diff --git a/Cargo.toml b/Cargo.toml
index 369c4655..3b7c34b5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -163,6 +163,20 @@ debug = "line-tables-only"
 [profile.test]
 debug = "line-tables-only"
 
+# `lto` and one codegen unit are what actually ship: this is what runs on the
+# public internet, built once and run for months, so the extra link time is
+# worth a smaller and faster binary. `strip` drops the symbols that buys.
+#
+# `overflow-checks` stays on despite the profile's default of off. The CBOR,
+# CAR and WAL frame parsers do length and offset arithmetic on bytes read
+# straight off the network, and a silent wraparound there is a correctness
+# bug, not a slow path worth optimizing away.
+[profile.release]
+lto = "fat"
+codegen-units = 1
+strip = true
+overflow-checks = true
+
 [workspace.lints.rust]
 missing_docs = "warn"