diff --git a/README.md b/README.md
index 7dc41ab..aa467a5 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,3 @@ Run:
 
 You'll need TLS keys, you can use `certs/generate.sh`
 for quick generation.
-
-## TODO
-- [ ] Make TLS keys path configurable
-- [ ] Fix slowloris (proper response timeouts)
diff --git a/cmd/gemserve/gemserve.go b/cmd/gemserve/gemserve.go
index 6d92e26..2155542 100644
--- a/cmd/gemserve/gemserve.go
+++ b/cmd/gemserve/gemserve.go
@@ -7,6 +7,8 @@ import (
 	"crypto/tls"
 	"fmt"
 	"net"
+	"net/http"
+	_ "net/http/pprof"
 	"os"
 	"os/signal"
 	"sync"
@@ -41,6 +43,16 @@ func runApp(ctx context.Context) error {
 
 	listenAddr := config.CONFIG.ListenAddr
 
+	// Start pprof HTTP server if enabled
+	if config.CONFIG.PprofAddr != "" {
+		go func() {
+			logger.Info("Starting pprof HTTP server", "address", config.CONFIG.PprofAddr)
+			if err := http.ListenAndServe(config.CONFIG.PprofAddr, nil); err != nil {
+				panic(fmt.Sprintf("pprof HTTP server failed: %v", err))
+			}
+		}()
+	}
+
 	signals := make(chan os.Signal, 1)
 	signal.Notify(signals, syscall.SIGINT, syscall.SIGTERM)
 
diff --git a/config/config.go b/config/config.go
index 4c972ab..d2ea4ab 100644
--- a/config/config.go
+++ b/config/config.go
@@ -18,6 +18,7 @@ type Config struct {
 	TLSCert            string     // TLS certificate file
 	TLSKey             string     // TLS key file
 	MaxResponseSize    int        // Max response size in bytes
+	PprofAddr          string     // Address for pprof HTTP endpoint (empty = disabled)
 }
 
 var CONFIG Config //nolint:gochecknoglobals
@@ -49,6 +50,7 @@ func GetConfig() *Config {
 	tlsCert := flag.String("tls-cert", "certs/server.crt", "TLS certificate file")
 	tlsKey := flag.String("tls-key", "certs/server.key", "TLS key file")
 	maxResponseSize := flag.Int("max-response-size", 5_242_880, "Max response size in bytes")
+	pprofAddr := flag.String("pprof-addr", "", "Address for pprof HTTP endpoint (empty = disabled)")
 
 	flag.Parse()
 
@@ -74,5 +76,6 @@ func GetConfig() *Config {
 		TLSCert:            *tlsCert,
 		TLSKey:             *tlsKey,
 		MaxResponseSize:    *maxResponseSize,
+		PprofAddr:          *pprofAddr,
 	}
 }