diff --git a/Makefile b/Makefile
index f6ab4e89..9822afeb 100644
--- a/Makefile
+++ b/Makefile
@@ -27,7 +27,7 @@ test: check_binaries
 	AIKIDO_LOG_LEVEL="error" AIKIDO_TOKEN="token" ./gradlew test
 
 cov: check_binaries
-	AIKIDO_LOG_LEVEL="error" AIKIDO_TOKEN="token" ./gradlew test --rerun-tasks -PcoverageRun jacocoTestReport
+	AIKIDO_LOG_LEVEL="error" AIKIDO_TOKEN="token" ./gradlew test --rerun-tasks -PcoverageRun jacocoTestReport jacocoTestCoverageVerification
 
 
 # Binaries :
diff --git a/agent_api/build.gradle b/agent_api/build.gradle
index b0f758f1..62a87ebd 100644
--- a/agent_api/build.gradle
+++ b/agent_api/build.gradle
@@ -5,7 +5,7 @@ plugins {
 }
 
 jacoco {
-    toolVersion "0.8.12"
+    toolVersion "0.8.15"
     reportsDirectory = layout.buildDirectory.dir('jacoco')
 }
 
@@ -46,7 +46,6 @@ dependencies {
 test {
     jvmArgs '--add-opens', 'java.base/java.util=ALL-UNNAMED'
     jvmArgs '--add-opens', 'java.base/java.lang=ALL-UNNAMED'
-    jvmArgs "-javaagent:${project.rootDir}/dist/agent.jar=mode=daemon-disabled"
     jvmArgs '-Dnet.bytebuddy.experimental=true' // Mockito support.
 
     systemProperty 'AIK_agent_dir', "${project.rootDir}/dist"
@@ -64,6 +63,12 @@ test {
     jacoco {
         enabled = true
     }
+    doFirst {
+        // JaCoCo starts tracking a class when Java loads it.
+        // Our agent loads agent_api classes, so JaCoCo must start first.
+        jvmArgs jacoco.getAsJvmArg(), "-javaagent:${project.rootDir}/dist/agent.jar=mode=daemon-disabled"
+        jacoco.enabled = false
+    }
 }
 
 jacocoTestReport {
@@ -75,8 +80,20 @@ jacocoTestReport {
     dependsOn test
 }
 
+jacocoTestCoverageVerification {
+    violationRules {
+        rule {
+            limit {
+                counter = 'LINE'
+                minimum = 0.80
+            }
+        }
+    }
+    dependsOn test
+}
+
 shadowJar {
     mergeServiceFiles()
     manifest {
     }
-}
\ No newline at end of file
+}