diff --git a/.travis-coverity-scan.py b/.travis-coverity-scan.py
new file mode 100755
index 00000000..ce96bb6d
--- /dev/null
+++ b/.travis-coverity-scan.py
@@ -0,0 +1,31 @@
+#!/usr/bin/python3
+
+# https://scan.coverity.com/faq#frequency doesn't allow every push to be scanned.
+# So this script pushes znc/znc to znc/coverity no more than once a day, with modified .travis.yml
+
+import datetime
+import subprocess
+import sys
+import yaml
+
+subprocess.check_call(['git remote add coverity github:znc/coverity.git'], shell=True)
+subprocess.check_call(['git fetch coverity'], shell=True)
+commits_today = subprocess.check_output(['git log --since=today.midnight --oneline coverity/coverity_scan || true'], shell=True)
+if len(commits_today) > 0:
+    print('There were already commits today in coverity_scan')
+    sys.exit()
+
+# Get "install:" from .travis.yml, the rest from .travis-coverity.yml
+with open('.travis.yml') as f:
+    t = yaml.load(f)
+with open('.travis-coverity.yml') as f:
+    c = yaml.load(f)
+# Travis project of znc/coverity is not multi-os
+c['install'] = ['export TRAVIS_OS_NAME=linux'] + t['install']
+
+with open('.travis.yml', 'w') as f:
+    print(yaml.dump(c, default_flow_style=False), file=f)
+
+subprocess.check_call(['git checkout -b coverity_scan'], shell=True)
+subprocess.check_call(['git commit .travis.yml -m"Automatic coverity scan for {}"'.format(datetime.date.today())], shell=True)
+subprocess.check_call(['git push coverity coverity_scan -f'], shell=True)
diff --git a/.travis-coverity.yml b/.travis-coverity.yml
new file mode 100644
index 00000000..277a9e6c
--- /dev/null
+++ b/.travis-coverity.yml
@@ -0,0 +1,19 @@
+language: cpp
+env:
+  global:
+   # The next declaration is the encrypted COVERITY_SCAN_TOKEN, created
+   #   via the "travis encrypt" command using the project repo's public key
+   - secure: "ZtgnBbHMNPeSLXMT3WQu732YntCUloBr/fLF1mfSZwAoSQxfVz+RMZEwhMKhtZ9r3hTudQoAC5RTBJ7MalFBMLqsH12yK5mHSm7DujlrTG2J6LNZAz+37ZIIUzsfHoMzkCO+EGlrBhSICr7k3AaNYshL2gcaIXhf4CXX0E3Kj5H4NIuyFN8pHOYUKxnf2pwed49q3KGZq1fVnpU725jF97xv+c6G7H2aAtPOjWlV60kOQJNr7mv2fcjrx809108A7Q30ULDG5i1u5h1SN8zydh5grI/6e7BcRs0ZsV1f0H2oOg3JLNHWd1xVw0vEKyfZfr92FYTvz24YaIk2ApIeJyfu5KHrb00yYiYulZpeIyXLYswxVnQTNLGriVgUAFXa0j0MwcPg4lLQWpAQvbldYsJh9Xn+D/2qkOG0EqZbgXciCg57ZbPEhDokejmX3cjxXlJp5KwCupWLb8oSrXkRd3tnimTE9r/eV6GwFb5gmMeGEel6jsHs/AwpVds7vnaOXbfNFiQOZOK8gpmnk9K2zZxxFtrTDvJMUn/qTJ+NcUbSJX+aDj++WRZI9Rv9fdzF1m4C6tFmxyo0WdcT9ZN3pZXCWNFoMe3wt4ad72XNCBrZ8fLGmxnx0UdNURQO/C0EESakomNaIkUq3TAJXiWhFYUfu9w6Ve9mDrGtjGQkM7k="
+
+addons:
+  coverity_scan:
+    project:
+      name: "znc/coverity"
+      description: "Build submitted via Travis CI"
+    notification_email: coverity@znc.in
+    build_command_prepend: "./configure --enable-perl --enable-python --enable-tcl"
+    build_command: "make"
+    branch_pattern: coverity_scan
+
+sudo: required
+dist: trusty
diff --git a/.travis-generate-docs.sh b/.travis-generate-docs.sh
index b6d27593..c60ac52d 100755
--- a/.travis-generate-docs.sh
+++ b/.travis-generate-docs.sh
@@ -4,21 +4,8 @@ echo "Generating docs with doxygen..."
 
 doxygen
 
-mkdir -p ~/.ssh
-chmod 0600 ~/znc-docs-key
-cat <<EOF >> ~/.ssh/config
-Host znc-docs
-HostName github.com
-User git
-IdentityFile ~/znc-docs-key
-StrictHostKeyChecking no
-UserKnownHostsFile /dev/null
-EOF
-
 cd "$HOME"
-git config --global user.email "travis-ci@znc.in"
-git config --global user.name "znc-travis"
-git clone --depth=1 --branch=gh-pages znc-docs:znc/docs.git gh-pages || exit 1
+git clone --depth=1 --branch=gh-pages github:znc/docs.git gh-pages || exit 1
 
 cd "$TRAVIS_BUILD_DIR/doc/html/"
 mv ~/gh-pages/.git ./
diff --git a/.travis.ssh b/.travis.ssh
new file mode 100644
index 00000000..8a29caa3
--- /dev/null
+++ b/.travis.ssh
@@ -0,0 +1,7 @@
+Host github
+HostName github.com
+User git
+IdentityFile ~/znc-github-key
+StrictHostKeyChecking no
+UserKnownHostsFile /dev/null
+
diff --git a/.travis.yml b/.travis.yml
index a51906dd..91878e77 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,6 +1,7 @@
 language: cpp
 env:
     global:
+          # SECRET_KEY, used to push docs to github and to init coverity scans
         - secure: "i2f2UVDnyHT/9z0U3XvgTj8eDERvnc1Wk7HpseEjb75JwGzqn/2R+RKHmoSrwK3hFgij2IMxZL19XtHFwMz9t5A/huAAKD74KMMI/QpeZEJ/sjT3CTLcE9HEVDdJOjc7dfLRxb2hZtgvx8clZIMrpeUdPhci8openff30KvXVbg="
 matrix:
     fast_finish: true
@@ -28,7 +29,7 @@ before_install:
     - if [[ "$BUILD_TYPE" == "coverage" ]]; then export CFGFLAGS="--enable-debug --disable-perl --disable-python" MYCXXFLAGS=--coverage MYLDFLAGS=--coverage; fi
       # UBSan randomly crashes clang, and very often :(
       # CFGFLAGS=--enable-debug MYCXXFLAGS="-fsanitize=undefined -O1 -fPIE -fno-sanitize-recover" MYLDFLAGS="-fsanitize=undefined -pie -fno-sanitize-recover"
-    - if [[ "$TRAVIS_REPO_SLUG" == "znc/znc" && "$TRAVIS_PULL_REQUEST" == "false" && "$TRAVIS_BRANCH" == "master" ]]; then openssl aes-256-cbc -d -in .travis-github.enc -out ~/znc-docs-key -k ${SECRET_KEY}; fi
+    - if [[ "$TRAVIS_REPO_SLUG" == "znc/znc" && "$TRAVIS_PULL_REQUEST" == "false" && "$TRAVIS_BRANCH" == "master" ]]; then openssl aes-256-cbc -d -in .travis-github.enc -out ~/znc-github-key -k ${SECRET_KEY}; fi
     - export SECRET_KEY=no
 install:
     - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then cat /proc/cpuinfo /proc/meminfo; fi
@@ -36,7 +37,7 @@ install:
     - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then sudo add-apt-repository -y ppa:teward/swig3.0; fi
     - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then sudo add-apt-repository -y ppa:beineri/opt-qt551-trusty; fi  # default qt5.2 from trusty doesn't support QByteArray::toStdString()
     - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then sudo apt-get update; fi
-    - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then sudo apt-get install -y libperl-dev python3-dev tcl-dev libsasl2-dev libicu-dev swig3.0 doxygen graphviz qt55base; fi
+    - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then sudo apt-get install -y libperl-dev python3-dev tcl-dev libsasl2-dev libicu-dev swig3.0 doxygen graphviz qt55base python3-yaml; fi
     - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then source /opt/qt55/bin/qt55-env.sh; fi
     - |
           if [[ "$TRAVIS_OS_NAME" == "linux" && "$BUILD_TYPE" == "coverage" ]]; then
@@ -84,7 +85,13 @@ after_success:
     - |
           if [ "$BUILD_LEADER" == "YES" ] && [ "$BUILD_AGGREGATE_STATUS" == "others_succeeded" ] && [ "$TRAVIS_REPO_SLUG" == "znc/znc" ] && [ "$TRAVIS_PULL_REQUEST" == "false" ] && [ "$TRAVIS_BRANCH" == "master" ]; then
               echo "All builds passed!"
+              mkdir -p ~/.ssh
+              chmod 0600 ~/znc-github-key
+              cp .travis.ssh ~/.ssh/config
+              git config --global user.email "travis-ci@znc.in"
+              git config --global user.name "znc-travis"
               ./.travis-generate-docs.sh
+              ./.travis-coverity-scan.py
           else
               echo "Not leader"
           fi