diff --git a/crates/bin/Cargo.toml b/crates/bin/Cargo.toml
index 7d52126a7..71d2aabfe 100644
--- a/crates/bin/Cargo.toml
+++ b/crates/bin/Cargo.toml
@@ -62,6 +62,7 @@ native-tls = ["binstalk/native-tls"]
 trust-dns = ["binstalk/trust-dns"]
 
 zstd-thin = ["binstalk/zstd-thin"]
+cross-lang-fat-lto = ["binstalk/cross-lang-fat-lto"]
 
 fancy-no-backtrace = ["miette/fancy-no-backtrace"]
 fancy-with-backtrace = ["fancy-no-backtrace", "miette/fancy"]
diff --git a/crates/binstalk-downloader/Cargo.toml b/crates/binstalk-downloader/Cargo.toml
index d77cc12e4..b6ac39668 100644
--- a/crates/binstalk-downloader/Cargo.toml
+++ b/crates/binstalk-downloader/Cargo.toml
@@ -69,3 +69,5 @@ native-tls = ["reqwest/native-tls", "trust-dns-resolver?/dns-over-native-tls"]
 trust-dns = ["trust-dns-resolver", "reqwest/trust-dns"]
 
 zstd-thin = ["zstd/thin"]
+
+cross-lang-fat-lto = ["zstd/fat-lto"]
diff --git a/crates/binstalk/Cargo.toml b/crates/binstalk/Cargo.toml
index 8fc3fbedd..a804d1ea2 100644
--- a/crates/binstalk/Cargo.toml
+++ b/crates/binstalk/Cargo.toml
@@ -55,3 +55,4 @@ native-tls = ["binstalk-downloader/native-tls"]
 trust-dns = ["binstalk-downloader/trust-dns"]
 
 zstd-thin = ["binstalk-downloader/zstd-thin"]
+cross-lang-fat-lto = ["binstalk-downloader/cross-lang-fat-lto"]
diff --git a/justfile b/justfile
index a79cfb15f..4edb4bdbb 100644
--- a/justfile
+++ b/justfile
@@ -69,7 +69,7 @@ support-pkg-config := if target == target-host {
 
 cargo-features := trim_end_match(if override-features != "" { override-features
     } else if (cargo-profile / ci-or-no) == "dev/ci" { "rustls,fancy-with-backtrace,zstd-thin,log_release_max_level_debug" + (if support-pkg-config != "" { ",pkg-config" } else { "" }) + extra-features
-    } else if (cargo-profile / ci-or-no) == "release/ci" { "static,rustls,trust-dns,fancy-no-backtrace,zstd-thin,log_release_max_level_debug" + extra-features
+    } else if (cargo-profile / ci-or-no) == "release/ci" { "static,rustls,trust-dns,fancy-no-backtrace,zstd-thin,log_release_max_level_debug" + (if target-os != "macos" { ",cross-lang-fat-lto" } else { "" }) + extra-features
     } else { extra-features
 }, ",")
 
@@ -92,7 +92,16 @@ rustc-miropt := if for-release != "" { " -Z mir-opt-level=4" } else { "" }
 # TODO: There is ongoing effort to stabilise this and we will need to update
 # this once it is merged.
 # https://github.com/rust-lang/compiler-team/issues/510
-rust-lld := if target-os != "windows" { " -Z gcc-ld=lld" } else { "" }
+#
+# If cargo-zigbuild is used, then it will provide the lld linker.
+# This option is disabled on windows since it not supported.
+rust-lld := if use-cargo-zigbuild != "" {
+    ""
+} else if target-os != "windows" {
+    " -Z gcc-ld=lld"
+} else {
+    ""
+}
 
 # ICF: link-time identical code folding
 #
@@ -100,6 +109,16 @@ rust-lld := if target-os != "windows" { " -Z gcc-ld=lld" } else { "" }
 # rust-lld.
 rustc-icf := if for-release != "" { " -C link-arg=-Wl,--icf=safe" } else { "" }
 
+# Only enable linker-plugin-lto for release
+# Also disable this on windows since it uses msvc.
+linker-plugin-lto := if for-release == "" {
+    ""
+} else if target-os == "linux" {
+    "-C linker-plugin-lto "
+} else {
+    ""
+}
+
 target-glibc-ver-postfix := if glibc-version != "" {
     if use-cargo-zigbuild != "" {
         "." + glibc-version
@@ -111,7 +130,7 @@ target-glibc-ver-postfix := if glibc-version != "" {
 }
 
 cargo-build-args := (if for-release != "" { " --release" } else { "" }) + (" --target ") + (target) + (target-glibc-ver-postfix) + (cargo-buildstd) + (if extra-build-args != "" { " " + extra-build-args } else { "" }) + (cargo-no-default-features) + (cargo-split-debuginfo) + (if cargo-features != "" { " --features " + cargo-features } else { "" }) + (win-arm64-ring16)
-export RUSTFLAGS := "-Z share-generics " + (rustc-gcclibs) + (rustc-miropt) + (rust-lld) + (rustc-icf)
+export RUSTFLAGS := "-Z share-generics " + (linker-plugin-lto) + (rustc-gcclibs) + (rustc-miropt) + (rust-lld) + (rustc-icf)
 
 
 # libblocksruntime-dev provides compiler-rt