diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml
index 6e32275ed..8d4d5177b 100644
--- a/.github/workflows/sonarqube.yml
+++ b/.github/workflows/sonarqube.yml
@@ -16,103 +16,9 @@ on:
   workflow_dispatch:
 
 jobs:
-  # The four suites mirror the jobs in test.yml — same setup, same
-  # `test:coverage` scripts — because Sonar needs the lcov each package emits.
-  # Without them every line reports as uncovered and the dashboard shows a
-  # collapse that did not happen. They run in parallel and hand their reports to
-  # the scan job as artifacts.
-  shared-coverage:
-    name: Coverage (shared)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: npm
-          cache-dependency-path: package-lock.json
-      - run: npm ci --workspace shared
-      - run: cd shared && npm run test:coverage
-      - uses: actions/upload-artifact@v6
-        with:
-          name: sonar-shared-coverage
-          path: shared/coverage/
-          retention-days: 1
-
-  plugin-sdk-coverage:
-    name: Coverage (plugin-sdk)
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: plugin-sdk
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: plugin-sdk/package-lock.json
-      - run: npm ci
-      - run: npm run test:coverage
-      - uses: actions/upload-artifact@v6
-        with:
-          name: sonar-plugin-sdk-coverage
-          path: plugin-sdk/coverage/
-          retention-days: 1
-
-  server-coverage:
-    name: Coverage (server)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: npm
-          cache-dependency-path: package-lock.json
-      - run: npm ci
-
-      - name: Ensure @swc/core's Linux binary for unplugin-swc
-        # Same reason as test.yml: the lockfile was generated on Windows and
-        # omits the Linux optional native binary, so the server's SWC transform
-        # cannot load without this.
-        run: |
-          SWC_VERSION=$(node -p "require('@swc/core/package.json').version")
-          npm install --no-save --legacy-peer-deps "@swc/core-linux-x64-gnu@$SWC_VERSION"
-
-      - name: Build shared
-        run: npm run build --workspace=shared
-      - run: cd server && npm run test:coverage
-      - uses: actions/upload-artifact@v6
-        with:
-          name: sonar-server-coverage
-          path: server/coverage/
-          retention-days: 1
-
-  client-coverage:
-    name: Coverage (client)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: npm
-          cache-dependency-path: package-lock.json
-      - run: npm ci --workspace shared && npm ci --workspace client
-      - name: Build shared
-        run: npm run build --workspace=shared
-      - run: cd client && npm run test:coverage
-      - uses: actions/upload-artifact@v6
-        with:
-          name: sonar-client-coverage
-          path: client/coverage/
-          retention-days: 1
-
   scan:
-    name: SonarQube Scan
+    name: Coverage & Scan
     runs-on: ubuntu-latest
-    needs: [shared-coverage, plugin-sdk-coverage, server-coverage, client-coverage]
     steps:
       - uses: actions/checkout@v6
         with:
@@ -120,24 +26,43 @@ jobs:
           # new code. A shallow clone leaves it blind to both.
           fetch-depth: 0
 
-      # Restored to the exact paths sonar-project.properties names in
-      # sonar.javascript.lcov.reportPaths.
-      - uses: actions/download-artifact@v6
+      - uses: actions/setup-node@v6
         with:
-          name: sonar-shared-coverage
-          path: shared/coverage/
-      - uses: actions/download-artifact@v6
-        with:
-          name: sonar-plugin-sdk-coverage
-          path: plugin-sdk/coverage/
-      - uses: actions/download-artifact@v6
-        with:
-          name: sonar-server-coverage
-          path: server/coverage/
-      - uses: actions/download-artifact@v6
-        with:
-          name: sonar-client-coverage
-          path: client/coverage/
+          node-version: 24
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install plugin-sdk dependencies
+        # plugin-sdk is not a root workspace (workspaces = client, server, shared)
+        # — it ships as its own npm package with its own lockfile, so the root
+        # npm ci does not reach it. Its coverage is part of test:cov all the same.
+        run: cd plugin-sdk && npm ci
+
+      - name: Ensure @swc/core's Linux binary for unplugin-swc
+        # Same reason as test.yml: the lockfile was generated on Windows and omits
+        # @swc/core's Linux optional native binary, so npm ci skips it on the
+        # runner and the server's SWC transform cannot load.
+        run: |
+          SWC_VERSION=$(node -p "require('@swc/core/package.json').version")
+          npm install --no-save --legacy-peer-deps "@swc/core-linux-x64-gnu@$SWC_VERSION"
+
+      - name: Build shared
+        # Only shared, not the root `build`. server and client run their suites
+        # from source through vitest, so building them would add a tsc pass and a
+        # full vite bundle that nothing here reads.
+        run: npm run build --workspace=shared
+
+      - name: Run tests with coverage
+        # One script for all four packages — it already ends with
+        # `--prefix plugin-sdk`. Each writes lcov to <pkg>/coverage/, which is
+        # where sonar.javascript.lcov.reportPaths looks. Without those files every
+        # line reports as uncovered and the dashboard shows a collapse that did
+        # not happen, so this step failing has to stop the scan rather than let it
+        # publish a false number.
+        run: npm run test:cov
 
       - name: Scan
         uses: SonarSource/sonarqube-scan-action@v8