diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index 2cffc3cf82..56f62e67ea 100644
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -74,7 +74,7 @@ jobs:
 
     steps:
     - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
-    - uses: systemd/mkosi@a845d4108ac87ca443bd1ad78ab53520bffd2eda
+    - uses: systemd/mkosi@236784dbb597321eedab50cef06cc49f92c57293
 
     # Freeing up disk space with rm -rf can take multiple minutes. Since we don't need the extra free space
     # immediately, we remove the files in the background. However, we first move them to a different location
diff --git a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
index 8eebd62b04..13d4ebeb18 100755
--- a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
@@ -25,7 +25,7 @@ mount --mkdir --rbind "$PWD/pkg/$ID" "pkg/$ID/src/"
 # on the makepkg command line so we append to /etc/makepkg.conf instead. The rootfs is overlaid with a
 # writable tmpfs during the build script so these changes don't end up in the image itself.
 tee --append /etc/makepkg.conf >/dev/null <<EOF
-CFLAGS="$CFLAGS -O0 -Wp,-D_FORTIFY_SOURCE=0"
+CFLAGS="$CFLAGS -O0 -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=0"
 OPTIONS=(
     docs
     !libtool
diff --git a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.conf.d/10-debug.conf b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.conf.d/10-debug.conf
new file mode 100644
index 0000000000..4a6d2e925c
--- /dev/null
+++ b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.conf.d/10-debug.conf
@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Environment=WITH_DEBUG=1
+
+[Content]
+VolatilePackages=systemd-debug
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
index 0cba71bf7a..46a509b330 100755
--- a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
@@ -32,7 +32,7 @@ ARCH="$(rpm --eval %_arch)"
 SRCDEST="/usr/src/debug/systemd-$VERSION-${RELEASE}${DIST}.$ARCH"
 
 # TODO: Drop -D_FORTIFY_SOURCE when we switch to CentOS Stream 10.
-EXTRA_CFLAGS="-O0 -Wp,-D_FORTIFY_SOURCE=0"
+EXTRA_CFLAGS="-O0 -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=0"
 if ((WITH_DEBUG)); then
     EXTRA_CFLAGS="$EXTRA_CFLAGS -ffile-prefix-map=../src=$SRCDEST"
 fi
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf
index cc9f3e9d11..4344b51fa0 100644
--- a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf
+++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf
@@ -7,18 +7,18 @@ Distribution=|fedora
 [Content]
 VolatilePackages=
         systemd
-        systemd-udev
-        systemd-container
-        systemd-repart
-        systemd-resolved
-        systemd-networkd
         systemd-boot
-        systemd-tests
-        systemd-ukify
-        systemd-pam
-        systemd-oomd-defaults
+        systemd-container
+        systemd-devel
         systemd-journal-remote
+        systemd-networkd
         systemd-networkd-defaults
+        systemd-oomd-defaults
+        systemd-pam
+        systemd-resolved
+        systemd-tests
+        systemd-udev
+        systemd-ukify
 
 Packages=
         bpftool
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-debug.conf b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-debug.conf
new file mode 100644
index 0000000000..0c3707b20b
--- /dev/null
+++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-debug.conf
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Environment=WITH_DEBUG=1
+
+[Content]
+VolatilePackages=
+        systemd-container-debuginfo
+        systemd-debuginfo
+        systemd-debugsource
+        systemd-journal-remote-debuginfo
+        systemd-libs-debuginfo
+        systemd-networkd-debuginfo
+        systemd-pam-debuginfo
+        systemd-resolved-debuginfo
+        systemd-tests-debuginfo
+        systemd-udev-debuginfo
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
index 7ece67705a..7144d73f10 100644
--- a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
+++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
@@ -6,19 +6,28 @@ Distribution=|ubuntu
 
 [Content]
 VolatilePackages=
+        libnss-myhostname
+        libnss-mymachines
+        libnss-resolve
+        libnss-systemd
+        libpam-systemd
+        libsystemd-dev
+        libudev-dev
         systemd
-        systemd-userdbd
+        systemd-boot
+        systemd-boot-efi
+        systemd-container
+        systemd-coredump
+        systemd-dev
+        systemd-homed
+        systemd-journal-remote
         systemd-oomd
+        systemd-resolved
         systemd-sysv
         systemd-tests
         systemd-timesyncd
-        systemd-resolved
-        systemd-homed
-        systemd-coredump
-        systemd-journal-remote
-        systemd-container
-        systemd-boot
         systemd-ukify
+        systemd-userdbd
         udev
 
 Packages=
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/10-debug.conf b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/10-debug.conf
new file mode 100644
index 0000000000..b53b3dcffe
--- /dev/null
+++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf.d/10-debug.conf
@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Environment=WITH_DEBUG=1
+
+[Content]
+VolatilePackages=
+        libnss-myhostname-dbgsym
+        libnss-mymachines-dbgsym
+        libnss-resolve-dbgsym
+        libnss-systemd-dbgsym
+        libpam-systemd-dbgsym
+        libsystemd-shared-dbgsym
+        libsystemd0-dbgsym
+        libudev1-dbgsym
+        systemd-boot-dbgsym
+        systemd-container-dbgsym
+        systemd-coredump-dbgsym
+        systemd-dbgsym
+        systemd-homed-dbgsym
+        systemd-journal-remote-dbgsym
+        systemd-oomd-dbgsym
+        systemd-resolved-dbgsym
+        systemd-tests-dbgsym
+        systemd-timesyncd-dbgsym
+        systemd-userdbd-dbgsym
+        udev-dbgsym
diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot
index fe89611e36..6261be1990 100755
--- a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.build.chroot
@@ -29,6 +29,20 @@ tee --append /usr/lib/rpm/suse/macros <<'EOF'
 %{nil}
 EOF
 
+VERSION="$(cat meson.version)"
+RELEASE="$(date "+%Y%m%d%H%M%S" --date "@$TS")"
+
+DIST="$(rpm --eval %dist)"
+ARCH="$(rpm --eval %_arch)"
+SRCDEST="/usr/src/debug/systemd-$VERSION-${RELEASE}${DIST}.$ARCH"
+
+# TODO: Enable this when the opensuse spec stops unconditionally setting FORTIFY_SOURCE=2.
+# EXTRA_CFLAGS="-O0 -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=0"
+EXTRA_CFLAGS=""
+if ((WITH_DEBUG)); then
+    EXTRA_CFLAGS="$EXTRA_CFLAGS -ffile-prefix-map=../src=$SRCDEST"
+fi
+
 build() {
     IFS=
     # TODO: Replace meson_build and meson_install overrides with "--undefine __meson_verbose" once
@@ -49,15 +63,17 @@ build() {
         $( ((WITH_DEBUG)) || echo --define) \
         $( ((WITH_DEBUG)) || echo "debug_package %{nil}") \
         --define "vendor openSUSE" \
-        --define "version_override $(cat meson.version)" \
-        --define "release_override $(date "+%Y%m%d%H%M%S" --date "@$TS")" \
+        --define "version_override $VERSION" \
+        --define "release_override $RELEASE" \
         --define "__check_files sh -c '$(rpm --eval %__check_files) | tee /tmp/unpackaged-files'" \
+        --define "build_cflags $(rpm --eval %build_cflags) $EXTRA_CFLAGS" \
         --define "meson_build %{shrink:%{__meson} compile -C %{_vpath_builddir} -j %{_smp_build_ncpus} %{nil}}" \
         --define "meson_install %{shrink:DESTDIR=%{buildroot} %{__meson} install -C %{_vpath_builddir} --no-rebuild --quiet %{nil}}" \
         --define "meson_extra_configure_options -D mode=developer -D b_sanitize=${SANITIZERS:-none}" \
         --define "__os_install_post /usr/lib/rpm/brp-suse %{nil}" \
         --define "__elf_exclude_path ^/usr/lib/systemd/tests/unit-tests/.*$" \
         --define "__script_requires %{nil}" \
+        --define "_find_debuginfo_dwz_opts %{nil}" \
         --noclean \
         "$@" \
         "pkg/$ID/systemd.spec"
diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf
index 24d69ccc27..dbc6f945af 100644
--- a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf
+++ b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf
@@ -9,15 +9,18 @@ InitrdInclude=initrd/
 [Content]
 VolatilePackages=
         systemd
-        udev
-        systemd-experimental
         systemd-boot
         systemd-container
+        systemd-devel
+        systemd-doc
+        systemd-experimental
         systemd-homed
+        systemd-lang
         systemd-network
         systemd-portable
         systemd-sysvcompat
         systemd-testsuite
+        udev
 
 # We install gawk, gzip, grep, xz, sed, rsync and docbook-xsl-stylesheets here explicitly so that the busybox
 # versions don't get installed instead.
diff --git a/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf.d/10-debug.conf b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf.d/10-debug.conf
new file mode 100644
index 0000000000..2262eae77e
--- /dev/null
+++ b/mkosi.images/system/mkosi.conf.d/10-opensuse/mkosi.conf.d/10-debug.conf
@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Match]
+Environment=WITH_DEBUG=1
+
+[Content]
+VolatilePackages=
+        libsystemd0-debuginfo
+        libudev1-debuginfo
+        systemd-boot-debuginfo
+        systemd-container-debuginfo
+        systemd-coredump-debuginfo
+        systemd-debuginfo
+        systemd-debugsource
+        systemd-experimental-debuginfo
+        systemd-homed-debuginfo
+        systemd-journal-remote-debuginfo
+        systemd-network-debuginfo
+        systemd-portable-debuginfo
+        systemd-sysvcompat-debuginfo
+        systemd-testsuite-debuginfo
+        udev-debuginfo