diff --git a/Dockerfile b/Dockerfile
index c6d3959..3cf65ac 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,6 +12,7 @@ WORKDIR /app
 
 COPY requirements.txt .
 RUN pip install -r requirements.txt
+RUN opentelemetry-bootstrap -a install
 
 COPY common ./common
 COPY services ./services
diff --git a/docker-compose.yml b/docker-compose.yml
index 2ba5ab1..4f6cbf9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -139,7 +139,16 @@ services:
     environment:
       <<: *app-env
       SERVICE_NAME: sanctions
-    command: uvicorn services.sanctions.app:app --host 0.0.0.0 --port 8003 --reload --no-access-log
+      OTEL_SERVICE_NAME: sanctions
+      OTEL_RESOURCE_ATTRIBUTES: deployment.environment.name=prod
+      OTEL_EXPORTER_OTLP_ENDPOINT: https://otlp.vione.cloud
+      OTEL_EXPORTER_OTLP_PROTOCOL: http/protobuf
+      OTEL_TRACES_EXPORTER: otlp
+      OTEL_METRICS_EXPORTER: none
+      OTEL_LOGS_EXPORTER: none
+    env_file:
+      - .env.observability
+    command: opentelemetry-instrument uvicorn services.sanctions.app:app --host 0.0.0.0 --port 8003 --reload --no-access-log
     ports:
       - "8003:8003"
     healthcheck:
diff --git a/k8s/create-secrets.sh b/k8s/create-secrets.sh
index 7392f24..80dc393 100755
--- a/k8s/create-secrets.sh
+++ b/k8s/create-secrets.sh
@@ -10,7 +10,8 @@
 #                   (Prometheus, Alertmanager, Loki, Tempo, Alloy UI, OTLP)
 #   grafana-admin   Grafana admin user/password
 # and writes .env.observability at the repo root (gitignored) for the czy-side
-# Alloy log agent; copy it to the server once (see k8s/README.md).
+# Alloy log agent and the OTLP auth header of instrumented services; copy it to
+# the server after every regeneration (see k8s/README.md).
 #
 # KUBECTL defaults to `kubectl`; e.g. KUBECTL="ssh falken kubectl" to run it on
 # the node when the API server isn't reachable from here.
@@ -47,14 +48,19 @@ kubectl create secret generic grafana-admin -n "$NS" \
   --from-literal=admin-password="$GRAFANA_ADMIN_PASSWORD" \
   --dry-run=client -o yaml | $KUBECTL apply -f -
 
+# OTLP header for instrumented services: URL-encoded (space -> %20), and
+# newlines stripped because GNU base64 wraps at 76 chars and this is ~80.
+OTLP_BASIC=$(printf '%s:%s' "$OBS_USER" "$OBS_PASSWORD" | base64 | tr -d '\n')
+
 (
   umask 077
   cat > ../.env.observability <<EOF
-# Credentials for the Alloy log agent on czy (docker-compose.traefik.yml).
+# Credentials for the Alloy log agent and instrumented services on czy.
 # Generated by k8s/create-secrets.sh -- do not commit.
 LOKI_PUSH_URL=https://loki.vione.cloud/loki/api/v1/push
 LOKI_PUSH_USER=$OBS_USER
 LOKI_PUSH_PASSWORD=$OBS_PASSWORD
+OTEL_EXPORTER_OTLP_HEADERS=Authorization=Basic%20$OTLP_BASIC
 EOF
 )
 echo "wrote $(cd .. && pwd)/.env.observability"
diff --git a/requirements.txt b/requirements.txt
index 4c12824..9856341 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -8,3 +8,5 @@ redis==5.2.1
 pydantic==2.10.4
 pydantic-settings==2.7.1
 python-multipart==0.0.20
+opentelemetry-distro==0.66b1
+opentelemetry-exporter-otlp==1.45.1