diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index aa2e3027..65f802a4 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -82,6 +82,7 @@ stages:
   variables:
     BUILD_OS: debian
     LLVM_VERSION: 15
+    # If you upgrade from bookworm, see the use_tls=0 notes in tests/meson.build.
     FDO_DISTRIBUTION_VERSION: bookworm
     FDO_DISTRIBUTION_EXEC: 'env FDO_CI_CONCURRENT=${FDO_CI_CONCURRENT} BUILD_ARCH=${BUILD_ARCH} KERNEL_IMAGE=${KERNEL_IMAGE} KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG} LLVM_VERSION=${LLVM_VERSION} FDO_DISTRIBUTION_VERSION=${FDO_DISTRIBUTION_VERSION} bash .gitlab-ci/debian-install.sh'
 
diff --git a/.gitlab-ci/leak-sanitizer.supp b/.gitlab-ci/leak-sanitizer.supp
index 769827dd..f6954ced 100644
--- a/.gitlab-ci/leak-sanitizer.supp
+++ b/.gitlab-ci/leak-sanitizer.supp
@@ -4,3 +4,9 @@
 # fontconfig library because turning off fast unwind -- required to catch other
 # originating leaks from fontconfig; would stall our tests timing them out.
 leak:libfontconfig
+
+# Workarounds for the LeakSanitizer use_tls=0 workaround,
+# see tests/meson.build
+leak:wl_shm_buffer_begin_access
+leak:g_malloc0
+leak:/ld-*.so*
diff --git a/tests/meson.build b/tests/meson.build
index a62c595f..7119245c 100644
--- a/tests/meson.build
+++ b/tests/meson.build
@@ -420,9 +420,14 @@ configure_file(output: 'test-config.h', configuration: test_config_h)
 
 test_env = {}
 
-# there are some leaks in fontconfig we can't fix; 
+# there are some leaks in fontconfig we can't fix;
+# use_tls=0 is a workaround for LeakSanitizer crashing after successful
+# program exit when it scans for leaks. Due to use_tls=0 even more
+# suppressions had to be added.
+# TODO XXX: Try to revert the addition of use_tls=0 when our CI image
+# upgrades from Debian Bookworm to something more recent.
 if get_option('b_sanitize') in ['address', 'address,undefined' ]
-  test_env += { 'LSAN_OPTIONS': 'suppressions=@0@'.format(dir_gitlab_ci / 'leak-sanitizer.supp') }
+  test_env += { 'LSAN_OPTIONS': 'use_tls=0:suppressions=@0@'.format(dir_gitlab_ci / 'leak-sanitizer.supp') }
 endif
 
 foreach t : tests