diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index 1c872c176..658a39985 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -22,21 +22,17 @@ jobs:
           CC: clang
           CXX: clang++
         run: |
-          cmake -S c -B build -DCODE_COVERAGE=ON -DCMAKE_C_FLAGS=--coverage -DCMAKE_CXX_FLAGS=--coverage &&
-          make -C build -j 8 do-all-tests &&
-          make -C build ccov-all-export &&
-          gcovr -j 8 --gcov-executable gcov --sonarqube build/code_coverage.xml &&
-          cat build/compile_commands.json &&
-          cat build/code_coverage.xml
+          ./scripts/ci_c_codecov.sh
       - name: SonarCloud Scan
-        uses: sonarsource/sonarcloud-github-action@master
         env:
+          CC: clang
+          CXX: clang++
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN_AUTO }}
-        with:
-          args: >
-            -Dsonar.organization=swift-nav
-            -Dsonar.projectKey=swift-nav_libsbp_auto
-            -Dsonar.inclusions=c/src/*.c,c/src/**/*.c
-            -Dsonar.coverageReportPaths=build/code_coverage.xml
-            -Dsonar.cfamily.compile-commands=build/compile_commands.json
+          SONAR_ORGANIZATION: swift-nav
+          SONAR_PROJECT_KEY: swift-nav_libsbp_auto
+          SONAR_PROJECT_NAME: libsbp-auto
+          SONAR_HOST_URL: https://sonarcloud.io
+          SONAR_SCANNER_VERSION: 5.0.1.3006
+        run: |
+          bash ./ci-build.sh
diff --git a/scripts/ci_c_codecov.sh b/scripts/ci_c_codecov.sh
index 806e4460c..35d8e0a41 100755
--- a/scripts/ci_c_codecov.sh
+++ b/scripts/ci_c_codecov.sh
@@ -10,13 +10,67 @@ set -o pipefail
 export CC=clang
 export CXX=clang++
 
-cmake -S c -B build -DCODE_COVERAGE=ON -DCMAKE_C_FLAGS=--coverage -DCMAKE_CXX_FLAGS=--coverage
-make -C build -j 8 do-all-tests
-gcovr -j 8 --gcov-executable gcov --sonarqube build/code_coverage.xml
-
 incl=$(find $(pwd)/c -name '*.c' -or -name '*.cc' -or -name '*.h' | grep -v third_party | grep -v test | paste -d, -s -)
 excl=$(find $(pwd)/c -name '*.c' -or -name '*.cc' -or -name '*.h' | grep -v third_party | grep test | paste -d, -s -)
 
 echo "sonar.sourceEncoding=UTF-8" > sonar-project.properties
 echo "sonar.inclusions=${incl}" >> sonar-project.properties
 echo "sonar.exclusions=${excl}" >> sonar-project.properties
+
+mkdir "${HOME}/.sonar"
+
+# download build-wrapper
+curl -sSLo "${HOME}/.sonar/build-wrapper-linux-x86.zip" https://sonarcloud.io/static/cpp/build-wrapper-linux-x86.zip
+unzip -o "${HOME}/.sonar/build-wrapper-linux-x86.zip" -d "${HOME}/.sonar/"
+export PATH=${HOME}/.sonar/build-wrapper-linux-x86:${PATH}
+
+# configure
+cmake --version
+cmake \
+  "-DCODE_COVERAGE=ON" \
+  "-DCMAKE_BUILD_TYPE=Debug" \
+  "-DCMAKE_C_FLAGS=--coverage" \
+  "-DCMAKE_CXX_FLAGS=--coverage" \
+  -S ./c -B ./build
+
+# build with wrapper
+build-wrapper-linux-x86-64 --out-dir ./bw-output cmake --build ./build --target ccov-all-export -j8
+
+if [[ -z "${SONAR_SCANNER_VERSION}" ]]; then
+echo "Error: SONAR_SCANNER_VERSION must be configured" >&2
+exit 1
+fi
+
+export SONAR_SCANNER_HOME="${HOME}/.sonar/sonar-scanner-${SONAR_SCANNER_VERSION}-linux"
+
+# download sonar-scanner
+curl -sSLo "${HOME}/.sonar/sonar-scanner.zip" \
+  "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${SONAR_SCANNER_VERSION}-linux.zip"
+unzip -o "${HOME}/.sonar/sonar-scanner.zip" -d "${HOME}/.sonar/"
+export PATH=${SONAR_SCANNER_HOME}/bin:${PATH}
+export SONAR_SCANNER_OPTS="-server"
+
+# Run sonar scanner
+[[ -n "${SONAR_TOKEN:-}" ]] && SONAR_TOKEN_CMD_ARG="-Dsonar.login=${SONAR_TOKEN}"
+[[ -n "${SONAR_ORGANIZATION:-}" ]] && SONAR_ORGANIZATION_CMD_ARG="-Dsonar.organization=${SONAR_ORGANIZATION}"
+[[ -n "${SONAR_PROJECT_NAME:-}" ]] && SONAR_PROJECT_NAME_CMD_ARG="-Dsonar.projectName=${SONAR_PROJECT_NAME}"
+
+# TODO: setup sonar.projectVersion so that it actually does something useful
+#  see https://swift-nav.atlassian.net/browse/DEVINFRA-504
+SONAR_OTHER_ARGS="\
+-Dsonar.projectVersion=1.0 \
+-Dsonar.sources=. \
+-Dsonar.cfamily.build-wrapper-output=./bw-output \
+-Dsonar.cfamily.threads=1 \
+-Dsonar.cfamily.cache.enabled=false \
+-Dsonar.sourceEncoding=UTF-8"
+
+# shellcheck disable=SC2086
+sonar-scanner \
+  "-Dsonar.cfamily.llvm-cov.reportPath=./build/ccov/coverage.txt" \
+  "-Dsonar.host.url=${SONAR_HOST_URL}" \
+  "-Dsonar.projectKey=${SONAR_PROJECT_KEY}" \
+  ${SONAR_OTHER_ARGS} \
+  "${SONAR_PROJECT_NAME_CMD_ARG}" \
+  "${SONAR_TOKEN_CMD_ARG}" \
+  "${SONAR_ORGANIZATION_CMD_ARG}"