diff --git a/pkgs/tools/networking/badvpn/default.nix b/pkgs/tools/networking/badvpn/default.nix
index 64f669a480e..e11d454154b 100644
--- a/pkgs/tools/networking/badvpn/default.nix
+++ b/pkgs/tools/networking/badvpn/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, cmake, openssl, nss, pkgconfig, nspr, bash}:
+{stdenv, fetchurl, cmake, openssl, nss, pkgconfig, nspr, bash, debug ? false}:
 let
   s = # Generated upstream information
   rec {
@@ -12,6 +12,7 @@ let
   buildInputs = [
     cmake openssl nss pkgconfig nspr
   ];
+  compileFlags = "-O3 ${stdenv.lib.optionalString (!debug) "-DNDEBUG"}";
 in
 stdenv.mkDerivation {
   inherit (s) name version;
@@ -23,6 +24,7 @@ stdenv.mkDerivation {
   preConfigure = ''
     find . -name '*.sh' -exec sed -e 's@#!/bin/sh@${stdenv.shell}@' -i '{}' ';'
     find . -name '*.sh' -exec sed -e 's@#!/bin/bash@${bash}/bin/bash@' -i '{}' ';'
+    cmakeFlagsArray=("-DCMAKE_BUILD_TYPE=" "-DCMAKE_C_FLAGS=${compileFlags}");
   '';
 
   meta = {