diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index e78fe1ea3..50616c871 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -16,6 +16,11 @@ concurrency:
 
 jobs:
   sonarcloud:
-    # Tracked at @main so org-wide CI improvements propagate without PR churn.
-    uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
+    # Pin the coverage setup that checks out this repo's pinned craft-i18n data.
+    uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@ea24c9c24e1997238334182160f60e602e5bce32
+    with:
+      # The shared coverage archive's shards omit the CLI executable used by integration tests.
+      # Run this repository's suite in one instrumented job and provide its pinned test data.
+      shards: 1
+      fonts-ref: 37827adc41fd165f9a9234ac40f94dbad353aa69
     secrets: inherit
diff --git a/sonar-project.properties b/sonar-project.properties
index 5f58f42ae..7bd9e8ce6 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -1,6 +1,9 @@
 sonar.projectKey=storytold_figcraft
 sonar.organization=storytold
 
+# Pinned integration-test fonts are data, not source code for analysis.
+sonar.exclusions=craft-fonts/**
+
 # S4790 (weak hash): a .fig file names each image by the SHA-1 of its bytes (20 bytes, the only
 # length readers accept). It is an identifier the format fixes, not a security choice.
 sonar.issue.ignore.multicriteria=fig_image_sha1