diff --git a/.codecov.yml b/.codecov.yml
index f3fa991a67..4268758e44 100644
--- a/.codecov.yml
+++ b/.codecov.yml
@@ -1,23 +1,32 @@
 codecov:
   require_ci_to_pass: true
+  # The C++ and Rust uploads land minutes apart; without this gate Codecov
+  # publishes a near-zero total from whichever one arrives first.
+  notify:
+    after_n_builds: 2
+    wait_for_ci: true
 
 comment:
   behavior: default
   layout: reach,diff,flags,tree,reach
   show_carryforward_flags: true
+  after_n_builds: 2
 
-# Coverage is uploaded from independent workflows: the C++ build under the `cpp`
-# flag and the Rust build under the `rust` flag. Carrying forward each flag means
-# a commit that only re-runs one language keeps the other language's last-known
-# coverage instead of dropping it, so the combined project total stays stable.
+# C++ and Rust coverage upload from independent workflows under the `cpp` and
+# `rust` flags; carryforward keeps one language's total when only the other reran.
 flag_management:
   default_rules:
     carryforward: true
   individual_flags:
     - name: cpp
       carryforward: true
+      paths:
+        - include/
+        - src/
     - name: rust
       carryforward: true
+      paths:
+        - crates/
 
 coverage:
   range: "70..85"
diff --git a/.github/workflows/reusable-rust.yml b/.github/workflows/reusable-rust.yml
index 3fd07bd66e..33726b2425 100644
--- a/.github/workflows/reusable-rust.yml
+++ b/.github/workflows/reusable-rust.yml
@@ -27,7 +27,7 @@ permissions:
 jobs:
   clippy:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3122de8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -42,7 +42,7 @@ jobs:
 
   coverage:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3122de8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -70,7 +70,7 @@ jobs:
 
   doc:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3122de8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-fecfc0c
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3