diff --git a/.circleci/config.yml b/.circleci/config.yml
index 87236193005f4..22d9de1203af8 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -86,11 +86,24 @@ jobs:
            command:
              ci/do_circle_ci.sh bazel.coverage
            no_output_timeout: 60m
-       - run: ci/coverage_publish.sh
+       - persist_to_workspace:
+           root: /build/envoy/generated
+           paths:
+             - coverage
        - store_artifacts:
            path: /build/envoy/generated
            destination: /
 
+   coverage_publish:
+     docker:
+       - image: google/cloud-sdk
+     steps:
+       - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
+       - checkout
+       - attach_workspace:
+           at: /build/envoy/generated
+       - run: ci/coverage_publish.sh
+
    clang_tidy:
      executor: ubuntu-build
      steps:
@@ -150,6 +163,8 @@ workflows:
       - api
       - filter_example_mirror
       - coverage
+      - coverage_publish:
+          requires: [coverage]
       - format
       - clang_tidy
       - build_image
diff --git a/bazel/README.md b/bazel/README.md
index b1be84925a72b..2631fbec01f3c 100644
--- a/bazel/README.md
+++ b/bazel/README.md
@@ -506,7 +506,7 @@ have seen some issues with seeing the artifacts tab. If you can't see it, log ou
 then log back in and it should start working.
 
 The latest coverage report for master is available
-[here](https://s3.amazonaws.com/lyft-envoy/coverage/report-master/index.html).
+[here](https://storage.googleapis.com/envoy-coverage/report-master/index.html).
 
 It's also possible to specialize the coverage build to a specified test or test dir. This is useful
 when doing things like exploring the coverage of a fuzzer over its corpus. This can be done by
diff --git a/ci/coverage_publish.sh b/ci/coverage_publish.sh
index ad4b05ba30199..c04eafff0323a 100755
--- a/ci/coverage_publish.sh
+++ b/ci/coverage_publish.sh
@@ -8,26 +8,26 @@ if [ "${CIRCLECI}" != "true" ]; then
   exit 0
 fi
 
+[[ -z "${ENVOY_BUILD_DIR}" ]] && ENVOY_BUILD_DIR=/build
+COVERAGE_FILE="${ENVOY_BUILD_DIR}/envoy/generated/coverage/index.html"
+
+if [ ! -f "${COVERAGE_FILE}" ]; then
+  echo "ERROR: Coverage file not found."
+  exit 1
+fi
+
 # available for master builds
 if [ -z "$CIRCLE_PR_NUMBER" ]
 then
   echo "Uploading coverage report..."
 
-  [[ -z "${ENVOY_BUILD_DIR}" ]] && ENVOY_BUILD_DIR=/build
-  COVERAGE_FILE="${ENVOY_BUILD_DIR}/envoy/generated/coverage/index.html"
-
-  if [ ! -f "${COVERAGE_FILE}" ]; then
-    echo "ERROR: Coverage file not found."
-    exit 1
-  fi
-
   BRANCH_NAME="${CIRCLE_BRANCH}"
   COVERAGE_DIR="$(dirname "${COVERAGE_FILE}")"
-  S3_LOCATION="lyft-envoy/coverage/report-${BRANCH_NAME}"
+  GCS_LOCATION="envoy-coverage/report-${BRANCH_NAME}"
 
-  pip install awscli --upgrade
-  aws s3 cp "${COVERAGE_DIR}" "s3://${S3_LOCATION}" --recursive --acl public-read --quiet --sse
-  echo "Coverage report for branch '${BRANCH_NAME}': https://s3.amazonaws.com/${S3_LOCATION}/index.html"
+  echo ${GCP_SERVICE_ACCOUNT_KEY} | base64 --decode | gcloud auth activate-service-account --key-file=-
+  gsutil -m rsync -dr ${COVERAGE_DIR} gs://${GCS_LOCATION}
+  echo "Coverage report for branch '${BRANCH_NAME}': https://storage.googleapis.com/${GCS_LOCATION}/index.html"
 else
   echo "Coverage report will not be uploaded for this build."
 fi