diff --git a/bazel/toolchains/go_module_deps.bzl b/bazel/toolchains/go_module_deps.bzl
index 7375136464..a91c4cebf5 100644
--- a/bazel/toolchains/go_module_deps.bzl
+++ b/bazel/toolchains/go_module_deps.bzl
@@ -4435,6 +4435,22 @@ def go_dependencies():
         sum = "h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=",
         version = "v1.0.0",
     )
+    go_repository(
+        name = "com_github_samber_lo",
+        build_file_generation = "on",
+        build_file_proto_mode = "disable_global",
+        importpath = "github.com/samber/lo",
+        sum = "h1:j2XEAqXKb09Am4ebOg31SpvzUTTs6EN3VfgeLUhPdXM=",
+        version = "v1.38.1",
+    )
+    go_repository(
+        name = "com_github_samber_slog_multi",
+        build_file_generation = "on",
+        build_file_proto_mode = "disable_global",
+        importpath = "github.com/samber/slog-multi",
+        sum = "h1:6BVH9uHGAsiGkbbtQgAOQJMpKgV8unMrHhhJaw+X1EQ=",
+        version = "v1.0.2",
+    )
     go_repository(
         name = "com_github_sassoftware_relic",
         build_file_generation = "on",
diff --git a/cli/internal/cmd/BUILD.bazel b/cli/internal/cmd/BUILD.bazel
index afccfc643b..8c300b62ad 100644
--- a/cli/internal/cmd/BUILD.bazel
+++ b/cli/internal/cmd/BUILD.bazel
@@ -97,6 +97,7 @@ go_library(
         "@com_github_google_uuid//:uuid",
         "@com_github_mattn_go_isatty//:go-isatty",
         "@com_github_rogpeppe_go_internal//diff",
+        "@com_github_samber_slog_multi//:slog-multi",
         "@com_github_siderolabs_talos_pkg_machinery//config/encoder",
         "@com_github_spf13_afero//:afero",
         "@com_github_spf13_cobra//:cobra",
diff --git a/cli/internal/cmd/apply.go b/cli/internal/cmd/apply.go
index 70d66daa67..ea7679a508 100644
--- a/cli/internal/cmd/apply.go
+++ b/cli/internal/cmd/apply.go
@@ -13,7 +13,9 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"log/slog"
 	"net"
+	"os"
 	"path/filepath"
 	"slices"
 	"strings"
@@ -38,6 +40,7 @@ import (
 	"github.com/edgelesssys/constellation/v2/internal/kms/uri"
 	"github.com/edgelesssys/constellation/v2/internal/semver"
 	"github.com/edgelesssys/constellation/v2/internal/versions"
+	"github.com/samber/slog-multi"
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
@@ -224,6 +227,10 @@ func runApply(cmd *cobra.Command, _ []string) error {
 	}
 
 	fileHandler := file.NewHandler(afero.NewOsFs())
+	logger, err := newDebugFileLogger(cmd, fileHandler)
+	if err != nil {
+		return err
+	}
 
 	newDialer := func(validator atls.Validator) *dialer.Dialer {
 		return dialer.New(nil, validator, &net.Dialer{})
@@ -248,7 +255,7 @@ func runApply(cmd *cobra.Command, _ []string) error {
 	apply := &applyCmd{
 		fileHandler:     fileHandler,
 		flags:           flags,
-		log:             log,
+		log:             logger,
 		wLog:            &warnLogger{cmd: cmd, log: log},
 		spinner:         spinner,
 		merger:          &kubeconfigMerger{log: log},
@@ -858,3 +865,34 @@ type imageFetcher interface {
 		image, region string, useMarketplaceImage bool,
 	) (string, error)
 }
+
+func newDebugFileLogger(cmd *cobra.Command, fileHandler file.Handler) (debugLog, error) {
+	logLvl := slog.LevelInfo
+	debugLog, err := cmd.Flags().GetBool("debug")
+	if err != nil {
+		return nil, err
+	}
+	if debugLog {
+		logLvl = slog.LevelDebug
+	}
+
+	fileWriter := &fileWriter{
+		fileHandler: fileHandler,
+	}
+	return slog.New(
+		slogmulti.Fanout(
+			slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{AddSource: true, Level: logLvl}),           // first handler: stderr at log level
+			slog.NewJSONHandler(fileWriter, &slog.HandlerOptions{AddSource: true, Level: slog.LevelDebug}), // second handler: debug JSON log to file
+		),
+	), nil
+}
+
+type fileWriter struct {
+	fileHandler file.Handler
+}
+
+// Write satisfies the io.Writer interface by writing a message to file.
+func (l *fileWriter) Write(msg []byte) (int, error) {
+	err := l.fileHandler.Write(constants.CLIDebugLogFile, msg, file.OptAppend)
+	return len(msg), err
+}
diff --git a/go.mod b/go.mod
index ab69a22003..4870e40e37 100644
--- a/go.mod
+++ b/go.mod
@@ -111,6 +111,7 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/regclient/regclient v0.5.5
 	github.com/rogpeppe/go-internal v1.11.0
+	github.com/samber/slog-multi v1.0.2
 	github.com/schollz/progressbar/v3 v3.13.1
 	github.com/siderolabs/talos/pkg/machinery v1.4.6
 	github.com/sigstore/rekor v1.2.2
@@ -152,6 +153,8 @@ require (
 	sigs.k8s.io/yaml v1.4.0
 )
 
+require github.com/samber/lo v1.38.1 // indirect
+
 require (
 	cloud.google.com/go v0.110.8 // indirect
 	cloud.google.com/go/iam v1.1.2 // indirect
diff --git a/go.sum b/go.sum
index 3f6789fae1..2f8a184299 100644
--- a/go.sum
+++ b/go.sum
@@ -894,6 +894,10 @@ github.com/rubenv/sql-migrate v1.5.2 h1:bMDqOnrJVV/6JQgQ/MxOpU+AdO8uzYYA/TxFUBzF
 github.com/rubenv/sql-migrate v1.5.2/go.mod h1:H38GW8Vqf8F0Su5XignRyaRcbXbJunSWxs+kmzlg0Is=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/samber/lo v1.38.1 h1:j2XEAqXKb09Am4ebOg31SpvzUTTs6EN3VfgeLUhPdXM=
+github.com/samber/lo v1.38.1/go.mod h1:+m/ZKRl6ClXCE2Lgf3MsQlWfh4bn1bz6CXEOxnEXnEA=
+github.com/samber/slog-multi v1.0.2 h1:6BVH9uHGAsiGkbbtQgAOQJMpKgV8unMrHhhJaw+X1EQ=
+github.com/samber/slog-multi v1.0.2/go.mod h1:uLAvHpGqbYgX4FSL0p1ZwoLuveIAJvBECtE07XmYvFo=
 github.com/sassoftware/relic v7.2.1+incompatible h1:Pwyh1F3I0r4clFJXkSI8bOyJINGqpgjJU3DYAZeI05A=
 github.com/sassoftware/relic v7.2.1+incompatible/go.mod h1:CWfAxv73/iLZ17rbyhIEq3K9hs5w6FpNMdUT//qR+zk=
 github.com/sassoftware/relic/v7 v7.5.5 h1:2ZUM6ovo3STCAp0hZnO9nQY9lOB8OyfneeYIi4YUxMU=
diff --git a/internal/constants/constants.go b/internal/constants/constants.go
index 68d0fd6e22..c313b74a68 100644
--- a/internal/constants/constants.go
+++ b/internal/constants/constants.go
@@ -40,6 +40,8 @@ const (
 	DefaultControlPlaneGroupName = "control_plane_default"
 	// DefaultWorkerGroupName is the name of the default worker node group.
 	DefaultWorkerGroupName = "worker_default"
+	// CLIDebugLogFile is the name of the debug log file for constellation init/constellation apply.
+	CLIDebugLogFile = "constellation-debug.log"
 
 	//
 	// Ports.