diff --git a/pkgs/by-name/li/linux-pam/package.nix b/pkgs/by-name/li/linux-pam/package.nix
index dc1d0bffdb37..9559bae721c5 100644
--- a/pkgs/by-name/li/linux-pam/package.nix
+++ b/pkgs/by-name/li/linux-pam/package.nix
@@ -28,6 +28,7 @@
     lib.meta.availableOn stdenv.hostPlatform audit
     # cross-compilation only works from platforms with linux headers
     && lib.meta.availableOn stdenv.buildPlatform linuxHeaders,
+  debugMode ? false, # warning: slower execution due to debug makes VM tests fail!
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -96,7 +97,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "audit" withAudit)
     (lib.mesonEnable "pam_lastlog" (!stdenv.hostPlatform.isMusl)) # TODO: switch to pam_lastlog2, pam_lastlog is deprecated and broken on musl
     (lib.mesonEnable "pam_unix" true)
-    # (lib.mesonBool "pam-debug" true) # warning: slower execution due to debug makes VM tests fail!
     (lib.mesonOption "sysconfdir" "etc") # relative to meson prefix, which is $out
     (lib.mesonEnable "elogind" false)
     (lib.mesonEnable "econf" false)
@@ -104,7 +104,9 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "nis" false)
     (lib.mesonBool "xtests" false)
     (lib.mesonBool "examples" false)
-  ];
+  ]
+  # warning: slower execution due to debug makes VM tests fail!
+  ++ lib.optional debugMode (lib.mesonBool "pam-debug" true);
 
   postInstall = ''
     moveToOutput sbin/pam_namespace_helper $scripts