diff --git a/Dockerfile b/Dockerfile
index b732f059..b7fa22d8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,5 @@
-FROM gcr.io/distroless/cc-debian12:nonroot
+ARG IMAGE_TAG=nonroot
+FROM gcr.io/distroless/cc-debian12:${IMAGE_TAG}
 
 ARG BINARY=objectstore
 COPY ${BINARY} /bin/entrypoint
diff --git a/scripts/build-cross.sh b/scripts/build-cross.sh
index fa97367b..ee56d977 100755
--- a/scripts/build-cross.sh
+++ b/scripts/build-cross.sh
@@ -4,11 +4,18 @@ set -euo pipefail
 cd "$(dirname "$0")/.."
 
 BINARY=${1:-objectstore}
+DEBUG_IMAGE=${DEBUG_IMAGE:-false}
 case "$BINARY" in
     objectstore) PACKAGE="objectstore-server" ;;
     *) PACKAGE="$BINARY" ;;
 esac
 
+if [[ "$DEBUG_IMAGE" =~ ^(true|1|yes|on)$ ]]; then
+    IMAGE_TAG="debug-nonroot"
+else
+    IMAGE_TAG="nonroot"
+fi
+
 docker build \
     --platform linux/arm64 \
     -f Dockerfile.cross \
@@ -26,6 +33,7 @@ docker run --rm \
 docker build \
     --platform linux/amd64 \
     -f Dockerfile \
+    --build-arg IMAGE_TAG="$IMAGE_TAG" \
     --build-arg BINARY="$BINARY" \
     -t "$BINARY:latest" \
     "target/x86_64-unknown-linux-gnu/release/"