diff --git a/sw/device/lib/testing/json/BUILD b/sw/device/lib/testing/json/BUILD
index 04532d70d5d2d..7639a027cbc19 100644
--- a/sw/device/lib/testing/json/BUILD
+++ b/sw/device/lib/testing/json/BUILD
@@ -85,6 +85,8 @@ cc_library(
     name = "provisioning_data",
     srcs = ["provisioning_data.c"],
     hdrs = ["provisioning_data.h"],
+    # Instrumenting this module consumes about 29K RAM.
+    features = ["-coverage"],
     deps = ["//sw/device/lib/ujson"],
 )
 
diff --git a/sw/device/silicon_creator/manuf/base/BUILD b/sw/device/silicon_creator/manuf/base/BUILD
index 7a6edaf04648b..c26d12783162a 100644
--- a/sw/device/silicon_creator/manuf/base/BUILD
+++ b/sw/device/silicon_creator/manuf/base/BUILD
@@ -51,6 +51,7 @@ opentitan_binary(
     name = "sram_cp_provision",
     testonly = True,
     srcs = ["sram_cp_provision.c"],
+    collect_code_coverage = 0,
     exec_env = {
         "//hw/top_earlgrey:sim_qemu_rom_with_fake_keys": None,
         "//hw/top_earlgrey:fpga_hyper310_rom_with_fake_keys": None,
@@ -91,6 +92,7 @@ opentitan_binary(
     name = "sram_cp_provision_functest",
     testonly = True,
     srcs = ["sram_cp_provision_functest.c"],
+    collect_code_coverage = 0,
     exec_env = {
         "//hw/top_earlgrey:sim_qemu_rom_with_fake_keys": None,
         "//hw/top_earlgrey:fpga_hyper310_rom_with_fake_keys": None,
@@ -188,6 +190,7 @@ opentitan_test(
         name = "sram_ft_individualize_{}{}".format(sku, variant),
         testonly = True,
         srcs = ["sram_ft_individualize.c"],
+        collect_code_coverage = 0,
         exec_env = {
             "//hw/top_earlgrey:fpga_hyper310_rom_with_fake_keys": None,
             "//hw/top_earlgrey:fpga_cw340_rom_with_fake_keys": None,
diff --git a/sw/host/provisioning/ft_lib/src/lib.rs b/sw/host/provisioning/ft_lib/src/lib.rs
index 5da9cfe1c0778..76fb8fd3362bd 100644
--- a/sw/host/provisioning/ft_lib/src/lib.rs
+++ b/sw/host/provisioning/ft_lib/src/lib.rs
@@ -667,6 +667,10 @@ pub fn run_ft_personalize(
     response
         .stats
         .log_elapsed_time("second-bootstrap-done", second_t0);
+
+    #[cfg(feature = "ot_coverage_enabled")]
+    let _ = UartConsole::wait_for_coverage(spi_console, Duration::from_secs(10));
+
     Ok(())
 }
 
diff --git a/sw/host/provisioning/orchestrator/tests/BUILD b/sw/host/provisioning/orchestrator/tests/BUILD
index 3f5c460e64f46..ed2f54226dcb4 100644
--- a/sw/host/provisioning/orchestrator/tests/BUILD
+++ b/sw/host/provisioning/orchestrator/tests/BUILD
@@ -149,10 +149,16 @@ sh_test(
             ":orchestrator_{}_zip".format(fpga),
             "@python3",
             cfg["orchestrator_cfg"],
+            cfg["owner_fw"],
+            cfg["rom_ext"],
+            "//sw/host/provisioning/orchestrator/src:data_dependencies",
+            "//util/coverage/collect_cc_coverage",
         ],
         env = {
             "PYTHON": "$(location @python3//:python3)",
             "SKU_CONFIG_PATH": "$(location {})".format(cfg["orchestrator_cfg"]),
+            "COLLECT_CC_COVERAGE": "$(location //util/coverage/collect_cc_coverage)",
+            "CC_CODE_COVERAGE_SCRIPT": "",  # Disable built-in cc coverage
             "FPGA": "{}".format(fpga),
         },
         tags = [
diff --git a/sw/host/provisioning/orchestrator/tests/e2e.sh b/sw/host/provisioning/orchestrator/tests/e2e.sh
index 13d70e03ed4e7..3a582bf5a5c40 100755
--- a/sw/host/provisioning/orchestrator/tests/e2e.sh
+++ b/sw/host/provisioning/orchestrator/tests/e2e.sh
@@ -14,19 +14,28 @@ cp sw/host/provisioning/orchestrator/src/orchestrator.zip $TEST_TMPDIR
 
 ORCHESTRATOR_PATH=$TEST_TMPDIR/orchestrator.zip
 
-# This script is run by a Bazel sh_test rule, which sets RUNFILES_DIR to point
-# at the test's runfiles. However, if RUNFILES_DIR is set, orchestrator.zip will
-# inherit its value instead of setting it to the proper directory. This breaks
-# runfile resolution, so we unset this variable here.
-unset RUNFILES_DIR
+(
+  # This script is run by a Bazel sh_test rule, which sets RUNFILES_DIR to point
+  # at the test's runfiles. However, if RUNFILES_DIR is set, orchestrator.zip will
+  # inherit its value instead of setting it to the proper directory. This breaks
+  # runfile resolution, so we unset this variable here.
+  unset RUNFILES_DIR
 
-# Run tool. The path to the --sku-config parameter is relative to the
-# runfiles-dir.
-$PYTHON ${ORCHESTRATOR_PATH} \
-  --sku-config=${SKU_CONFIG_PATH} \
-  --test-unlock-token="0x11111111_11111111_11111111_11111111" \
-  --test-exit-token="0x22222222_22222222_22222222_22222222" \
-  --fpga=${FPGA} \
-  --non-interactive \
-  "$@" \
-  --db-path=$TEST_TMPDIR/registry.sqlite
+  # Run tool. The path to the --sku-config parameter is relative to the
+  # runfiles-dir.
+  $PYTHON ${ORCHESTRATOR_PATH} \
+    --sku-config=${SKU_CONFIG_PATH} \
+    --test-unlock-token="0x11111111_11111111_11111111_11111111" \
+    --test-exit-token="0x22222222_22222222_22222222_22222222" \
+    --fpga=${FPGA} \
+    --non-interactive \
+    "$@" \
+    --db-path=$TEST_TMPDIR/registry.sqlite
+)
+
+# Post-process the coverage profile if coverage mode is enabled.
+if [[ "$COVERAGE" == "1" ]]; then
+  export COLLECT_CC_COVERAGE="$PWD/$COLLECT_CC_COVERAGE"
+  cd "$ROOT"
+  "$COLLECT_CC_COVERAGE"
+fi