diff --git a/.cirrus.yml b/.cirrus.yml
index 23c0be84a5..cbdaf422eb 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -401,6 +401,9 @@ bindings_task:
         server_log_artifacts:
             path: ./podman-server.log
             type: text/plain
+        cleanup_tracer_artifacts:
+            path: ./podman-cleanup-tracer.log
+            type: text/plain
         df_script: '$SCRIPT_BASE/logcollector.sh df'
         audit_log_script: '$SCRIPT_BASE/logcollector.sh audit'
         journal_script: '$SCRIPT_BASE/logcollector.sh journal'
diff --git a/.gitignore b/.gitignore
index d1813cc8fb..1b596b2b44 100644
--- a/.gitignore
+++ b/.gitignore
@@ -57,3 +57,4 @@ contrib/win-installer/shasums
 contrib/win-installer/*.wixobj
 contrib/win-installer/*.wixpdb
 contrib/win-installer/*.log
+podman-cleanup-tracer.log*
diff --git a/contrib/cirrus/runner.sh b/contrib/cirrus/runner.sh
index ea6235eba4..8d4dddd69d 100755
--- a/contrib/cirrus/runner.sh
+++ b/contrib/cirrus/runner.sh
@@ -458,6 +458,15 @@ msg "************************************************************"
 ((${SETUP_ENVIRONMENT:-0})) || \
     die "Expecting setup_environment.sh to have completed successfully"
 
+if [[ "$UID" -eq 0 ]] && ((CONTAINER==0)); then
+    # start ebpf cleanup tracer (#23487)
+    msg "start ebpf cleanup tracer"
+    # replace zero bytes to make the log more readable
+    bpftrace $GOSRC/hack/podman_cleanup_tracer.bt |& \
+        tr '\0' ' ' >$GOSRC/podman-cleanup-tracer.log &
+    TRACER_PID=$!
+fi
+
 # shellcheck disable=SC2154
 if [[ "$PRIV_NAME" == "rootless" ]] && [[ "$UID" -eq 0 ]]; then
     # Remove /var/lib/cni, it is not required for rootless cni.
@@ -499,4 +508,9 @@ fi
 
 showrun $handler
 
+if [[ -n "$TRACER_PID" ]]; then
+    # ignore any error here
+    kill "$TRACER_PID" || true
+fi
+
 showrun echo "finished"