diff --git a/common/telemetry.py b/common/telemetry.py
new file mode 100644
index 0000000..9904ef0
--- /dev/null
+++ b/common/telemetry.py
@@ -0,0 +1,13 @@
+from opentelemetry import trace
+from opentelemetry.sdk.resources import SERVICE_NAME, Resource
+from opentelemetry.sdk.trace import TracerProvider
+from opentelemetry.sdk.trace.export import BatchSpanProcessor
+from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter
+
+
+def setup_telemetry(service_name: str):
+    resource = Resource.create(attributes={SERVICE_NAME: service_name})
+    processor = BatchSpanProcessor(OTLPSpanExporter())
+    provider = TracerProvider(resource=resource)
+    provider.add_span_processor(processor)
+    trace.set_tracer_provider(provider)
diff --git a/deploy.sh b/deploy.sh
index 1906a0f..dee9a02 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -18,4 +18,10 @@ if [ -n "$(git log '@{u}..HEAD' --oneline 2>/dev/null)" ]; then
   echo "warning: local commits are not pushed; the server will not see them" >&2
 fi
 
-ssh "$DEPLOY_HOST" "cd '$DEPLOY_DIR' && git pull --ff-only && $COMPOSE up -d --build && $COMPOSE ps"
+# DEPLOY_HASH is the server's HEAD *after* the pull -- the code actually
+# running -- and becomes service.version on every span (docker-compose.yml).
+# Escaped so it is evaluated on the server, not here.
+ssh "$DEPLOY_HOST" "cd '$DEPLOY_DIR' && git pull --ff-only \
+  && export DEPLOY_HASH=\$(git rev-parse --short HEAD) \
+  && echo \"deploying \$DEPLOY_HASH\" \
+  && $COMPOSE up -d --build && $COMPOSE ps"
diff --git a/docker-compose.yml b/docker-compose.yml
index 4f6cbf9..e04b3e7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,6 +7,9 @@ x-app-env: &app-env
   SANCTIONS_URL: http://sanctions:8003
   INSIGHTS_URL: http://insights:8004
   NOTIFIER_URL: http://notifier:8005
+  # Merged into the Resource by Resource.create(). deploy.sh sets DEPLOY_HASH
+  # to the deployed git SHA; anything else (local runs) is "dev".
+  OTEL_RESOURCE_ATTRIBUTES: service.version=${DEPLOY_HASH:-dev}
 
 x-app-build: &app-build
   build:
@@ -140,7 +143,6 @@ services:
       <<: *app-env
       SERVICE_NAME: sanctions
       OTEL_SERVICE_NAME: sanctions
-      OTEL_RESOURCE_ATTRIBUTES: deployment.environment.name=prod
       OTEL_EXPORTER_OTLP_ENDPOINT: https://otlp.vione.cloud
       OTEL_EXPORTER_OTLP_PROTOCOL: http/protobuf
       OTEL_TRACES_EXPORTER: otlp
@@ -148,7 +150,7 @@ services:
       OTEL_LOGS_EXPORTER: none
     env_file:
       - .env.observability
-    command: opentelemetry-instrument uvicorn services.sanctions.app:app --host 0.0.0.0 --port 8003 --reload --no-access-log
+    command: uvicorn services.sanctions.app:app --host 0.0.0.0 --port 8003 --reload --no-access-log
     ports:
       - "8003:8003"
     healthcheck:
diff --git a/services/sanctions/app.py b/services/sanctions/app.py
index 7961216..147a05c 100644
--- a/services/sanctions/app.py
+++ b/services/sanctions/app.py
@@ -6,13 +6,14 @@ from pydantic import BaseModel
 
 from common.db import engine
 from common.logging_config import configure_logging
-from common.redis_client import redis_client
+from common.telemetry import setup_telemetry
 
 from . import chaos
 from .repository import is_match
 
 SERVICE_NAME = "sanctions"
 logger = configure_logging(SERVICE_NAME)
+setup_telemetry(service_name=SERVICE_NAME)
 app = FastAPI(title=SERVICE_NAME)