diff --git a/.github/workflows/build-and-push.yml b/.github/workflows/build-and-push.yml
index 13ff034..b134d7d 100644
--- a/.github/workflows/build-and-push.yml
+++ b/.github/workflows/build-and-push.yml
@@ -34,14 +34,25 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      # --target is mandatory: the Dockerfile's last stage is the XDebug
+      # variant, so an untargeted build silently publishes XDebug as the
+      # production image.
       - name: Build an image from Dockerfile
         run: |
-          docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-${{matrix.arch}} .
+          docker image build --target final --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-${{matrix.arch}} .
+
+      - name: Build the XDebug variant
+        run: |
+          docker image build --target xdebug --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-xdebug-${{matrix.arch}} .
 
       - name: Push an image
         run: |
           docker image push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-${{matrix.arch}}
 
+      - name: Push the XDebug variant
+        run: |
+          docker image push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-xdebug-${{matrix.arch}}
+
   manifest_build_and_push_on_feature:
     if: github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/')
     needs: build_and_push
@@ -60,10 +71,21 @@ jobs:
               ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-amd64 \
               ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-arm64
 
+      - name: Create XDebug manifest
+        run: |
+            docker manifest create \
+              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-xdebug \
+              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-xdebug-amd64 \
+              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-xdebug-arm64
+
       - name: Push manifest
         run: |
             docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
 
+      - name: Push XDebug manifest
+        run: |
+            docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-xdebug
+
   manifest_build_and_push_on_tag:
     if: startsWith(github.ref, 'refs/tags/')
     needs: build_and_push
@@ -82,6 +104,17 @@ jobs:
               ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-amd64 \
               ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-arm64
 
+      - name: Create XDebug manifest
+        run: |
+            docker manifest create \
+              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}-xdebug \
+              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-xdebug-amd64 \
+              ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-xdebug-arm64
+
       - name: Push manifest
         run: |
             docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}
+
+      - name: Push XDebug manifest
+        run: |
+            docker manifest push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}-xdebug
diff --git a/.github/workflows/dive.yml b/.github/workflows/dive.yml
index fea47d0..a09fd73 100644
--- a/.github/workflows/dive.yml
+++ b/.github/workflows/dive.yml
@@ -18,7 +18,7 @@ jobs:
 
       - name: Build an image from Dockerfile
         run: |
-          docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
+          docker image build --target final --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
 
       - name: Dive
         uses: yuichielectric/dive-action@0.0.4
diff --git a/.github/workflows/structure-test.yml b/.github/workflows/structure-test.yml
index 6a32692..610be9e 100644
--- a/.github/workflows/structure-test.yml
+++ b/.github/workflows/structure-test.yml
@@ -19,10 +19,20 @@ jobs:
 
       - name: Build an image from Dockerfile
         run: |
-          docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
+          docker image build --target final --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
+
+      - name: Build the XDebug variant
+        run: |
+          docker image build --target xdebug --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-xdebug .
 
       - name: Run container structure tests
         uses: plexsystems/container-structure-test-action@v0.1.0
         with:
           image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
           config: tests.yaml
+
+      - name: Run container structure tests for the XDebug variant
+        uses: plexsystems/container-structure-test-action@v0.1.0
+        with:
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-xdebug
+          config: tests-xdebug.yaml
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index b41ee89..510505b 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -28,7 +28,7 @@ jobs:
 
       - name: Build an image from Dockerfile
         run: |
-          docker image build --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
+          docker image build --target final --tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
 
       - name: Run Trivy vulnerability scanner (sarif report)
         uses: aquasecurity/trivy-action@0.35.0
diff --git a/CHANGES.md b/CHANGES.md
index 4bbcdac..d2a7c92 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,5 +1,17 @@
 # CHANGELOG
 
+## Version 1.4.5
+
+### Fix
+
+* Publish the production image instead of the XDebug variant. Every workflow built with `docker image build ... .` and no `--target`, and Docker defaults to the *last* stage — which is `xdebug`. So `appwrite/base` has shipped XDebug in the production image since the variant was introduced in 1.2.0, and Trivy and dive were measuring the wrong image too. All four build workflows now pass an explicit `--target`. The stage order cannot be fixed instead: `xdebug` is `FROM final`, so it must be declared after `final`, which necessarily makes it last — `--target` is the only reliable control.
+
+### Add
+
+* Publish the XDebug variant under `-xdebug` tags (`<sha>-xdebug`, `<tag>-xdebug`, per-arch and manifest). It was documented as a build target since 1.2.0 but never published, so consumers that want XDebug — such as Appwrite's `development` image, which supplies an ini expecting `xdebug.so` to already exist — now have a real image to pin.
+* Wire `tests-xdebug.yaml` into the structure-test workflow. It had existed since 1.2.0 with no workflow consuming it.
+* `tests.yaml` assertion that XDebug is absent. `tests.yaml` only ever asserted module *presence*, so the XDebug image satisfied it and CI stayed green while shipping the wrong image.
+
 ## Version 1.3.2
 
 ### Security
diff --git a/README.md b/README.md
index cb551c6..fd294a9 100644
--- a/README.md
+++ b/README.md
@@ -36,9 +36,13 @@ In order to run this container you'll need the Docker runtime installed.
 
 ## Build
 
+`--target` is required. The XDebug variant derives from `final`, so it has to be
+declared after it, which makes it the last stage — and Docker defaults to the
+last stage. Omitting `--target` therefore builds XDebug, not production.
+
 ```shell
 # Default (production) image
-docker build --no-cache --tag appwrite/base:latest .
+docker build --no-cache --target final --tag appwrite/base:latest .
 
 # XDebug variant
 docker build --no-cache --target xdebug --tag appwrite/base:latest-xdebug .
diff --git a/tests.yaml b/tests.yaml
index 69482b2..f3dc069 100644
--- a/tests.yaml
+++ b/tests.yaml
@@ -78,6 +78,11 @@ commandTests:
       - yaml
       - zlib
       - zstd
+  - name: 'XDebug absent'
+    command: "php"
+    args: ["-m"]
+    excludedOutput:
+      - xdebug
   - name: 'PHP GD supported formats'
     command: "php"
     args: ["-i"]