diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index d8aeea9d..f8eaffd2 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -192,6 +192,24 @@ jobs:
           docker logs smoke-aisix
           test -n "$ok"
 
+      # The profiling contract from #847: the shipped binary must stay
+      # profileable in the field, meaning the symbol table survives into
+      # the image (function-level flame graphs). A future strip step,
+      # RUSTFLAGS change, or base-image swap would break flame graphs
+      # silently, so pin it here — and print the size so every PR
+      # records the real Linux artifact cost.
+      - name: Verify shipped binary keeps its symbol table (#847)
+        if: github.event_name == 'pull_request'
+        run: |
+          set -eux
+          IMAGE="$(printf '%s\n' "${{ steps.meta.outputs.tags }}" | head -n1)"
+          cid="$(docker create "$IMAGE")"
+          docker cp "$cid:/usr/local/bin/aisix" /tmp/aisix-shipped
+          docker rm "$cid"
+          ls -l /tmp/aisix-shipped
+          test "$(nm /tmp/aisix-shipped | grep -c ' [tT] ')" -gt 1000
+          readelf -S /tmp/aisix-shipped | grep -E '\.symtab|\.eh_frame'
+
       - name: Install cosign
         if: github.event_name != 'pull_request'
         uses: sigstore/cosign-installer@v3
diff --git a/Cargo.toml b/Cargo.toml
index f529c186..10623fe6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -145,10 +145,19 @@ wiremock = "0.6"
 testcontainers = "0.23"
 tempfile = "3.13"
 
+# Shipped binaries must stay profileable in the field (perf / cargo
+# flamegraph against the very build a user runs), so keep the symbol
+# table: function-level flame graphs cost ~10 MiB over stripped. DWARF
+# stays out — line tables alone measured ~142 MB here (cgu=1 + thin
+# LTO explode inlined-instance records). For an ad-hoc line-level
+# build when a deep dive needs file:line attribution:
+#   CARGO_PROFILE_RELEASE_DEBUG=line-tables-only \
+#   CARGO_PROFILE_RELEASE_STRIP=none cargo build --release
+# See issue #847.
 [profile.release]
 lto = "thin"
 codegen-units = 1
-strip = "symbols"
+strip = "debuginfo"
 
 [profile.coverage]
 inherits = "dev"