diff --git a/rust/windows-client/README.md b/rust/windows-client/README.md
index c8e549f88..957b1bda0 100644
--- a/rust/windows-client/README.md
+++ b/rust/windows-client/README.md
@@ -40,8 +40,8 @@ From this dir:
 RUST_LOG=info,firezone_windows_client=debug cargo tauri dev
 
 # You can call debug subcommands on the exe from this directory too
-# e.g. this is equivalent to `cargo run -- debug`
-cargo tauri dev -- -- debug
+# e.g. this is equivalent to `cargo run -- debug hostname`
+cargo tauri dev -- -- debug hostname
 
 # The exe is up in the workspace
 stat ../target/debug/firezone-windows-client.exe
diff --git a/rust/windows-client/src-tauri/src/client.rs b/rust/windows-client/src-tauri/src/client.rs
index 18cfbe979..8fb5fcbb6 100644
--- a/rust/windows-client/src-tauri/src/client.rs
+++ b/rust/windows-client/src-tauri/src/client.rs
@@ -110,14 +110,7 @@ pub(crate) fn run() -> Result<()> {
             }
         }
         Some(Cmd::CrashHandlerServer) => crash_handling::server(),
-        Some(Cmd::Debug) => {
-            println!("debug");
-            Ok(())
-        }
-        Some(Cmd::DebugCrash) => debug_commands::crash(),
-        Some(Cmd::DebugHostname) => debug_commands::hostname(),
-        Some(Cmd::DebugNetworkChanges) => network_changes::run_debug(),
-        Some(Cmd::DebugWintun) => debug_commands::wintun(cli),
+        Some(Cmd::Debug { command }) => debug_commands::run(command),
         // If we already tried to elevate ourselves, don't try again
         Some(Cmd::Elevated) => gui::run(GuiParams {
             crash_on_purpose: cli.crash_on_purpose,
@@ -134,23 +127,22 @@ pub(crate) fn run() -> Result<()> {
 
 #[derive(Parser)]
 #[command(author, version, about, long_about = None)]
-pub struct Cli {
+struct Cli {
     #[command(subcommand)]
-    pub command: Option<Cmd>,
+    command: Option<Cmd>,
     #[arg(long, hide = true)]
-    pub crash_on_purpose: bool,
+    crash_on_purpose: bool,
     #[arg(long, hide = true)]
-    pub inject_faults: bool,
+    inject_faults: bool,
 }
 
 #[derive(clap::Subcommand)]
 pub enum Cmd {
     CrashHandlerServer,
-    Debug,
-    DebugCrash,
-    DebugHostname,
-    DebugNetworkChanges,
-    DebugWintun,
+    Debug {
+        #[command(subcommand)]
+        command: debug_commands::Cmd,
+    },
     Elevated,
     OpenDeepLink(DeepLink),
 }
diff --git a/rust/windows-client/src-tauri/src/client/debug_commands.rs b/rust/windows-client/src-tauri/src/client/debug_commands.rs
index 6c7c7bb93..63a4bd3ae 100644
--- a/rust/windows-client/src-tauri/src/client/debug_commands.rs
+++ b/rust/windows-client/src-tauri/src/client/debug_commands.rs
@@ -1,10 +1,26 @@
 //! CLI subcommands used to test features / dependencies before integrating
 //! them with the GUI, or to exercise features programmatically.
 
-use crate::client::Cli;
 use anyhow::Result;
 
-pub fn crash() -> Result<()> {
+#[derive(clap::Subcommand)]
+pub enum Cmd {
+    Crash,
+    Hostname,
+    NetworkChanges,
+    Wintun,
+}
+
+pub fn run(cmd: Cmd) -> Result<()> {
+    match cmd {
+        Cmd::Crash => crash(),
+        Cmd::Hostname => hostname(),
+        Cmd::NetworkChanges => crate::client::network_changes::run_debug(),
+        Cmd::Wintun => wintun(),
+    }
+}
+
+fn crash() -> Result<()> {
     // `_` doesn't seem to work here, the log files end up empty
     let _handles = crate::client::logging::setup("debug")?;
     tracing::info!("started log (DebugCrash)");
@@ -12,7 +28,7 @@ pub fn crash() -> Result<()> {
     panic!("purposely crashing to see if it shows up in logs");
 }
 
-pub fn hostname() -> Result<()> {
+fn hostname() -> Result<()> {
     println!(
         "{:?}",
         hostname::get().ok().and_then(|x| x.into_string().ok())
@@ -20,7 +36,7 @@ pub fn hostname() -> Result<()> {
     Ok(())
 }
 
-pub fn wintun(_: Cli) -> Result<()> {
+fn wintun() -> Result<()> {
     tracing_subscriber::fmt::init();
 
     if crate::client::elevation::check()? {