diff --git a/.github/workflows/debug.yml b/.github/workflows/debug.yml
new file mode 100644
index 000000000..7ca42634c
--- /dev/null
+++ b/.github/workflows/debug.yml
@@ -0,0 +1,55 @@
+# Debugging workflows to run on-runner to debug issues that are isolated
+# to GitHub Actions workflow runs.
+name: Debug
+
+on:
+  pull_request:
+    branches: [ main, maint/* ]
+  workflow_dispatch:
+
+jobs:
+  debug:
+    strategy:
+      matrix:
+        platform:
+        - name: "Windows"
+          os: windows-2022
+          setup-script: win32
+          env:
+            ARCH: amd64
+            CMAKE_GENERATOR: Visual Studio 17 2022
+            CMAKE_OPTIONS: -A x64 -DDEBUG_LEAK_CHECKER=win32 -DUSE_HTTPS=Schannel -DUSE_SSH=ON -DCMAKE_PREFIX_PATH=D:\Temp\libssh2
+            BUILD_PATH: C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files (x86)\CMake\bin;D:\Temp\libssh2\bin
+            BUILD_TEMP: D:\Temp
+      fail-fast: false
+    env: ${{ matrix.platform.env }}
+    runs-on: ${{ matrix.platform.os }}
+    name: "Build: ${{ matrix.platform.name }}"
+    steps:
+    - name: Check out repository
+      uses: actions/checkout@v4
+      with:
+        path: source
+        fetch-depth: 0
+    - name: Set up build environment
+      run: source/ci/setup-${{ matrix.platform.setup-script }}-build.sh
+      shell: bash
+      if: matrix.platform.setup-script != ''
+    - name: Set up QEMU
+      run: docker run --rm --privileged multiarch/qemu-user-static:register --reset
+      if: matrix.platform.container.qemu == true
+    - name: Prepare build
+      run: mkdir build
+    - name: Build
+      uses: ./source/.github/actions/run-build
+      with:
+        command: cd ${BUILD_WORKSPACE:-.}/build && ../source/ci/build.sh
+        container: ${{ matrix.platform.container.name }}
+        container-version: ${{ env.docker-registry-container-sha }}
+        shell: ${{ matrix.platform.shell }}
+        cmake-global-options: -DDEPRECATE_HARD=ON -DENABLE_WERROR=ON -DBUILD_EXAMPLES=ON -DBUILD_FUZZERS=ON -DUSE_STANDALONE_FUZZERS=ON
+    - name: Set up SSH
+      uses: owenthereal/action-upterm@v1
+      with:
+        limit-access-to-actor: true
+        limit-access-to-users: ethomson