diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 07044197..f02c190c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -122,6 +122,29 @@ jobs:
       excludes: ${{inputs.excludes}}
       includes: ${{inputs.includes}}
 
+  valgrind:
+    if: >
+      !contains(inputs.head_msg, '[ci only it]')
+      && contains(fromJSON(inputs.cargo_profiles), fromJSON('["bench"]')[0])
+      && contains(fromJSON(inputs.feat_sets), fromJSON('["all"]')[0])
+      && contains(fromJSON(inputs.rust_toolchains), fromJSON('["nightly"]')[0])
+      && contains(fromJSON(inputs.sys_targets), fromJSON('["x86_64-v3-linux-gnu"]')[0])
+
+    name: Memcheck
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["integration-valgrind"]'
+      cargo_profiles: '["bench"]'
+      feat_sets: '["all"]'
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{inputs.sys_names}}
+      sys_versions: ${{inputs.sys_versions}}
+      rust_targets: ${{inputs.rust_targets}}
+      sys_targets: '["x86_64-v3-linux-gnu"]'
+      machines: ${{inputs.machines}}
+      excludes: ${{inputs.excludes}}
+      includes: ${{inputs.includes}}
+
   smoke:
     if: >
       !failure() && !cancelled()
@@ -152,6 +175,7 @@ jobs:
           {"cargo_profile": "test", "rust_target": "aarch64-unknown-linux-gnu"},
           {"cargo_profile": "test", "sys_target": "x86_64-v2-linux-gnu"},
           {"cargo_profile": "test", "sys_target": "x86_64-v3-linux-gnu"},
+          {"cargo_profile": "test", "bake_target": "smoke-valgrind"},
           {"cargo_profile": "bench"},
           {"cargo_profile": "release", "rust_toolchain": "nightly"},
           {"cargo_profile": "release", "rust_toolchain": "stable", "feat_set": "none"},
diff --git a/docker/Dockerfile.cargo b/docker/Dockerfile.cargo
index eb255fa6..224853fb 100644
--- a/docker/Dockerfile.cargo
+++ b/docker/Dockerfile.cargo
@@ -16,6 +16,7 @@ ARG CARGO_TERM_VERBOSE=0
 ARG RUST_BACKTRACE
 ARG JEMALLOC_OVERRIDE
 ARG ROCKSDB_LIB_DIR
+ARG VALGRINDFLAGS=""
 ARG CARGO_BUILD_RUSTFLAGS
 ARG CARGO_PROFILE_TEST_DEBUG
 ARG CARGO_PROFILE_TEST_INCREMENTAL
@@ -47,6 +48,7 @@ ENV CARGO_TERM_VERBOSE="${CARGO_TERM_VERBOSE}"
 ENV RUST_BACKTRACE="${RUST_BACKTRACE}"
 ENV JEMALLOC_OVERRIDE="${JEMALLOC_OVERRIDE}"
 ENV ROCKSDB_LIB_DIR="${ROCKSDB_LIB_DIR}"
+ENV VALGRINDFLAGS="${VALGRINDFLAGS}"
 ENV CARGO_PROFILE_TEST_DEBUG="${CARGO_PROFILE_TEST_DEBUG}"
 ENV CARGO_PROFILE_TEST_INCREMENTAL="${CARGO_PROFILE_TEST_INCREMENTAL}"
 ENV CARGO_PROFILE_BENCH_DEBUG="${CARGO_PROFILE_BENCH_DEBUG}"
@@ -74,6 +76,7 @@ RUN \
 --mount=type=cache,dst=${targ_targ_dir}/.fingerprint,id=${cargo_target_share}/fingerprint,sharing=locked \
 <<EOF
     set -eux
+    ulimit -n 65535
     rustup run ${rust_toolchain} \
         cargo ${cargo_cmd} \
             --verbose \
@@ -87,7 +90,7 @@ RUN \
             "--manifest-path=Cargo.toml" \
             ${recipe_args} \
             ${color_args} \
-            $cargo_args
+            ${cargo_args}
 
     # If this image is further reused with other cargo commands, all
     # modifications made by cargo chef cook outside of target-dir have to be
diff --git a/docker/bake.hcl b/docker/bake.hcl
index 93663d21..c8b8208b 100644
--- a/docker/bake.hcl
+++ b/docker/bake.hcl
@@ -470,6 +470,25 @@ target "matrix-rust-sdk-integration" {
     }
 }
 
+target "integration-valgrind" {
+    name = elem("integration-valgrind", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    tags = [
+        elem_tag("integration-valgrind", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
+    ]
+    matrix = cargo_rust_feat_sys
+    inherits = [
+        elem("integration", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+    ]
+    contexts = {
+        input = elem("target:integration", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    }
+    args = {
+        VALGRINDFLAGS = "--error-exitcode=1 --exit-on-first-error=yes --undef-value-errors=no --leak-check=no"
+        cargo_cmd = "valgrind test"
+        cargo_args = "--test=*"
+    }
+}
+
 target "integration" {
     name = elem("integration", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     tags = [
@@ -597,6 +616,26 @@ target "tests-smoke" {
 # Unit tests
 #
 
+target "unit-valgrind" {
+    name = elem("unit-valgrind", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    tags = [
+        elem_tag("unit-valgrind", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
+    ]
+    target = "cargo"
+    matrix = cargo_rust_feat_sys
+    inherits = [
+        elem("unit", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+    ]
+    contexts = {
+        input = elem("target:unit", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    }
+    args = {
+        VALGRINDFLAGS = "--error-exitcode=1 --exit-on-first-error=yes --undef-value-errors=no --leak-check=no"
+        cargo_cmd = "valgrind test"
+        cargo_args = "--lib --bins"
+    }
+}
+
 target "unit" {
     name = elem("unit", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     tags = [
@@ -1636,11 +1675,12 @@ rustup_components = [
 ]
 
 cargo_installs = [
-    "cargo-chef",
     "cargo-audit",
-    "cargo-deb",
     #"cargo-arch",
+    "cargo-chef",
+    "cargo-deb",
     "cargo-generate-rpm",
+    "cargo-valgrind",
     #"lychee",
     "mdbook",
     "typos-cli",
@@ -1737,6 +1777,7 @@ kitchen_packages = [
     "openssl",
     "pkg-config",
     "pkgconf",
+    "valgrind",
     "xz-utils",
 ]