diff --git a/.github/workflows/go-test.yaml b/.github/workflows/go-test.yaml
index b1afad0c..44eda192 100644
--- a/.github/workflows/go-test.yaml
+++ b/.github/workflows/go-test.yaml
@@ -28,6 +28,11 @@ jobs:
         with:
           go-version: "1.20"
 
+      - name: consider debugging
+        uses: ./.github/workflows/tmate_debug
+        with:
+          use-tmate: ${{ secrets.USE_TMATE }}
+
       - name: setup cluster
         uses: ./.github/workflows/cluster-setup
         with:
@@ -73,7 +78,7 @@ jobs:
       - name: Subvolume command
         run: |
           set -ex
-          kubectl rook-ceph ceph fs subvolume create myfs test-subvol group-a 
+          kubectl rook-ceph ceph fs subvolume create myfs test-subvol group-a
           kubectl rook-ceph subvolume ls
           kubectl rook-ceph subvolume ls --stale
           kubectl rook-ceph subvolume delete test-subvol myfs group-a
@@ -163,6 +168,11 @@ jobs:
         with:
           go-version: "1.20"
 
+      - name: consider debugging
+        uses: ./.github/workflows/tmate_debug
+        with:
+          use-tmate: ${{ secrets.USE_TMATE }}
+
       - name: setup cluster
         uses: ./.github/workflows/cluster-setup
         with:
@@ -210,7 +220,7 @@ jobs:
       - name: Subvolume command
         run: |
           set -ex
-          kubectl rook-ceph --operator-namespace test-operator -n test-cluster ceph fs subvolume create myfs test-subvol group-a 
+          kubectl rook-ceph --operator-namespace test-operator -n test-cluster ceph fs subvolume create myfs test-subvol group-a
           kubectl rook-ceph --operator-namespace test-operator -n test-cluster subvolume ls
           kubectl rook-ceph --operator-namespace test-operator -n test-cluster subvolume ls --stale
           kubectl rook-ceph --operator-namespace test-operator -n test-cluster subvolume delete test-subvol myfs group-a
diff --git a/.github/workflows/tmate_debug/action.yml b/.github/workflows/tmate_debug/action.yml
new file mode 100644
index 00000000..b6a32e5f
--- /dev/null
+++ b/.github/workflows/tmate_debug/action.yml
@@ -0,0 +1,24 @@
+name: "Tmate debugging tests"
+description: "Setup tmate session if the test fails"
+inputs:
+  use-tmate:
+    description: "boolean for enabling TMATE"
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - name: consider debugging
+      shell: bash --noprofile --norc -eo pipefail -x {0}
+      if: runner.debug || contains(github.event.pull_request.labels.*.name, 'debug-ci')
+      run: |
+        # Enable tmate only in the Rook fork, where the USE_TMATE secret is set in the repo, or if the action is re-run
+        if [ "$GITHUB_REPOSITORY_OWNER" = "rook" ] || [ -n "${{ inputs.use-tmate }}" ] || [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
+          echo USE_TMATE=1 >> $GITHUB_ENV
+        fi
+
+    - name: set up tmate session for debugging
+      if: env.USE_TMATE
+      uses: mxschmitt/action-tmate@v3
+      with:
+        limit-access-to-actor: false
+        detached: true