diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index 2f5d5b28f5..2cffc3cf82 100644
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -119,15 +119,6 @@ jobs:
                                systemd.default_device_timeout_sec=180
         EOF
 
-        # For erofs, we have to install linux-modules-extra-azure, but that doesn't match the running kernel
-        # version, so we can't load the erofs module. squashfs is a builtin module so we use that instead.
-
-        mkdir -p mkosi.images/system/mkosi.repart/10-usr.conf.d
-        tee mkosi.images/system/mkosi.repart/10-usr.conf.d/squashfs.conf <<EOF
-        [Partition]
-        Format=squashfs
-        EOF
-
         # The emergency shell is not useful in the CI, as it just blocks for a long time before the job
         # eventually times out. Override it to just shutdown immediately.
         mkdir -p mkosi.images/initrd/mkosi.extra/usr/lib/systemd/system/emergency.service.d/
diff --git a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
index fb85580360..8eebd62b04 100755
--- a/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-arch/mkosi.build.chroot
@@ -20,12 +20,12 @@ mount --mkdir --rbind "$PWD/pkg/$ID" "pkg/$ID/src/"
 # shellcheck source=/dev/null
 . /etc/makepkg.conf
 
-# Override the default options. Use -Og because -O0 doesn't work with FORTIFY_SOURCE. We specifically disable
-# "strip", "zipman" and "lto" as they slow down builds significantly. OPTIONS= cannot be overridden on the
-# makepkg command line so we append to /etc/makepkg.conf instead. The rootfs is overlaid with a writable
-# tmpfs during the build script so these changes don't end up in the image itself.
+# Override the default options. Disable FORTIFY_SOURCE because it doesn't work with O0. We specifically
+# disable "strip", "zipman" and "lto" as they slow down builds significantly. OPTIONS= cannot be overridden
+# on the makepkg command line so we append to /etc/makepkg.conf instead. The rootfs is overlaid with a
+# writable tmpfs during the build script so these changes don't end up in the image itself.
 tee --append /etc/makepkg.conf >/dev/null <<EOF
-CFLAGS="$CFLAGS -Og"
+CFLAGS="$CFLAGS -O0 -Wp,-D_FORTIFY_SOURCE=0"
 OPTIONS=(
     docs
     !libtool
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
index e2d20d4b87..0cba71bf7a 100755
--- a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.build.chroot
@@ -24,6 +24,19 @@ tee --append /usr/lib/rpm/redhat/macros <<'EOF'
 %{nil}
 EOF
 
+VERSION="$(cat meson.version)"
+RELEASE="$(date "+%Y%m%d%H%M%S" --date "@$TS")"
+
+DIST="$(rpm --eval %dist)"
+ARCH="$(rpm --eval %_arch)"
+SRCDEST="/usr/src/debug/systemd-$VERSION-${RELEASE}${DIST}.$ARCH"
+
+# TODO: Drop -D_FORTIFY_SOURCE when we switch to CentOS Stream 10.
+EXTRA_CFLAGS="-O0 -Wp,-D_FORTIFY_SOURCE=0"
+if ((WITH_DEBUG)); then
+    EXTRA_CFLAGS="$EXTRA_CFLAGS -ffile-prefix-map=../src=$SRCDEST"
+fi
+
 IFS=
 # TODO: Replace meson_build and meson_install overrides with "--undefine __meson_verbose" once
 # https://github.com/mesonbuild/meson/pull/12835 is available.
@@ -43,9 +56,9 @@ rpmbuild \
     --define "_binary_payload w.ufdio" \
     $( ((WITH_DEBUG)) || echo --define) \
     $( ((WITH_DEBUG)) || echo "debug_package %{nil}") \
-    --define "version_override $(cat meson.version)" \
-    --define "release_override $(date "+%Y%m%d%H%M%S" --date "@$TS")" \
-    --define "_distro_extra_cflags -Og" \
+    --define "version_override $VERSION" \
+    --define "release_override $RELEASE" \
+    --define "build_cflags $(rpm --eval %build_cflags) $EXTRA_CFLAGS" \
     --define "meson_build %{shrink:%{__meson} compile -C %{_vpath_builddir} -j %{_smp_build_ncpus} %{nil}}" \
     --define "meson_install %{shrink:DESTDIR=%{buildroot} %{__meson} install -C %{_vpath_builddir} --no-rebuild --quiet %{nil}}" \
     --define "meson_extra_configure_options -D mode=developer -D b_sanitize=${SANITIZERS:-none}" \
@@ -58,6 +71,8 @@ rpmbuild \
     --define "__brp_check_rpaths %{nil}" \
     --define "__elf_exclude_path ^/usr/lib/systemd/tests/unit-tests/.*$" \
     --define "__script_requires %{nil}" \
+    --define "_find_debuginfo_dwz_opts %{nil}" \
+    --define "_fortify_level 0" \
     --undefine _lto_cflags \
     --noclean \
     "pkg/$ID/systemd.spec"
diff --git a/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.conf
index d32eae4952..843b96d9a6 100644
--- a/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.conf
+++ b/mkosi.images/system/mkosi.conf.d/10-centos/mkosi.conf
@@ -5,5 +5,4 @@ Distribution=centos
 
 [Content]
 Packages=
-        kernel-modules # For squashfs support
         rpmautospec-rpm-macros
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
index 3a89e49c5b..a8775d05f1 100755
--- a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
+++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.build.chroot
@@ -46,15 +46,15 @@ build() {
         $( ((WITH_TESTS)) || echo nocheck) \
         $( ((WITH_DOCS)) || echo nodoc) \
         $( ((WITH_DEBUG)) || echo nostrip) \
-        terse
+        terse \
         optimize=-lto \
+        noopt \
     " \
     DEB_BUILD_PROFILES="\
         $( ((WITH_TESTS)) || echo nocheck) \
         $( ((WITH_DOCS)) || echo nodoc) \
         pkg.systemd.upstream \
     " \
-    DEB_CFLAGS_APPEND="-Og" \
     DPKG_FORCE="unsafe-io" \
     DPKG_DEB_COMPRESSOR_TYPE="none" \
     DH_MISSING="--fail-missing" \