diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 09d3728fba..94ff1ea103 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -199,10 +199,17 @@ jobs:
           image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
           path: "/usr/src/app/windmill"
 
+      - uses: shrink/actions-docker-extract@v3
+        id: extract-ee-debug
+        with:
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
+          path: "/usr/src/app/windmill.debug"
+
       - name: Rename binary with corresponding architecture
         run: |
           mv "${{ steps.extract.outputs.destination }}/windmill" "${{ steps.extract.outputs.destination }}/windmill-${ARCH}"
           mv "${{ steps.extract-ee.outputs.destination }}/windmill" "${{ steps.extract-ee.outputs.destination }}/windmill-ee-${ARCH}"
+          mv "${{ steps.extract-ee-debug.outputs.destination }}/windmill.debug" "${{ steps.extract-ee-debug.outputs.destination }}/windmill-ee-${ARCH}.debug"
 
       - name: Attach binary to release
         uses: softprops/action-gh-release@v2
@@ -210,8 +217,36 @@ jobs:
           files: |
             ${{ steps.extract.outputs.destination }}/*
             ${{ steps.extract-ee.outputs.destination }}/*
+            ${{ steps.extract-ee-debug.outputs.destination }}/*
             ${{ steps.extract-duckdb-ffi-internal.outputs.destination }}/*
 
+  attach_arm64_ee_debug_to_release:
+    needs: [build_ee]
+    runs-on: ubicloud-standard-2-arm
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    env:
+      ARCH: arm64
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          docker pull --platform "linux/$ARCH" ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
+
+      - uses: shrink/actions-docker-extract@v3
+        id: extract-ee-debug
+        with:
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
+          path: "/usr/src/app/windmill.debug"
+
+      - name: Rename debug file with corresponding architecture
+        run: |
+          mv "${{ steps.extract-ee-debug.outputs.destination }}/windmill.debug" "${{ steps.extract-ee-debug.outputs.destination }}/windmill-ee-${ARCH}.debug"
+
+      - name: Attach debug file to release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            ${{ steps.extract-ee-debug.outputs.destination }}/*
+
   # attach_arm64_binary_to_release:
   #   needs: [build, build_ee]
   #   runs-on: ubicoud
diff --git a/Dockerfile b/Dockerfile
index 2ebb8508df..f84afcc888 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -118,6 +118,11 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=$SCCACHE_DIR,sharing=locked \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release --features "$features"
 
+# Split debug info into a separate file, then strip the binary.
+# The .debug file can be extracted as a CI artifact for production debugging.
+RUN objcopy --only-keep-debug /windmill/target/release/windmill /windmill/target/release/windmill.debug \
+    && strip /windmill/target/release/windmill
+
 FROM ${DEBIAN_IMAGE}
 
 ARG TARGETPLATFORM
@@ -252,6 +257,7 @@ ENV TZ=Etc/UTC
 
 COPY --from=builder /frontend/build /static_frontend
 COPY --from=builder /windmill/target/release/windmill ${APP}/windmill
+COPY --from=builder /windmill/target/release/windmill.debug ${APP}/windmill.debug
 COPY --from=windmill_duckdb_ffi_internal_builder /windmill-duckdb-ffi-internal/target/release/libwindmill_duckdb_ffi_internal.so ${APP}/libwindmill_duckdb_ffi_internal.so
 
 COPY --from=denoland/deno:2.2.1 --chmod=755 /usr/bin/deno /usr/bin/deno
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 83e4c9c4cf..f787e0d73f 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -100,6 +100,8 @@ debug = false
 
 [profile.release]
 lto = "thin"
+debug = "line-tables-only"
+strip = "none"
 
 [features]
 default = []