diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml
index 5d7b89a..acd024b 100644
--- a/.github/workflows/node.js.yml
+++ b/.github/workflows/node.js.yml
@@ -1,32 +1,44 @@
-# This workflow will do a clean installation of node dependencies, cache/restore them, build the source code and run tests across different versions of node
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-nodejs
-
 name: Node.js CI
 
 on:
     push:
-        branches: ['main']
+        branches: [master, main]
     pull_request:
-        branches: ['main']
+        branches: [master, main]
 
 jobs:
     build:
         runs-on: ubuntu-latest
-
         strategy:
             matrix:
                 node-version: [20.x, 22.x]
-                # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
-
         steps:
             - uses: actions/checkout@v7
             - name: Use Node.js ${{ matrix.node-version }}
               uses: actions/setup-node@v7
               with:
                   node-version: ${{ matrix.node-version }}
-                  cache: 'npm'
+                  cache: npm
             - run: npm ci
-            - run: npm run build --if-present
             - run: npm run lint
             - run: npm run format:check
             - run: npm test
+            - run: npm run coverage:check
+            # Uploaded from one matrix leg only — the report is identical across them, and
+            # two legs writing the same artifact name is an error. Makes a coverage
+            # regression inspectable from the failing run instead of only reproducible locally.
+            - name: Upload coverage report
+              if: matrix.node-version == '22.x'
+              uses: actions/upload-artifact@v7
+              with:
+                  name: coverage-report
+                  # Only the readable report, not all of `coverage/`. c8 also writes its
+                  # raw V8 dump to coverage/tmp, which is ~97% of the bytes and inspectable
+                  # by nothing — measured at 23 MB of tmp against a 647 kB report. Uploading
+                  # the directory ships that dead weight on every run for the whole
+                  # retention window, and the step exists to make a failure *readable*.
+                  # Requires c8 to emit a report: `"reporter": ["text", "lcov"]`.
+                  path: |
+                      coverage/lcov-report
+                      coverage/lcov.info
+                  retention-days: 14
diff --git a/.github/workflows/standards-check.yml b/.github/workflows/standards-check.yml
index 7dcb64b..dfb0840 100644
--- a/.github/workflows/standards-check.yml
+++ b/.github/workflows/standards-check.yml
@@ -1,11 +1,14 @@
-# Enforces the shared standard. Tool-neutral, no AI. Fails CI if this repo drifts.
+# Synced into target repos by `nrstd sync` as .github/workflows/standards-check.yml.
+# Fails CI if the repo drifts from the shared standard. Tool-neutral (no AI).
+# `nrstd audit` exits non-zero on any gap, so a repo adopting this should run
+# `nrstd sync --write` first — otherwise its next push goes red on pre-existing drift.
 name: Standards check
-
 on:
     push:
         branches: [master, main]
     pull_request:
-
+permissions:
+    contents: read
 jobs:
     standards:
         runs-on: ubuntu-latest
@@ -14,9 +17,10 @@ jobs:
             - uses: actions/setup-node@v7
               with:
                   node-version: 20.x
-                  cache: 'npm'
-            # node-red-standards is declared as a devDependency (public repo,
-            # HTTPS tarball URL), so `npm ci` installs it and `npx nrstd`
-            # runs the local binary without an additional network fetch.
-            - run: npm ci
-            - run: npx nrstd audit
+            # Resolved from Git, not the npm registry: this package is deliberately
+            # unpublished (README "Install", option B), so a bare
+            # `npx --yes node-red-standards` fails every run with E404 before it can
+            # audit anything — which reads as drift when it is really a missing
+            # package. The repo is public, so no token is needed. If it is ever
+            # published, the short form becomes available and this can go back.
+            - run: npx --yes github:windkh/node-red-standards audit
diff --git a/package-lock.json b/package-lock.json
index 43a0477..0e73c34 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -21,7 +21,7 @@
                 "globals": "^17.6.0",
                 "node-red": "^5.0.1",
                 "node-red-node-test-helper": "^0.3.6",
-                "node-red-standards": "https://codeload.github.com/windkh/node-red-standards/tar.gz/1726fe5133771b88b9c4fd17e64413cca595992e",
+                "node-red-standards": "github:windkh/node-red-standards",
                 "prettier": "^3.8.3"
             },
             "engines": {
@@ -4004,9 +4004,8 @@
             }
         },
         "node_modules/node-red-standards": {
-            "version": "0.3.0",
-            "resolved": "https://codeload.github.com/windkh/node-red-standards/tar.gz/1726fe5133771b88b9c4fd17e64413cca595992e",
-            "integrity": "sha512-5rbvWdgI/OSN6ZQBl3U1iTLJ8CWyCHhGll6vZxB/qA1Ye1ROdUP0NSSzyHh1vgzVI3drpklgEI0H9DvHYRIFXg==",
+            "version": "0.5.1",
+            "resolved": "git+ssh://git@github.com/windkh/node-red-standards.git#f3982d0a9447df04a6074bf654aca39e174a5fc3",
             "dev": true,
             "license": "MIT",
             "bin": {
diff --git a/package.json b/package.json
index ad8090c..b8c2fe6 100644
--- a/package.json
+++ b/package.json
@@ -54,7 +54,24 @@
         "globals": "^17.6.0",
         "node-red": "^5.0.1",
         "node-red-node-test-helper": "^0.3.6",
-        "node-red-standards": "https://codeload.github.com/windkh/node-red-standards/tar.gz/1726fe5133771b88b9c4fd17e64413cca595992e",
+        "node-red-standards": "github:windkh/node-red-standards",
         "prettier": "^3.8.3"
+    },
+    "c8": {
+        "reporter": [
+            "text",
+            "lcov"
+        ],
+        "exclude": [
+            "test/**",
+            "test-helpers/**",
+            "examples/**",
+            "doc/**",
+            "eslint.config.js"
+        ],
+        "lines": 56,
+        "statements": 56,
+        "branches": 71,
+        "functions": 64
     }
 }