diff --git a/.gitignore b/.gitignore
index 9749474..8eb946c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,4 @@ cli
 .DS_Store
 local_example/
 .envrc
+coverage.out
diff --git a/scripts/tests.sh b/scripts/tests.sh
index e60191c..4e2bd87 100755
--- a/scripts/tests.sh
+++ b/scripts/tests.sh
@@ -1,3 +1,7 @@
 #!/bin/sh
 
-go test -cover ./...
+# -coverprofile writes a machine-readable profile (coverage.out) for SonarQube
+# (sonar.go.coverage.reportPaths); -covermode=atomic keeps counts correct under
+# concurrent tests. Profile entries are module-import paths, resolved by the
+# scanner from the module root (sonar.sources=.).
+go test -covermode=atomic -coverprofile=coverage.out ./...
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..2c76315
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,14 @@
+# SonarQube configuration for the Transifex CLI (Go).
+# Scan is run from the module root so the import paths in coverage.out resolve.
+#
+# NOTE: the CI step that runs the scanner is NOT wired up yet. The internal
+# Sonar host (sonar.svc.transifex.net) is unreachable from GitHub-hosted
+# runners, so the host + runner choice (self-hosted runner vs SonarCloud) is a
+# follow-up. sonar.host.url and the auth token are supplied by that CI step,
+# not here.
+sonar.projectKey=cli
+sonar.sources=.
+sonar.tests=.
+sonar.test.inclusions=**/*_test.go
+sonar.exclusions=**/*_test.go,**/vendor/**,examples/**,build/**
+sonar.go.coverage.reportPaths=coverage.out