diff --git a/.github/scripts/jacoco-to-cobertura.xsl b/.github/scripts/jacoco-to-cobertura.xsl
new file mode 100644
index 00000000..a93764ed
--- /dev/null
+++ b/.github/scripts/jacoco-to-cobertura.xsl
@@ -0,0 +1,167 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:output method="xml" indent="yes" encoding="UTF-8"/>
+
+  <!-- Entry point: delegate to <report> template -->
+  <xsl:template match="/">
+    <xsl:apply-templates select="report"/>
+  </xsl:template>
+
+  <!-- Root coverage element with global counters -->
+  <xsl:template match="report">
+    <xsl:variable name="coveredLines"    select="sum(counter[@type='LINE']/@covered)"/>
+    <xsl:variable name="missedLines"     select="sum(counter[@type='LINE']/@missed)"/>
+    <xsl:variable name="coveredBranches" select="sum(counter[@type='BRANCH']/@covered)"/>
+    <xsl:variable name="missedBranches"  select="sum(counter[@type='BRANCH']/@missed)"/>
+    <xsl:variable name="totalLines"    select="$coveredLines + $missedLines"/>
+    <xsl:variable name="totalBranches" select="$coveredBranches + $missedBranches"/>
+    <coverage>
+      <xsl:attribute name="line-rate">
+        <xsl:choose>
+          <xsl:when test="$totalLines &gt; 0">
+            <xsl:value-of select="$coveredLines div $totalLines"/>
+          </xsl:when>
+          <xsl:otherwise>1</xsl:otherwise>
+        </xsl:choose>
+      </xsl:attribute>
+      <xsl:attribute name="branch-rate">
+        <xsl:choose>
+          <xsl:when test="$totalBranches &gt; 0">
+            <xsl:value-of select="$coveredBranches div $totalBranches"/>
+          </xsl:when>
+          <xsl:otherwise>1</xsl:otherwise>
+        </xsl:choose>
+      </xsl:attribute>
+      <xsl:attribute name="lines-covered"><xsl:value-of select="$coveredLines"/></xsl:attribute>
+      <xsl:attribute name="lines-valid"><xsl:value-of select="$totalLines"/></xsl:attribute>
+      <xsl:attribute name="branches-covered"><xsl:value-of select="$coveredBranches"/></xsl:attribute>
+      <xsl:attribute name="branches-valid"><xsl:value-of select="$totalBranches"/></xsl:attribute>
+      <xsl:attribute name="complexity">0</xsl:attribute>
+      <xsl:attribute name="version">0.1</xsl:attribute>
+      <xsl:attribute name="timestamp">0</xsl:attribute>
+      <sources>
+        <source>.</source>
+      </sources>
+      <packages>
+        <xsl:apply-templates select="package"/>
+      </packages>
+    </coverage>
+  </xsl:template>
+
+  <!-- Package element -->
+  <xsl:template match="package">
+    <xsl:variable name="coveredLines"    select="sum(counter[@type='LINE']/@covered)"/>
+    <xsl:variable name="missedLines"     select="sum(counter[@type='LINE']/@missed)"/>
+    <xsl:variable name="coveredBranches" select="sum(counter[@type='BRANCH']/@covered)"/>
+    <xsl:variable name="missedBranches"  select="sum(counter[@type='BRANCH']/@missed)"/>
+    <xsl:variable name="totalLines"    select="$coveredLines + $missedLines"/>
+    <xsl:variable name="totalBranches" select="$coveredBranches + $missedBranches"/>
+    <package>
+      <xsl:attribute name="name"><xsl:value-of select="translate(@name, '/', '.')"/></xsl:attribute>
+      <xsl:attribute name="line-rate">
+        <xsl:choose>
+          <xsl:when test="$totalLines &gt; 0"><xsl:value-of select="$coveredLines div $totalLines"/></xsl:when>
+          <xsl:otherwise>1</xsl:otherwise>
+        </xsl:choose>
+      </xsl:attribute>
+      <xsl:attribute name="branch-rate">
+        <xsl:choose>
+          <xsl:when test="$totalBranches &gt; 0"><xsl:value-of select="$coveredBranches div $totalBranches"/></xsl:when>
+          <xsl:otherwise>1</xsl:otherwise>
+        </xsl:choose>
+      </xsl:attribute>
+      <xsl:attribute name="complexity">0</xsl:attribute>
+      <classes>
+        <xsl:apply-templates select="class"/>
+      </classes>
+    </package>
+  </xsl:template>
+
+  <!-- Class element — line-rate from the class counters; line details from the
+       corresponding sourcefile element (same package, same filename) -->
+  <xsl:template match="class">
+    <xsl:variable name="sname" select="@sourcefilename"/>
+    <xsl:variable name="sf"    select="../sourcefile[@name=$sname]"/>
+    <xsl:variable name="coveredLines"    select="sum(counter[@type='LINE']/@covered)"/>
+    <xsl:variable name="missedLines"     select="sum(counter[@type='LINE']/@missed)"/>
+    <xsl:variable name="coveredBranches" select="sum(counter[@type='BRANCH']/@covered)"/>
+    <xsl:variable name="missedBranches"  select="sum(counter[@type='BRANCH']/@missed)"/>
+    <xsl:variable name="totalLines"    select="$coveredLines + $missedLines"/>
+    <xsl:variable name="totalBranches" select="$coveredBranches + $missedBranches"/>
+    <class>
+      <xsl:attribute name="name"><xsl:value-of select="translate(@name, '/', '.')"/></xsl:attribute>
+      <xsl:attribute name="filename"><xsl:value-of select="concat(../@name, '/', @sourcefilename)"/></xsl:attribute>
+      <xsl:attribute name="line-rate">
+        <xsl:choose>
+          <xsl:when test="$totalLines &gt; 0"><xsl:value-of select="$coveredLines div $totalLines"/></xsl:when>
+          <xsl:otherwise>1</xsl:otherwise>
+        </xsl:choose>
+      </xsl:attribute>
+      <xsl:attribute name="branch-rate">
+        <xsl:choose>
+          <xsl:when test="$totalBranches &gt; 0"><xsl:value-of select="$coveredBranches div $totalBranches"/></xsl:when>
+          <xsl:otherwise>1</xsl:otherwise>
+        </xsl:choose>
+      </xsl:attribute>
+      <xsl:attribute name="complexity">0</xsl:attribute>
+      <methods>
+        <xsl:apply-templates select="method"/>
+      </methods>
+      <lines>
+        <xsl:apply-templates select="$sf/line"/>
+      </lines>
+    </class>
+  </xsl:template>
+
+  <!-- Method element -->
+  <xsl:template match="method">
+    <xsl:variable name="coveredLines"    select="sum(counter[@type='LINE']/@covered)"/>
+    <xsl:variable name="missedLines"     select="sum(counter[@type='LINE']/@missed)"/>
+    <xsl:variable name="coveredBranches" select="sum(counter[@type='BRANCH']/@covered)"/>
+    <xsl:variable name="missedBranches"  select="sum(counter[@type='BRANCH']/@missed)"/>
+    <xsl:variable name="totalLines"    select="$coveredLines + $missedLines"/>
+    <xsl:variable name="totalBranches" select="$coveredBranches + $missedBranches"/>
+    <method>
+      <xsl:attribute name="name"><xsl:value-of select="@name"/></xsl:attribute>
+      <xsl:attribute name="signature"><xsl:value-of select="@desc"/></xsl:attribute>
+      <xsl:attribute name="line-rate">
+        <xsl:choose>
+          <xsl:when test="$totalLines &gt; 0"><xsl:value-of select="$coveredLines div $totalLines"/></xsl:when>
+          <xsl:otherwise>1</xsl:otherwise>
+        </xsl:choose>
+      </xsl:attribute>
+      <xsl:attribute name="branch-rate">
+        <xsl:choose>
+          <xsl:when test="$totalBranches &gt; 0"><xsl:value-of select="$coveredBranches div $totalBranches"/></xsl:when>
+          <xsl:otherwise>1</xsl:otherwise>
+        </xsl:choose>
+      </xsl:attribute>
+      <xsl:attribute name="complexity">0</xsl:attribute>
+    </method>
+  </xsl:template>
+
+  <!-- Sourcefile line element: maps nr→number, ci→hits, mb/cb→branch info -->
+  <xsl:template match="line">
+    <line>
+      <xsl:attribute name="number"><xsl:value-of select="@nr"/></xsl:attribute>
+      <xsl:attribute name="hits"><xsl:value-of select="@ci"/></xsl:attribute>
+      <xsl:choose>
+        <xsl:when test="(@mb + @cb) &gt; 0">
+          <xsl:attribute name="branch">true</xsl:attribute>
+          <xsl:attribute name="condition-coverage">
+            <xsl:value-of select="round(100 * @cb div (@mb + @cb))"/>
+            <xsl:text>% (</xsl:text>
+            <xsl:value-of select="@cb"/>
+            <xsl:text>/</xsl:text>
+            <xsl:value-of select="@mb + @cb"/>
+            <xsl:text>)</xsl:text>
+          </xsl:attribute>
+        </xsl:when>
+        <xsl:otherwise>
+          <xsl:attribute name="branch">false</xsl:attribute>
+        </xsl:otherwise>
+      </xsl:choose>
+    </line>
+  </xsl:template>
+
+</xsl:stylesheet>
diff --git a/.github/workflows/basic_code_checks.yml b/.github/workflows/basic_code_checks.yml
index a5388fe3..eaf30230 100644
--- a/.github/workflows/basic_code_checks.yml
+++ b/.github/workflows/basic_code_checks.yml
@@ -57,6 +57,7 @@ jobs:
     needs: license_compliance
     permissions:
       contents: write
+      code-quality: write
 
     steps:
       - name: Checkout repository
@@ -76,8 +77,24 @@ jobs:
           distribution: temurin
           java-version: 25
 
-      - name: Build Maven project
-        run: mvn clean verify
+      - name: Build Maven project and Sonar analysis
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mvn clean verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
+            -Dsonar.organization=decathlon \
+            -Dsonar.projectKey=Decathlon_internal-developer-platform \
+            -Dsonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml \
+            -Dsonar.host.url=https://sonarcloud.io \
+            -B
+
+      - name: Upload code coverage to GitHub
+        uses: actions/upload-code-coverage@abb5995db9e0199b0e2bb9dbd136fce4cb1ec4d3  # v1
+        with:
+          file: target/cobertura.xml
+          language: Java
+          label: code-coverage/jacoco
 
       - name: Upload built jar
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
diff --git a/.github/workflows/build_and_push.yml b/.github/workflows/build_and_push.yml
index 387ae029..bedfc8bc 100644
--- a/.github/workflows/build_and_push.yml
+++ b/.github/workflows/build_and_push.yml
@@ -9,15 +9,14 @@ on: # yamllint disable-line rule:truthy
         description: 'Tag name for the release (e.g., v1.0.0)'
         required: true
 
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
     name: Build and Push Docker Image
     timeout-minutes: 20
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  #  v6.0.2
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 779c7bb9..4ece252c 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -42,4 +42,4 @@ jobs:
       - name: Install dependencies
         working-directory: docs
         run: |
-          uv sync
+          uv sync --no-build --frozen
diff --git a/.github/workflows/deploy_docs.yml b/.github/workflows/deploy_docs.yml
index 2d33a98b..95bc5757 100644
--- a/.github/workflows/deploy_docs.yml
+++ b/.github/workflows/deploy_docs.yml
@@ -18,11 +18,6 @@ on:  # yamllint disable-line rule:truthy
     types: [created]
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
 concurrency:
   group: "pages-${{ github.ref }}"
   cancel-in-progress: false
@@ -31,6 +26,10 @@ jobs:
   build:
     name: Build Documentation
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
@@ -48,12 +47,12 @@ jobs:
       - name: Install dependencies
         working-directory: docs
         run: |
-          uv sync
+          uv sync --no-build --frozen
 
       - name: Build documentation
         working-directory: docs
         run: |
-          uv run zensical build
+          uv run --no-build --frozen zensical build
 
       - name: Check navigation links
         run: |
@@ -77,6 +76,10 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     needs: build
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
diff --git a/.github/workflows/lint_pull_request_title.yml b/.github/workflows/lint_pull_request_title.yml
index 25e5a1b0..993b1c34 100644
--- a/.github/workflows/lint_pull_request_title.yml
+++ b/.github/workflows/lint_pull_request_title.yml
@@ -10,14 +10,13 @@ on:  # yamllint disable-line rule:truthy
       - edited
       - synchronize
 
-permissions:
-  pull-requests: write
-  statuses: write
-
 jobs:
   lint-title:
     name: Lint PR title
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      statuses: write
     steps:
 
       - name: Check PR title convention
diff --git a/pom.xml b/pom.xml
index a5e4c3e7..e19c2749 100644
--- a/pom.xml
+++ b/pom.xml
@@ -24,6 +24,7 @@
     <testcontainers.version>1.21.4</testcontainers.version>
     <maven-compiler.version>3.15.0</maven-compiler.version>
     <jacoco-maven.version>0.8.14</jacoco-maven.version>
+    <xml-maven-plugin.version>1.1.0</xml-maven-plugin.version>
     <mapstruct.version>1.5.5.Final</mapstruct.version>
   </properties>
 
@@ -253,7 +254,7 @@
       <plugin>
         <groupId>org.sonarsource.scanner.maven</groupId>
         <artifactId>sonar-maven-plugin</artifactId>
-        <version>3.9.1.2184</version>
+        <version>5.7.0.6970</version>
       </plugin>
 
       <plugin>
@@ -314,6 +315,63 @@
         </executions>
       </plugin>
 
+      <plugin>
+        <groupId>com.google.code.maven-replacer-plugin</groupId>
+        <artifactId>maven-replacer-plugin</artifactId>
+        <version>1.4.1</version>
+        <executions>
+          <execution>
+            <id>remove-dtd-from-jacoco</id>
+            <goals>
+              <goal>replace</goal>
+            </goals>
+            <phase>verify</phase>
+            <configuration>
+              <file>target/site/jacoco/jacoco.xml</file>
+              <regex>true</regex>
+              <replacements>
+                <replacement>
+                  <token>&lt;!DOCTYPE[^&gt;]*&gt;</token>
+                  <value/>
+                </replacement>
+              </replacements>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+
+      <plugin>
+        <groupId>org.codehaus.mojo</groupId>
+        <artifactId>xml-maven-plugin</artifactId>
+        <version>${xml-maven-plugin.version}</version>
+        <configuration>
+          <transformationSets>
+            <transformationSet>
+              <dir>${project.build.directory}/site/jacoco</dir>
+              <includes>
+                <include>jacoco.xml</include>
+              </includes>
+              <stylesheet>${project.basedir}/.github/scripts/jacoco-to-cobertura.xsl</stylesheet>
+              <outputDir>${project.build.directory}</outputDir>
+              <fileMappers>
+                <fileMapper implementation="org.codehaus.plexus.components.io.filemappers.MergeFileMapper">
+                  <targetName>cobertura.xml</targetName>
+                </fileMapper>
+              </fileMappers>
+            </transformationSet>
+          </transformationSets>
+        </configuration>
+        <executions>
+          <execution>
+            <id>jacoco-to-cobertura</id>
+            <goals>
+              <goal>transform</goal>
+            </goals>
+            <phase>verify</phase>
+          </execution>
+        </executions>
+      </plugin>
+
       <plugin>
         <groupId>com.github.spotbugs</groupId>
         <artifactId>spotbugs-maven-plugin</artifactId>