diff --git a/internal/command/controller/run.go b/internal/command/controller/run.go
index 7987d56..8e111bb 100644
--- a/internal/command/controller/run.go
+++ b/internal/command/controller/run.go
@@ -17,6 +17,7 @@ var ErrRunFailed = errors.New("failed to run controller")
 var BootstrapAdminAccountName = "bootstrap-admin"
 
 var address string
+var debug bool
 
 func newRunCommand() *cobra.Command {
 	cmd := &cobra.Command{
@@ -31,6 +32,7 @@ func newRunCommand() *cobra.Command {
 	}
 
 	cmd.PersistentFlags().StringVarP(&address, "listen", "l", fmt.Sprintf(":%s", port), "address to listen on")
+	cmd.PersistentFlags().BoolVar(&debug, "debug", false, "enable debug logging")
 
 	// flags for auto-init if necessary
 	// this simplifies the user experience to run the controller in serverless environments
@@ -46,7 +48,11 @@ func newRunCommand() *cobra.Command {
 
 func runController(cmd *cobra.Command, args []string) (err error) {
 	// Initialize the logger
-	logger, err := zap.NewProduction()
+	zapConfig := zap.NewProductionConfig()
+	if debug {
+		zapConfig.Level = zap.NewAtomicLevelAt(zap.DebugLevel)
+	}
+	logger, err := zapConfig.Build()
 	if err != nil {
 		return err
 	}
@@ -56,6 +62,12 @@ func runController(cmd *cobra.Command, args []string) (err error) {
 		}
 	}()
 
+	// Redirect standard's library package-global logger
+	// to our zap logger at debug level
+	if _, err := zap.RedirectStdLogAt(logger, zap.DebugLevel); err != nil {
+		return err
+	}
+
 	// Instantiate a data directory and ensure it's initialized
 	dataDir, err := controller.NewDataDir(dataDirPath)
 	if err != nil {
diff --git a/internal/command/worker/run.go b/internal/command/worker/run.go
index 637a3f8..81be0bd 100644
--- a/internal/command/worker/run.go
+++ b/internal/command/worker/run.go
@@ -22,6 +22,7 @@ var bootstrapTokenRaw string
 var logFilePath string
 var stringToStringResources map[string]string
 var noPKI bool
+var debug bool
 
 func newRunCommand() *cobra.Command {
 	cmd := &cobra.Command{
@@ -41,6 +42,7 @@ func newRunCommand() *cobra.Command {
 		"do not use the host's root CA set and instead validate the Controller's presented "+
 			"certificate using a bootstrap token (or manually via fingerprint, "+
 			"if no bootstrap token is provided)")
+	cmd.PersistentFlags().BoolVar(&debug, "debug", false, "enable debug logging")
 
 	return cmd
 }
@@ -89,7 +91,6 @@ func runWorker(cmd *cobra.Command, args []string) (err error) {
 	if err != nil {
 		return err
 	}
-
 	defer func() {
 		if syncErr := logger.Sync(); syncErr != nil && err == nil {
 			err = syncErr
@@ -109,8 +110,16 @@ func runWorker(cmd *cobra.Command, args []string) (err error) {
 }
 
 func createLogger() (*zap.Logger, error) {
+	level := zap.InfoLevel
+	if debug {
+		level = zap.DebugLevel
+	}
+
 	if logFilePath == "" {
-		return zap.NewProduction()
+		zapConfig := zap.NewProductionConfig()
+		zapConfig.Level = zap.NewAtomicLevelAt(level)
+
+		return zapConfig.Build()
 	}
 
 	logFileWriter := zapcore.AddSync(&lumberjack.Logger{
@@ -120,7 +129,7 @@ func createLogger() (*zap.Logger, error) {
 	core := zapcore.NewCore(
 		zapcore.NewJSONEncoder(zap.NewProductionEncoderConfig()),
 		logFileWriter,
-		zap.InfoLevel,
+		level,
 	)
 	return zap.New(core), nil
 }