diff --git a/Makefile b/Makefile
index e1cb8e58..4dc0977a 100644
--- a/Makefile
+++ b/Makefile
@@ -37,7 +37,7 @@ TOUCH 	  ?= touch
 BUILDDIR := build
 GITHUB_REPO ?= "https://github.com/trapexit/mergerfs"
 
-DEFAULT_RELEASE := debian:13.amd64
+DEFAULT_TARGET := debian:13.amd64
 
 ifndef GIT_REPO
 ifneq ($(shell $(GIT) --version 2> /dev/null),)
@@ -48,11 +48,7 @@ endif
 endif
 
 USE_XATTR ?= 1
-UGID_USE_RWLOCK ?= 0
 
-ifdef NDEBUG
-OPT_FLAGS := -O2 -DNDEBUG
-else
 ifdef SANITIZE
 ifeq ($(SANITIZE),1)
   override SANITIZE := -fsanitize=address,undefined,leak
@@ -60,14 +56,22 @@ else ifeq ($(filter -fsanitize=%,$(SANITIZE)),)
   override SANITIZE := -fsanitize=$(SANITIZE)
 endif
 endif
-OPT_FLAGS := -O0 \
-	     -g \
-	     -fno-omit-frame-pointer \
-	     $(SANITIZE) \
-	     -fstack-protector-strong \
-             -Wextra \
-	     -Wno-unused-parameter \
-             -DDEBUG
+
+COMMON_OPT_FLAGS += \
+    -fstack-protector-strong \
+    -Wextra \
+    -Wno-unused-parameter
+
+DEBUG_OPT_FLAGS += \
+    -O0 \
+    -g3 \
+    -fno-omit-frame-pointer \
+    $(SANITIZE)
+
+ifdef RELEASE
+OPT_FLAGS := -O3 $(COMMON_OPT_FLAGS)
+else
+OPT_FLAGS ?= $(DEBUG_OPT_FLAGS) $(COMMON_OPT_FLAGS)
 endif
 
 ifdef STATIC
@@ -125,8 +129,7 @@ override INC_FLAGS := \
 	-Ivendored \
 	-Ivendored/libfuse/include
 override MFS_FLAGS  := \
-	-DUSE_XATTR=$(USE_XATTR) \
-	-DUGID_USE_RWLOCK=$(UGID_USE_RWLOCK)
+	-DUSE_XATTR=$(USE_XATTR)
 override TESTS_FLAGS := \
 	-Isrc \
 	-Ivendored \
@@ -198,7 +201,7 @@ libfuse: $(LIBFUSE)
 	$(MAKE) -C vendored/libfuse
 
 $(LIBFUSE):
-	$(MAKE) -C vendored/libfuse $(BUILDDIR)/libfuse.a
+	$(MAKE) -C vendored/libfuse $(BUILDDIR)/libfuse.a RELEASE=$(RELEASE)
 
 tests: $(BUILDDIR)/tests
 
@@ -362,14 +365,16 @@ define build_release
 		--branch=$(GITREF)
 endef
 
-.PHONY: release
+.PHONY: release release-all
 .PHONY: release-amd64 release-arm64 release-armhf release-riscv64
-.PHONY: release-sample release-static release-tarball
+.PHONY: release-sample release-static release-tarball release-installer
 release:
+	$(MAKE) RELEASE=1 CPPFLAGS=-DNDEBUG all
+release-all:
 	$(call build_release,"all")
 release-sample:
-	$(if $(RELEASE),,$(eval RELEASE := $(shell ./buildtools/detect-local-target 2>/dev/null)))
-	$(call build_release,$(if $(RELEASE),$(RELEASE),$(DEFAULT_RELEASE)))
+	$(if $(TARGET),,$(eval TARGET := $(shell ./buildtools/detect-local-target 2>/dev/null)))
+	$(call build_release,$(if $(TARGET),$(TARGET),$(DEFAULT_TARGET)))
 release-amd64:
 	$(call build_release,"amd64")
 release-arm64:
@@ -382,6 +387,8 @@ release-static:
 	$(call build_release,"static")
 release-tarball:
 	$(call build_release,"tarball")
+release-installer:
+	$(call build_release,"installer")
 
 container:
 	$(eval GITREF ?= $(shell git describe --exact-match --tags HEAD 2>/dev/null || git symbolic-ref --short HEAD 2>/dev/null || git rev-parse --short HEAD))
diff --git a/buildtools/build-release b/buildtools/build-release
index 6c307f51..241aeece 100755
--- a/buildtools/build-release
+++ b/buildtools/build-release
@@ -18,7 +18,7 @@ def build(git_repo,
             '--force-rm']
     if os.path.exists(git_repo):
         git_repo = os.path.realpath(git_repo)
-        args += ['-v',f'{git_repo}:/tmp/mergerfs.git:ro']
+        args += ['-v',f'{git_repo}:/tmp/mergerfs.git:ro:z']
         args += ['--build-arg=GIT_REPO=file:///tmp/mergerfs.git']
     else:
         args += [f'--build-arg=GIT_REPO={git_repo}']
diff --git a/buildtools/containerfiles/fedora:44.amd64 b/buildtools/containerfiles/fedora:44.amd64
index 736968b2..ecc1ed70 100644
--- a/buildtools/containerfiles/fedora:44.amd64
+++ b/buildtools/containerfiles/fedora:44.amd64
@@ -1,4 +1,4 @@
-FROM --platform=amd64 fedora:43 as build
+FROM --platform=amd64 fedora:44 as build
 COPY install-build-pkgs build-mergerfs /tmp/
 RUN /tmp/install-build-pkgs
 ARG BUILD_TIMESTAMP=0
diff --git a/buildtools/containerfiles/fedora:44.arm64 b/buildtools/containerfiles/fedora:44.arm64
index ca0bc04f..0ee220cc 100644
--- a/buildtools/containerfiles/fedora:44.arm64
+++ b/buildtools/containerfiles/fedora:44.arm64
@@ -1,4 +1,4 @@
-FROM --platform=arm64 fedora:43 as build
+FROM --platform=arm64 fedora:44 as build
 COPY install-build-pkgs build-mergerfs /tmp/
 RUN /tmp/install-build-pkgs
 ARG BUILD_TIMESTAMP=0
diff --git a/debian/rules b/debian/rules
index e1d52bc2..8924dfdc 100755
--- a/debian/rules
+++ b/debian/rules
@@ -6,8 +6,11 @@ export DH_VERBOSE=1
 %:
 	dh $@
 
+override_dh_auto_build:
+	$(MAKE) release
+
 override_dh_auto_install:
 	$(MAKE) \
 		DESTDIR=$(CURDIR)/debian/mergerfs \
 		PREFIX=/usr \
-		install
+		install
\ No newline at end of file
diff --git a/vendored/libfuse/Makefile b/vendored/libfuse/Makefile
index d521f5db..d41928c8 100644
--- a/vendored/libfuse/Makefile
+++ b/vendored/libfuse/Makefile
@@ -32,9 +32,6 @@ UTILS :=
 INSTALLUTILS :=
 endif
 
-ifeq ($(NDEBUG),1)
-OPT_FLAGS := -O2 -DNDEBUG
-else
 ifdef SANITIZE
 ifeq ($(SANITIZE),1)
   override SANITIZE := -fsanitize=address,undefined,leak
@@ -42,15 +39,22 @@ else ifeq ($(filter -fsanitize=%,$(SANITIZE)),)
   override SANITIZE := -fsanitize=$(SANITIZE)
 endif
 endif
-OPT_FLAGS := -O0 \
-	     -g \
-	     -fno-omit-frame-pointer \
-	     $(SANITIZE) \
-	     -fstack-protector-strong \
-             -Wextra \
-	     -Werror \
-	     -Wno-unused-parameter \
-             -DDEBUG
+
+COMMON_OPT_FLAGS += \
+    -fstack-protector-strong \
+    -Wextra \
+    -Wno-unused-parameter
+
+DEBUG_OPT_FLAGS += \
+    -O0 \
+    -g3 \
+    -fno-omit-frame-pointer \
+    $(SANITIZE)
+
+ifdef RELEASE
+OPT_FLAGS := -O3 $(COMMON_OPT_FLAGS)
+else
+OPT_FLAGS ?= $(DEBUG_OPT_FLAGS) $(COMMON_OPT_FLAGS)
 endif
 
 ifeq ($(LTO),1)
@@ -151,10 +155,10 @@ $(BUILDDIR)/mount.mergerfs: $(BUILDDIR)/libfuse.a util/mount.mergerfs.cpp
 mount.mergerfs: $(BUILDDIR)/mount.mergerfs
 
 $(BUILDDIR)/.objs/%.c.o: lib/%.c | $(BUILDDIR)/stamp
-	$(CC) $(CFLAGS) $(FUSE_FLAGS) -c $< -o $@
+	$(CC) $(CFLAGS) $(CPPFLAGS) $(FUSE_FLAGS) -c $< -o $@
 
 $(BUILDDIR)/.objs/%.cpp.o: lib/%.cpp | $(BUILDDIR)/stamp
-	$(CXX) $(CXXFLAGS) $(FUSE_FLAGS) -c $< -o $@
+	$(CXX) $(CXXFLAGS) $(CPPFLAGS) $(FUSE_FLAGS) -c $< -o $@
 
 .PHONY: clean
 clean:
@@ -176,6 +180,10 @@ install-utils: mergerfs-fusermount mount.mergerfs strip
 
 install: $(INSTALLUTILS)
 
+.PHONY: release
+release:
+	$(MAKE) RELEASE=1 NDEBUG=1 CPPFLAGS="$(CPPFLAGS) -DNDEBUG" all
+
 .PHONY: objects strip utils install install-utils
 
 -include $(DEPS)