diff --git a/Cargo.toml b/Cargo.toml
index 18fd9d45b..1998ffdff 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -25,3 +25,8 @@ resolver = "2"
 [workspace.package]
 edition = "2024"
 license = "AGPL-3.0-or-later"
+
+[profile.release]
+lto = "fat"
+codegen-units = 1
+strip = "symbols"
diff --git a/fluxer_admin/Dockerfile b/fluxer_admin/Dockerfile
index 240703c5a..0163bb3f5 100644
--- a/fluxer_admin/Dockerfile
+++ b/fluxer_admin/Dockerfile
@@ -37,6 +37,11 @@ RUN printf '%s\n' \
 	'[workspace.package]' \
 	'edition = "2024"' \
 	'license = "AGPL-3.0-or-later"' \
+	'' \
+	'[profile.release]' \
+	'lto = "fat"' \
+	'codegen-units = 1' \
+	'strip = "symbols"' \
 	> Cargo.toml
 
 ENV FLUXER_BUILD_VERSION="${BUILD_VERSION}"
diff --git a/fluxer_app_proxy/Dockerfile b/fluxer_app_proxy/Dockerfile
index 83675ce67..a5bdd3c04 100644
--- a/fluxer_app_proxy/Dockerfile
+++ b/fluxer_app_proxy/Dockerfile
@@ -127,6 +127,11 @@ RUN printf '%s\n' \
 	'[workspace.package]' \
 	'edition = "2024"' \
 	'license = "AGPL-3.0-or-later"' \
+	'' \
+	'[profile.release]' \
+	'lto = "fat"' \
+	'codegen-units = 1' \
+	'strip = "symbols"' \
 	> Cargo.toml
 
 RUN if [ "${FLUXER_APP_PROXY_TIME_FREEZE_ENABLED}" = "false" ]; then \
diff --git a/tools/ci/src/app_proxy.rs b/tools/ci/src/app_proxy.rs
index 6f533b67c..ba1cd24e7 100644
--- a/tools/ci/src/app_proxy.rs
+++ b/tools/ci/src/app_proxy.rs
@@ -452,6 +452,33 @@ mod tests {
         );
     }
 
+    #[test]
+    fn dockerfile_workspace_manifest_keeps_the_release_profile() {
+        let dockerfile = include_str!("../../../fluxer_app_proxy/Dockerfile");
+        let manifest = dockerfile
+            .split("'[workspace]'")
+            .nth(1)
+            .expect("synthesized workspace manifest")
+            .split("> Cargo.toml")
+            .next()
+            .expect("synthesized workspace manifest body");
+        for entry in [
+            "'[profile.release]'",
+            "'lto = \"fat\"'",
+            "'codegen-units = 1'",
+            "'strip = \"symbols\"'",
+        ] {
+            assert!(
+                manifest.contains(entry),
+                "the rust-builder workspace manifest replaces the repository root one, so it must carry {entry}"
+            );
+        }
+        assert!(
+            !manifest.contains("panic"),
+            "fluxer_svc runs every request on its own tokio task, so a panicking handler must unwind instead of aborting the pod"
+        );
+    }
+
     #[test]
     fn asset_manifest_entries_are_sorted_and_relative_to_dist() {
         let temp = tempfile::tempdir().unwrap();