diff --git a/DynamoDbEncryption/runtimes/java/build.gradle.kts b/DynamoDbEncryption/runtimes/java/build.gradle.kts
index 2135acf23a..016a38fe5b 100644
--- a/DynamoDbEncryption/runtimes/java/build.gradle.kts
+++ b/DynamoDbEncryption/runtimes/java/build.gradle.kts
@@ -12,6 +12,7 @@ plugins {
     `maven-publish`
     `signing`
     id("io.github.gradle-nexus.publish-plugin") version "2.0.0"
+    `jacoco`
 }
 
 var props = Properties().apply {
@@ -229,6 +230,7 @@ tasks.test {
             }
         }
     })
+    finalizedBy(tasks.jacocoTestCoverageVerification)
 }
 
 tasks.register<JavaExec>("runTests") {
@@ -252,6 +254,24 @@ tasks.javadoc {
     exclude("src/main/dafny-generated")
 }
 
+tasks.jacocoTestCoverageVerification {
+    classDirectories.setFrom(
+        fileTree("build/classes/java/main") {
+            include("**/sdkv2/**")
+        }
+    )
+    sourceDirectories.setFrom(
+        files("src/main/sdkv2")
+    )
+    violationRules {
+        rule {
+            limit {
+                minimum = "0.90".toBigDecimal()
+            }
+        }
+    }
+}
+
 nexusPublishing {
     // We are using the nexusPublishing plugin since it is recommended by Sonatype Gradle Project configurations
     // and it is easy to supply the creds we need to deploy