diff --git a/.golangci.yml b/.golangci.yml
index 70c9dee..9f41278 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -14,6 +14,7 @@ issues:
   # List of regexps of issue texts to exclude, empty list by default.
   exclude:
     - Using the variable on range scope `tc` in function literal
+    - "G108: Profiling endpoint is automatically exposed on /debug/pprof"
 run:
   deadline: 2m
   skip-dirs:
diff --git a/main.go b/main.go
index 876f53b..6546339 100644
--- a/main.go
+++ b/main.go
@@ -18,6 +18,8 @@ package main
 
 import (
 	"flag"
+	"net/http"
+	_ "net/http/pprof"
 	"os"
 	"time"
 
@@ -54,6 +56,7 @@ func main() {
 		enableLeaderElection bool
 		syncPeriod           time.Duration
 		watchNamespace       string
+		profilerAddress      string
 	)
 
 	flag.StringVar(
@@ -91,10 +94,24 @@ func main() {
 		"Namespace that the controller watches to reconcile cluster-api objects. If unspecified, the controller watches for cluster-api objects across all namespaces.",
 	)
 
+	flag.StringVar(
+		&profilerAddress,
+		"profiler-address",
+		"",
+		"Bind address to expose the pprof profiler (e.g. localhost:6060)",
+	)
+
 	flag.Parse()
 
 	ctrl.SetLogger(klogr.New())
 
+	if profilerAddress != "" {
+		klog.Infof("Profiler listening for requests at %s", profilerAddress)
+		go func() {
+			klog.Info(http.ListenAndServe(profilerAddress, nil))
+		}()
+	}
+
 	if controllers.DefaultTokenTTL-syncPeriod < 1*time.Minute {
 		setupLog.Info("warning: the sync interval is close to the configured token TTL, tokens may expire temporarily before being refreshed")
 	}