diff --git a/README.md b/README.md
index 588626d1..5387d342 100644
--- a/README.md
+++ b/README.md
@@ -103,5 +103,5 @@ Some `underlay-db` tests spin up Postgres via `testcontainers`.
 
 ### Coverage
 
-- Install tarpaulin: `cargo install cargo-tarpaulin`
+- Install tarpaulin: `oxide install cargo-tarpaulin`
 - Run coverage check: `rust/scripts/check-coverage.sh`
diff --git a/docs/knowledge/contracts/022-testing-posture-and-shared-harnesses.md b/docs/knowledge/contracts/022-testing-posture-and-shared-harnesses.md
index 4477af2a..ebb29b1c 100644
--- a/docs/knowledge/contracts/022-testing-posture-and-shared-harnesses.md
+++ b/docs/knowledge/contracts/022-testing-posture-and-shared-harnesses.md
@@ -98,6 +98,14 @@ Rules:
 - `validate` should represent the normal local merge gate
 - `qa` may layer docs, lint, audits, or other broader checks
 
+### Coverage tooling
+
+Install Tarpaulin with `oxide install cargo-tarpaulin`. The coverage script
+still checks for `cargo-tarpaulin` and runs
+`cargo tarpaulin --workspace --out Xml`; Tarpaulin's instrumentation, profile,
+and platform behavior is not qualified through Oxide, so its execution remains
+a Cargo exception.
+
 ### Underlay repository TypeScript formatting
 
 Underlay's `fmt:ts` and `fmt:ts:check` selectors invoke the root development
diff --git a/rust/scripts/check-coverage.sh b/rust/scripts/check-coverage.sh
index c830500d..9f5ccc92 100755
--- a/rust/scripts/check-coverage.sh
+++ b/rust/scripts/check-coverage.sh
@@ -13,7 +13,7 @@ cd "$ROOT_DIR"
 
 if ! command -v cargo-tarpaulin >/dev/null 2>&1; then
   echo "cargo-tarpaulin not found. Install with:" >&2
-  echo "  cargo install cargo-tarpaulin" >&2
+  echo "  oxide install cargo-tarpaulin" >&2
   exit 1
 fi