diff --git a/CHANGELOG.md b/CHANGELOG.md
index 87d685f..5b203d7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `LogsDirectory=fips` was added to the packaged systemd units so the capture
   directory is created and cleaned up declaratively.
 
+- `packaging/debian/build-deb.sh --features <list>` builds the `.deb` with a
+  Cargo feature list, which is how an instrumented package is produced for a
+  measurement run. The auto-derived dev Version gains a matching `+<features>`
+  marker, so a feature build and a default build of the same commit are no
+  longer indistinguishable: without it the two carry byte-identical versions,
+  an install of one over the other is an apt no-op, and the running node offers
+  no way to tell which one it has. The marker sorts above the unmarked build, so
+  installing a feature build is an upgrade and reverting to the default build is
+  a downgrade — revert with `dpkg -i` rather than `apt install`. `--features` is
+  refused together with `--no-build`, which would stamp the marker onto binaries
+  the features never reached.
+
 ### Changed
 
 - The Ethernet transport's per-interface `discovery` flag was renamed to
diff --git a/packaging/debian/build-deb.sh b/packaging/debian/build-deb.sh
index 77a302b..188255e 100755
--- a/packaging/debian/build-deb.sh
+++ b/packaging/debian/build-deb.sh
@@ -2,6 +2,7 @@
 # Build a .deb package for FIPS using cargo-deb.
 #
 # Usage: ./build-deb.sh [--target <triple>] [--version <version>] [--no-build]
+#                       [--features <list>]
 #
 # Prerequisites: cargo-deb (install with: cargo install cargo-deb)
 # Output: deploy/fips_<version>_<arch>.deb
@@ -19,6 +20,9 @@ Options:
   --target <triple>   Rust target triple to build/package
   --version <version> Override Debian package version
   --no-build          Package existing binaries without running cargo build
+  --features <list>   Cargo features to build with (comma-separated). Marks the
+                      auto-derived Version so the package is distinguishable
+                      from a default build of the same commit.
   -h, --help          Show this help
 EOF
 }
@@ -26,6 +30,7 @@ EOF
 TARGET_TRIPLE=""
 VERSION_OVERRIDE=""
 NO_BUILD=0
+FEATURES=""
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
@@ -41,6 +46,10 @@ while [[ $# -gt 0 ]]; do
             NO_BUILD=1
             shift
             ;;
+        --features)
+            FEATURES="${2:?missing value for --features}"
+            shift 2
+            ;;
         -h|--help)
             usage
             exit 0
@@ -53,6 +62,16 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
+# A feature build that skips the build step would stamp a feature-marked Version
+# onto whatever binaries already sit in target/, which is the one outcome the
+# marking exists to prevent. Refuse rather than emit a package that misdescribes
+# itself.
+if [[ -n "${FEATURES}" && "${NO_BUILD}" -eq 1 ]]; then
+    echo "--features cannot be combined with --no-build: the features would not" >&2
+    echo "reach the binaries, but the Version would claim they had." >&2
+    exit 1
+fi
+
 cd "${PROJECT_ROOT}"
 
 # Ensure cargo-deb is available
@@ -81,13 +100,33 @@ if [[ -z "${VERSION_OVERRIDE}" ]]; then
         if [[ -n "$(git status --porcelain 2>/dev/null)" ]]; then
             DIRTY_SUFFIX=".dirty"
         fi
-        # Debian Version: <upstream>~dev+git<YYYYMMDD>.<sha>[.dirty]-1
+        # A feature build of a given commit is a different package from the
+        # default build of that same commit, but nothing else in this version
+        # says so: the crate version, the date and the sha are all identical.
+        # Without a marker the two are byte-identical versions, so installing
+        # one over the other is an apt no-op (the very failure the per-commit
+        # version above exists to prevent) and the node offers no way to tell
+        # which one it is running. Underscores and commas are not legal in a
+        # Debian version, so the feature list is folded to dots.
+        FEATURE_SUFFIX=""
+        if [[ -n "${FEATURES}" ]]; then
+            FEATURE_SUFFIX="+$(printf '%s' "${FEATURES}" | tr -c 'a-zA-Z0-9.' '.')"
+        fi
+        # Debian Version: <upstream>~dev+git<YYYYMMDD>.<sha>[.dirty][+<features>]-1
         # The "~" makes every dev build sort BEFORE the eventual tagged
         # release; the date+sha makes consecutive dev builds compare as
         # different versions; the trailing "-1" is the Debian revision.
-        VERSION_OVERRIDE="${BASE_VERSION}~dev+git${GIT_DATE}.${GIT_SHA}${DIRTY_SUFFIX}-1"
+        # The feature suffix sorts ABOVE the unsuffixed build, so installing a
+        # feature build is an upgrade and reverting to the default build is a
+        # downgrade — which apt refuses without being told to, and `dpkg -i`
+        # performs. Revert with `dpkg -i`, not `apt install`.
+        VERSION_OVERRIDE="${BASE_VERSION}~dev+git${GIT_DATE}.${GIT_SHA}${DIRTY_SUFFIX}${FEATURE_SUFFIX}-1"
         echo "Auto-derived dev Version: ${VERSION_OVERRIDE}"
     fi
+elif [[ -n "${FEATURES}" ]]; then
+    echo "Warning: --version was given with --features, so the Version carries no" >&2
+    echo "feature marker and this package is indistinguishable from a default" >&2
+    echo "build of the same commit. Mark it yourself if that matters." >&2
 fi
 
 # Build the .deb package
@@ -105,6 +144,9 @@ fi
 if [[ "${NO_BUILD}" -eq 1 ]]; then
     cargo_args+=(--no-build)
 fi
+if [[ -n "${FEATURES}" ]]; then
+    cargo_args+=(--features "${FEATURES}")
+fi
 cargo "${cargo_args[@]}"
 
 # Move output to deploy/