diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 323d6c27..fdd30213 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,13 @@
 #
 
 name: CI
-on: [pull_request, push]
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
 
 jobs:
   build:
@@ -64,12 +70,8 @@ jobs:
       run: |
         make test-setup
         keyctl link @u @s
-        make coverage.out
+        make test
         make test-teardown
-    - name: Report coverage
-      uses: shogo82148/actions-goveralls@v1
-      with:
-        path-to-profile: coverage.out
 
   # This isn't working currently because qemu user-mode emulation doesn't
   # support passing through the keyctl() system call and the fscrypt ioctls.
diff --git a/README.md b/README.md
index 3cf20bb3..5650d764 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,6 @@
 # fscrypt [![GitHub version](https://badge.fury.io/go/github.com%2Fgoogle%2Ffscrypt.svg)](https://github.com/google/fscrypt/releases)
 
 [![Build Status](https://github.com/google/fscrypt/workflows/CI/badge.svg)](https://github.com/google/fscrypt/actions?query=workflow%3ACI+branch%3Amaster)
-[![Coverage Status](https://coveralls.io/repos/github/google/fscrypt/badge.svg?branch=master)](https://coveralls.io/github/google/fscrypt?branch=master)
 [![GoDoc](https://godoc.org/github.com/google/fscrypt?status.svg)](https://godoc.org/github.com/google/fscrypt)
 [![Go Report Card](https://goreportcard.com/badge/github.com/google/fscrypt)](https://goreportcard.com/report/github.com/google/fscrypt)
 [![License](https://img.shields.io/badge/LICENSE-Apache2.0-ff69b4.svg)](http://www.apache.org/licenses/LICENSE-2.0.html)