean: ## Cleanup any build binaries or packages.
 	$(RM) -r $(BUILDDIR)
 
 .PHONY: snapshot
-snapshot: ## Builds the cross-compiled binaries, naming them in such a way for release (eg. binary-GOOS-GOARCH)
+snapshot: build-deps ## Builds the cross-compiled binaries, naming them in such a way for release (eg. binary-GOOS-GOARCH)
 	@echo "==> $@"
 	@goreleaser release --rm-dist -f .github/goreleaser.yaml --snapshot