diff --git a/cilium/dctest/upstream.yaml b/cilium/dctest/upstream.yaml
index 29caf9942..dc4eb7b96 100644
--- a/cilium/dctest/upstream.yaml
+++ b/cilium/dctest/upstream.yaml
@@ -56,7 +56,7 @@ data:
   labels: " k8s:app k8s:io\\.cilium\\.k8s\\.namespace\\.labels\\.team k8s:io\\.kubernetes\\.pod\\.namespace k8s:k8s-app io\\.cilium\\.k8s\\.policy cybozu\\.io/family app\\.cybozu\\.io neco\\.cybozu\\.io\\/registry identity\\.neco\\.cybozu\\.io "
 
   # If you want to run cilium in debug mode change this value to true
-  debug: "false"
+  debug: "true"
   debug-verbose: ""
   # The agent can be put into the following three policy enforcement modes
   # default, always and never.
@@ -828,7 +828,7 @@ spec:
         prometheus.io/port: "9962"
         prometheus.io/scrape: "true"
         # ensure pods roll when configmap updates
-        cilium.io/cilium-configmap-checksum: "015d0c430aff9b337ca0f42115b1f7fd0b9c1e871001aef285870a8f7482f6fa"
+        cilium.io/cilium-configmap-checksum: "33be80dd0e19503940a9cb85c0179b11c6e51ec201d6f03e786315ec8fd53532"
         # Set app AppArmor's profile to "unconfined". The value of this annotation
         # can be modified as long users know which profiles they have available
         # in AppArmor.
@@ -1300,7 +1300,7 @@ spec:
     metadata:
       annotations:
         # ensure pods roll when configmap updates
-        cilium.io/cilium-configmap-checksum: "015d0c430aff9b337ca0f42115b1f7fd0b9c1e871001aef285870a8f7482f6fa"
+        cilium.io/cilium-configmap-checksum: "33be80dd0e19503940a9cb85c0179b11c6e51ec201d6f03e786315ec8fd53532"
         prometheus.io/port: "9963"
         prometheus.io/scrape: "true"
       labels:
@@ -1452,6 +1452,7 @@ spec:
             - hubble-relay
           args:
             - serve
+            - --debug
           ports:
             - name: grpc
               containerPort: 4245
@@ -1552,6 +1553,7 @@ spec:
               # the values used in past runs by inspecting the completed pod.
               args:
                 - "--cilium-namespace=kube-system"
+                - "--debug"
                 - "--ca-generate"
                 - "--ca-reuse-secret"
                 - "--hubble-server-cert-generate"
@@ -1602,6 +1604,7 @@ spec:
           # the values used in past runs by inspecting the completed pod.
           args:
             - "--cilium-namespace=kube-system"
+            - "--debug"
             - "--ca-generate"
             - "--ca-reuse-secret"
             - "--hubble-server-cert-generate"
diff --git a/cilium/dctest/values.yaml b/cilium/dctest/values.yaml
index aa43faba7..a97d3bb21 100644
--- a/cilium/dctest/values.yaml
+++ b/cilium/dctest/values.yaml
@@ -15,6 +15,8 @@ cni:
   customConf: true
 conntrackGCMaxInterval: 30m
 datapathMode: "veth"
+debug:
+  enabled: true
 devices: "eth+ eno1+ eno2+"
 enableIPv4Masquerade: false
 enableIdentityMark: false
diff --git a/cilium/pre/upstream.yaml b/cilium/pre/upstream.yaml
index 5603a1c1f..467f17817 100644
--- a/cilium/pre/upstream.yaml
+++ b/cilium/pre/upstream.yaml
@@ -56,7 +56,7 @@ data:
   labels: " k8s:app k8s:io\\.cilium\\.k8s\\.namespace\\.labels\\.team k8s:io\\.kubernetes\\.pod\\.namespace k8s:k8s-app io\\.cilium\\.k8s\\.policy cybozu\\.io/family app\\.cybozu\\.io neco\\.cybozu\\.io\\/registry identity\\.neco\\.cybozu\\.io "
 
   # If you want to run cilium in debug mode change this value to true
-  debug: "false"
+  debug: "true"
   debug-verbose: ""
   # The agent can be put into the following three policy enforcement modes
   # default, always and never.
@@ -828,7 +828,7 @@ spec:
         prometheus.io/port: "9962"
         prometheus.io/scrape: "true"
         # ensure pods roll when configmap updates
-        cilium.io/cilium-configmap-checksum: "015d0c430aff9b337ca0f42115b1f7fd0b9c1e871001aef285870a8f7482f6fa"
+        cilium.io/cilium-configmap-checksum: "33be80dd0e19503940a9cb85c0179b11c6e51ec201d6f03e786315ec8fd53532"
         # Set app AppArmor's profile to "unconfined". The value of this annotation
         # can be modified as long users know which profiles they have available
         # in AppArmor.
@@ -1302,7 +1302,7 @@ spec:
     metadata:
       annotations:
         # ensure pods roll when configmap updates
-        cilium.io/cilium-configmap-checksum: "015d0c430aff9b337ca0f42115b1f7fd0b9c1e871001aef285870a8f7482f6fa"
+        cilium.io/cilium-configmap-checksum: "33be80dd0e19503940a9cb85c0179b11c6e51ec201d6f03e786315ec8fd53532"
         prometheus.io/port: "9963"
         prometheus.io/scrape: "true"
       labels:
@@ -1454,6 +1454,7 @@ spec:
             - hubble-relay
           args:
             - serve
+            - --debug
           ports:
             - name: grpc
               containerPort: 4245
@@ -1554,6 +1555,7 @@ spec:
               # the values used in past runs by inspecting the completed pod.
               args:
                 - "--cilium-namespace=kube-system"
+                - "--debug"
                 - "--ca-generate"
                 - "--ca-reuse-secret"
                 - "--hubble-server-cert-generate"
@@ -1604,6 +1606,7 @@ spec:
           # the values used in past runs by inspecting the completed pod.
           args:
             - "--cilium-namespace=kube-system"
+            - "--debug"
             - "--ca-generate"
             - "--ca-reuse-secret"
             - "--hubble-server-cert-generate"
diff --git a/cilium/pre/values.yaml b/cilium/pre/values.yaml
index eedabb8d9..9326f2f2c 100644
--- a/cilium/pre/values.yaml
+++ b/cilium/pre/values.yaml
@@ -15,6 +15,8 @@ cni:
   customConf: true
 conntrackGCMaxInterval: 30m
 datapathMode: "veth"
+debug:
+  enabled: true
 devices: "eth+ eno1+ eno2+"
 enableIPv4Masquerade: false
 enableIdentityMark: false
diff --git a/etc/cilium-dctest.yaml b/etc/cilium-dctest.yaml
index 9716a0f5e..b204c54fb 100644
--- a/etc/cilium-dctest.yaml
+++ b/etc/cilium-dctest.yaml
@@ -557,7 +557,7 @@ data:
   cnp-node-status-gc-interval: 0s
   conntrack-gc-max-interval: 30m
   custom-cni-conf: "true"
-  debug: "false"
+  debug: "true"
   debug-verbose: ""
   devices: eth+ eno1+ eno2+
   direct-routing-device: e+
@@ -764,7 +764,7 @@ spec:
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: 015d0c430aff9b337ca0f42115b1f7fd0b9c1e871001aef285870a8f7482f6fa
+        cilium.io/cilium-configmap-checksum: 33be80dd0e19503940a9cb85c0179b11c6e51ec201d6f03e786315ec8fd53532
         prometheus.io/port: "9963"
         prometheus.io/scrape: "true"
       labels:
@@ -905,6 +905,7 @@ spec:
       containers:
       - args:
         - serve
+        - --debug
         command:
         - hubble-relay
         image: ghcr.io/cybozu/hubble-relay:1.14.14.1
@@ -1000,6 +1001,7 @@ spec:
           containers:
           - args:
             - --cilium-namespace=kube-system
+            - --debug
             - --ca-generate
             - --ca-reuse-secret
             - --hubble-server-cert-generate
@@ -1054,7 +1056,7 @@ spec:
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: 015d0c430aff9b337ca0f42115b1f7fd0b9c1e871001aef285870a8f7482f6fa
+        cilium.io/cilium-configmap-checksum: 33be80dd0e19503940a9cb85c0179b11c6e51ec201d6f03e786315ec8fd53532
         container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined
         container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined
         prometheus.io/port: "9962"
@@ -1479,6 +1481,7 @@ spec:
       containers:
       - args:
         - --cilium-namespace=kube-system
+        - --debug
         - --ca-generate
         - --ca-reuse-secret
         - --hubble-server-cert-generate
diff --git a/etc/cilium-pre.yaml b/etc/cilium-pre.yaml
index 37b91ae8e..91c88ec10 100644
--- a/etc/cilium-pre.yaml
+++ b/etc/cilium-pre.yaml
@@ -557,7 +557,7 @@ data:
   cnp-node-status-gc-interval: 0s
   conntrack-gc-max-interval: 30m
   custom-cni-conf: "true"
-  debug: "false"
+  debug: "true"
   debug-verbose: ""
   devices: eth+ eno1+ eno2+
   direct-routing-device: e+
@@ -764,7 +764,7 @@ spec:
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: 015d0c430aff9b337ca0f42115b1f7fd0b9c1e871001aef285870a8f7482f6fa
+        cilium.io/cilium-configmap-checksum: 33be80dd0e19503940a9cb85c0179b11c6e51ec201d6f03e786315ec8fd53532
         prometheus.io/port: "9963"
         prometheus.io/scrape: "true"
       labels:
@@ -905,6 +905,7 @@ spec:
       containers:
       - args:
         - serve
+        - --debug
         command:
         - hubble-relay
         image: ghcr.io/cybozu/hubble-relay:1.14.14.1
@@ -1000,6 +1001,7 @@ spec:
           containers:
           - args:
             - --cilium-namespace=kube-system
+            - --debug
             - --ca-generate
             - --ca-reuse-secret
             - --hubble-server-cert-generate
@@ -1054,7 +1056,7 @@ spec:
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: 015d0c430aff9b337ca0f42115b1f7fd0b9c1e871001aef285870a8f7482f6fa
+        cilium.io/cilium-configmap-checksum: 33be80dd0e19503940a9cb85c0179b11c6e51ec201d6f03e786315ec8fd53532
         container.apparmor.security.beta.kubernetes.io/cilium-agent: unconfined
         container.apparmor.security.beta.kubernetes.io/clean-cilium-state: unconfined
         prometheus.io/port: "9962"
@@ -1481,6 +1483,7 @@ spec:
       containers:
       - args:
         - --cilium-namespace=kube-system
+        - --debug
         - --ca-generate
         - --ca-reuse-secret
         - --hubble-server-cert-generate