diff --git a/.github/workflows/_run.yml b/.github/workflows/_run.yml
index e4852b6294c9d..c1349aaaae5b0 100644
--- a/.github/workflows/_run.yml
+++ b/.github/workflows/_run.yml
@@ -433,6 +433,8 @@ jobs:
         summary-post: ${{ inputs.summary-post }}
         upload-name: ${{ inputs.upload-name }}
         upload-path: ${{ inputs.upload-path }}
+        upload-junit-name: junit-xml-${{ inputs.target-name || inputs.target }}-${{ inputs.arch || 'x64' }}
+        upload-junit-path: container/envoy/*/generated/test-results/**/*.xml
         warning-match: ${{ inputs.warning-match }}
         working-directory: ${{ inputs.working-directory }}
       env:
diff --git a/.github/workflows/datadog-publish.yml b/.github/workflows/datadog-publish.yml
new file mode 100644
index 0000000000000..cd8d0788db333
--- /dev/null
+++ b/.github/workflows/datadog-publish.yml
@@ -0,0 +1,44 @@
+name: Datadog CI Visibility
+
+permissions:
+  actions: read
+  contents: read
+
+on:
+  workflow_run:
+    workflows: ["Envoy/Checks"]
+    types:
+      - completed
+
+jobs:
+  upload:
+    runs-on: ubuntu-24.04
+    if: |
+      github.repository == 'envoyproxy/envoy'
+      && github.event.workflow_run.conclusion != 'skipped'
+    steps:
+      - name: Download JUnit XML artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          pattern: junit-xml-*
+          merge-multiple: true
+          path: junit-reports
+
+      - name: Check for report files
+        id: check-files
+        run: |
+          if [ -d junit-reports ] && [ "$(find junit-reports -name '*.xml' | wc -l)" -gt 0 ]; then
+            echo "has_reports=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No JUnit reports found to upload."
+            echo "has_reports=false" >> "$GITHUB_OUTPUT"
+          fi
+        shell: bash
+
+      - name: Upload test results to Datadog CI Visibility
+        if: steps.check-files.outputs.has_reports == 'true'
+        uses: datadog/github-action-upload-junit@7f8cd36e2f694dbf069177a64112e75306cd10e9 # v1.4.0
+        with:
+          api-key: ${{ secrets.DD_API_KEY }}
+          service: envoy-ci
+          files: "junit-reports/**/*.xml"
diff --git a/ci/build_setup.sh b/ci/build_setup.sh
index df2e079316edb..5f7a98e2eb11a 100755
--- a/ci/build_setup.sh
+++ b/ci/build_setup.sh
@@ -170,6 +170,10 @@ export ENVOY_FUZZ_COVERAGE_ARTIFACT="${ENVOY_BUILD_DIR}/generated/fuzz_coverage.
 export ENVOY_FAILED_TEST_LOGS="${ENVOY_BUILD_DIR}"/generated/failed-testlogs
 mkdir -p "${ENVOY_FAILED_TEST_LOGS}"
 
+# This is where we copy JUnit XML test reports for CI collection/publishing.
+export ENVOY_TEST_RESULTS="${ENVOY_BUILD_DIR}"/generated/test-results
+mkdir -p "${ENVOY_TEST_RESULTS}"
+
 # This is where we copy the build profile to.
 export ENVOY_BUILD_PROFILE="${ENVOY_BUILD_DIR}"/generated/build-profile
 mkdir -p "${ENVOY_BUILD_PROFILE}"
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index 2588a47157548..a78d7716c9cce 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -15,6 +15,17 @@ CI_TARGET=$1
 # shellcheck source=ci/build_setup.sh
 . "${CURRENT_SCRIPT_DIR}"/build_setup.sh
 
+# Register exit trap to collect all Bazel JUnit XML test reports before the script exits.
+collect_junit_reports() {
+  if [[ -d "bazel-testlogs" && -n "${ENVOY_TEST_RESULTS}" ]]; then
+    echo "Collecting JUnit XML test reports..."
+    pushd bazel-testlogs >/dev/null
+    find . -name "test.xml" -exec cp --parents -f {} "${ENVOY_TEST_RESULTS}" \; 2>/dev/null || true
+    popd >/dev/null
+  fi
+}
+trap collect_junit_reports EXIT
+
 echo "building for ${ENVOY_BUILD_ARCH}"
 
 cd "${SRCDIR}"