diff --git a/.jenkins.d/20-tests.sh b/.jenkins.d/20-tests.sh
index 13ddf6e..e0d2977 100755
--- a/.jenkins.d/20-tests.sh
+++ b/.jenkins.d/20-tests.sh
@@ -3,6 +3,7 @@
 
 # Prepare environment
 rm -rf ~/.ndn
+ndnsec key-gen "/tmp/jenkins/$NODE_NAME" | ndnsec cert-install -
 
 # https://github.com/google/sanitizers/wiki/AddressSanitizerFlags
 ASAN_OPTIONS="color=always"
diff --git a/.jenkins.d/30-coverage.sh b/.jenkins.d/30-coverage.sh
index 70c5c9b..f4e8769 100755
--- a/.jenkins.d/30-coverage.sh
+++ b/.jenkins.d/30-coverage.sh
@@ -2,12 +2,16 @@
 set -ex
 
 if [[ $JOB_NAME == *"code-coverage" ]]; then
-    # Generate an XML report (Cobertura format)
-    gcovr --object-directory=build \
-          --output=build/coverage.xml \
-          --exclude="$PWD/tests" \
-          --root=. \
-          --xml
+    # Generate an XML report (Cobertura format) and a detailed HTML report using gcovr
+    # Note: trailing slashes are important in the paths below. Do not remove them!
+    gcovr -j$WAF_JOBS \
+          --object-directory build \
+          --filter src/ \
+          --exclude-throw-branches \
+          --exclude-unreachable-branches \
+          --print-summary \
+          --html-details build/gcovr/ \
+          --xml build/coverage.xml
 
     # Generate a detailed HTML report using lcov
     lcov --quiet \
diff --git a/.jenkins.d/40-headers-check.sh b/.jenkins.d/40-headers-check.sh
new file mode 100755
index 0000000..343160a
--- /dev/null
+++ b/.jenkins.d/40-headers-check.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+# It's intentional not to use `set -x`, because this script explicitly prints useful information
+# and should not run in trace mode.
+# It's intentional not to use `set -e`, because this script wants to check all headers
+# (similar to running all test cases), instead of failing at the first error.
+
+PROJ=ndn-nac
+
+if [[ -n $DISABLE_HEADERS_CHECK ]]; then
+  echo 'Skipping headers check.'
+  exit 0
+fi
+
+if has CentOS-8 $NODE_LABELS; then
+  export PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig
+fi
+
+CXX=${CXX:-g++}
+STD=-std=c++14
+CXXFLAGS="-O2 -Wall -Wno-unneeded-internal-declaration -Wno-unused-const-variable $(pkg-config --cflags libndn-cxx lib$PROJ)"
+INCLUDEDIR="$(pkg-config --variable=includedir lib$PROJ)"/$PROJ
+
+echo "Using: $CXX $STD $CXXFLAGS"
+
+NCHECKED=0
+NERRORS=0
+while IFS= read -r -d '' H; do
+  echo "Checking header ${H#${INCLUDEDIR}/}"
+  "$CXX" -xc++ $STD $CXXFLAGS -c -o /dev/null "$H"
+  [[ $? -eq 0 ]] || ((NERRORS++))
+  ((NCHECKED++))
+done < <(find "$INCLUDEDIR" -name '*.hpp' -type f -print0 2>/dev/null)
+
+if [[ $NCHECKED -eq 0 ]]; then
+  echo "No headers found. Is $PROJ installed?"
+  exit 1
+else
+  echo "$NCHECKED headers checked."
+fi
+
+if [[ $NERRORS -gt 0 ]]; then
+  echo "$NERRORS headers could not be compiled."
+  exit 1
+fi