diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index ef84a163..865a5875 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -166,6 +166,14 @@ jobs:
     with:
       config: CC=g++ C_EXTRA_FLAGS="-Werror=narrowing"
 
+  # The same C++ build with --enable-debug, which adds the debug-only test
+  # hooks and the tests that declare them. Those declarations need
+  # extern "C" to match the library's C linkage, or the tests fail to link.
+  cpp_debug_build:
+    uses: ./.github/workflows/build-workflow.yml
+    with:
+      config: CC=g++ C_EXTRA_FLAGS="-Werror=narrowing" --enable-debug
+
   wolfssl_v5_6_6:
     uses: ./.github/workflows/wolfssl-v5.6.6-build-workflow.yml
 
diff --git a/tests/destroy_stale_handle_test.c b/tests/destroy_stale_handle_test.c
index 61839923..e7dc58ed 100644
--- a/tests/destroy_stale_handle_test.c
+++ b/tests/destroy_stale_handle_test.c
@@ -61,8 +61,14 @@
 #if defined(DEBUG_WOLFPKCS11) && !defined(NO_AES)
 
 /* DEBUG_WOLFPKCS11-only test hook exported by libwolfpkcs11. */
+#ifdef __cplusplus
+extern "C" {
+#endif
 extern int WP11_Test_RemoveObjectStale(CK_SESSION_HANDLE hSession,
     CK_OBJECT_HANDLE liveHandle, CK_OBJECT_HANDLE staleHandle);
+#ifdef __cplusplus
+}
+#endif
 
 /* Mirrors WP11_OBJECT_ALREADY_REMOVED in wolfpkcs11/internal.h. */
 #define OBJECT_ALREADY_REMOVED 1
diff --git a/tests/login_pin_state_test.c b/tests/login_pin_state_test.c
index 92dc169b..378a81e9 100644
--- a/tests/login_pin_state_test.c
+++ b/tests/login_pin_state_test.c
@@ -167,8 +167,14 @@ static byte aesValue[16] = {
 
 #ifdef LOGIN_TEST_FILE_STORE
 /* DEBUG_WOLFPKCS11-only introspection hooks exported by libwolfpkcs11. */
+#ifdef __cplusplus
+extern "C" {
+#endif
 extern int WP11_Slot_TokenKeyIsZero(CK_SLOT_ID slotId);
 extern int WP11_Slot_TokenDecodedObjectCount(CK_SLOT_ID slotId);
+#ifdef __cplusplus
+}
+#endif
 
 #define SYMMKEY_FILENAME "wp11_symmkey_0000000000000001_0000000000000000"
 
@@ -1157,7 +1163,13 @@ static void find_with_racing_logout_test(void)
 
 #if defined(DEBUG_WOLFPKCS11) && defined(LOGIN_TEST_THREADS) && \
     !defined(WOLFPKCS11_NO_TIME)
+#ifdef __cplusplus
+extern "C" {
+#endif
 extern void WP11_Slot_SetPinCheckHook(void (*hook)(void));
+#ifdef __cplusplus
+}
+#endif
 
 static pthread_mutex_t pinMutex = PTHREAD_MUTEX_INITIALIZER;
 static pthread_cond_t pinCond = PTHREAD_COND_INITIALIZER;
diff --git a/tests/logout_retire_test.c b/tests/logout_retire_test.c
index 7d2d049f..caa87f6e 100644
--- a/tests/logout_retire_test.c
+++ b/tests/logout_retire_test.c
@@ -292,8 +292,14 @@ static void retired_objects_bounded_test(CK_SLOT_ID slot)
 }
 
 #ifdef DEBUG_WOLFPKCS11
+#ifdef __cplusplus
+extern "C" {
+#endif
 extern void WP11_Object_SetFindHook(void (*hook)(void));
 extern void WP11_Session_SetAddObjectHook(void (*hook)(void));
+#ifdef __cplusplus
+}
+#endif
 
 static CK_SESSION_HANDLE hookLogoutSession = CK_INVALID_HANDLE;
 static CK_RV hookLogoutRv = CKR_GENERAL_ERROR;
diff --git a/tests/logout_token_key_zero_test.c b/tests/logout_token_key_zero_test.c
index bddcbb30..ec452fc5 100644
--- a/tests/logout_token_key_zero_test.c
+++ b/tests/logout_token_key_zero_test.c
@@ -54,7 +54,13 @@
 #if defined(DEBUG_WOLFPKCS11) && !defined(WOLFPKCS11_NO_STORE)
 
 /* DEBUG_WOLFPKCS11-only introspection hook exported by libwolfpkcs11. */
+#ifdef __cplusplus
+extern "C" {
+#endif
 extern int WP11_Slot_TokenKeyIsZero(CK_SLOT_ID slotId);
+#ifdef __cplusplus
+}
+#endif
 
 #define LOGOUT_KEY_TEST_DIR "./store/logout_token_key_zero_test"
 #define WOLFPKCS11_TOKEN_FILENAME "wp11_token_0000000000000001"
diff --git a/tests/object_policy_integrity_test.c b/tests/object_policy_integrity_test.c
index dd98ba31..e1b4f413 100644
--- a/tests/object_policy_integrity_test.c
+++ b/tests/object_policy_integrity_test.c
@@ -1653,7 +1653,13 @@ static void test_recovery_ignores_dir_spelling(void)
 #define STORE_EXIT_CODE      75
 #define CRASH_MAX_RENAMES    40
 
+#ifdef __cplusplus
+extern "C" {
+#endif
 extern void WP11_Test_StoreExitAfterRenames(int renames);
+#ifdef __cplusplus
+}
+#endif
 
 static int crashAt = 0;
 
diff --git a/tests/token_reset_fail_test.c b/tests/token_reset_fail_test.c
index eb52abc6..8dfc734f 100644
--- a/tests/token_reset_fail_test.c
+++ b/tests/token_reset_fail_test.c
@@ -53,7 +53,13 @@
 
 #ifdef DEBUG_WOLFPKCS11
 
+#ifdef __cplusplus
+extern "C" {
+#endif
 extern void WP11_Test_FailTokenInit(int fail);
+#ifdef __cplusplus
+}
+#endif
 
 static const char* soPin = "password123456";
 static const char* userPin = "wolfpkcs11-test";
diff --git a/tests/token_store_test.c b/tests/token_store_test.c
index 1be6d8bf..970f2a25 100644
--- a/tests/token_store_test.c
+++ b/tests/token_store_test.c
@@ -474,7 +474,13 @@ static void test_derive_reports_commit_failure(void)
 
 #ifdef DEBUG_WOLFPKCS11
 /* Debug-only hook exported by libwolfpkcs11. */
+#ifdef __cplusplus
+extern "C" {
+#endif
 extern void WP11_Test_StoreCloseFailAfter(int closes);
+#ifdef __cplusplus
+}
+#endif
 
 /* A token object whose record cannot be closed is not reported created. */
 static void test_create_reports_close_failure(void)
@@ -1005,9 +1011,15 @@ static void test_load_record_without_trailing_fields(void)
 
 #ifdef TOKEN_STORE_TPM_TEST
 /* Debug-only hooks exported by libwolfpkcs11. */
+#ifdef __cplusplus
+extern "C" {
+#endif
 extern int WP11_Test_StoreWriteFailAfter(int writes);
 extern int WP11_Test_StoreWriteFailOnce(int writes);
 extern void WP11_Test_TpmStoreShortBy(int bytes);
+#ifdef __cplusplus
+}
+#endif
 
 #define MAX_STORE_WRITES 500
 
diff --git a/tests/tpm_decode_bounds_test.c b/tests/tpm_decode_bounds_test.c
index 3028e24e..751b897f 100644
--- a/tests/tpm_decode_bounds_test.c
+++ b/tests/tpm_decode_bounds_test.c
@@ -55,8 +55,14 @@
     (!defined(NO_RSA) || defined(HAVE_ECC))
 
 /* DEBUG_WOLFPKCS11-only hook exported by libwolfpkcs11. */
+#ifdef __cplusplus
+extern "C" {
+#endif
 extern int WP11_Test_DecodeTpmKey(CK_SLOT_ID slotId, unsigned char* keyData,
     int keyDataLen);
+#ifdef __cplusplus
+}
+#endif
 
 static int test_passed = 0;
 static int test_failed = 0;