diff --git a/codex-rs/exec-server/src/client.rs b/codex-rs/exec-server/src/client.rs
index 1ff98fcc7c..797c286456 100644
--- a/codex-rs/exec-server/src/client.rs
+++ b/codex-rs/exec-server/src/client.rs
@@ -337,11 +337,15 @@ impl LazyRemoteExecServerClient {
             return None;
         }
         let client = self.clone();
-        Some(AbortOnDropHandle::new(tokio::spawn(async move {
-            if let Err(error) = client.wait_until_ready().await {
-                debug!(%error, "exec-server environment startup failed");
+        Some(AbortOnDropHandle::new(tokio::spawn(
+            async move {
+                if let Err(error) = client.wait_until_ready().await {
+                    debug!(%error, "exec-server environment startup failed");
+                }
             }
-        })))
+            .in_current_span()
+            .with_current_subscriber(),
+        )))
     }
 
     pub(crate) fn startup_finished(&self) -> bool {
@@ -509,6 +513,7 @@ impl LazyRemoteExecServerClient {
         )
     }
 
+    #[tracing::instrument(name = "codex.exec_server.remote.connect", skip_all)]
     async fn connect_once(&self) -> ConnectionResult {
         let result = ExecServerClient::connect_for_transport(
             self.transport_params.clone(),
diff --git a/codex-rs/exec-server/src/client_transport.rs b/codex-rs/exec-server/src/client_transport.rs
index 87c238e55b..d699188fd7 100644
--- a/codex-rs/exec-server/src/client_transport.rs
+++ b/codex-rs/exec-server/src/client_transport.rs
@@ -170,6 +170,7 @@ impl ExecServerClient {
         .await
     }
 
+    #[tracing::instrument(name = "codex.exec_server.remote.noise.connect", skip_all)]
     async fn open_initial_noise_rendezvous_connection(
         provider: &Arc<dyn NoiseRendezvousConnectProvider>,
         identity: &NoiseChannelIdentity,
@@ -285,6 +286,16 @@ impl ExecServerClient {
         Self::connect(connection, options).await
     }
 
+    #[tracing::instrument(
+        name = "codex.exec_server.remote.noise.websocket_connect",
+        skip_all,
+        fields(
+            otel.kind = "client",
+            otel.name = "codex.exec_server.remote.noise.websocket_connect",
+            environment_id = %args.bundle.environment_id,
+            executor_registration_id = %args.bundle.executor_registration_id,
+        )
+    )]
     pub(crate) async fn open_noise_rendezvous_connection(
         args: NoiseRendezvousConnectArgs,
     ) -> Result<(JsonRpcConnection, ExecServerClientConnectOptions), ExecServerError> {
diff --git a/codex-rs/exec-server/src/remote.rs b/codex-rs/exec-server/src/remote.rs
index 082b206128..484b2fe79a 100644
--- a/codex-rs/exec-server/src/remote.rs
+++ b/codex-rs/exec-server/src/remote.rs
@@ -170,6 +170,15 @@ impl EnvironmentRegistryClient {
     }
 
     /// Authorize one Noise harness key and obtain the full rendezvous bundle.
+    #[tracing::instrument(
+        name = "codex.exec_server.remote.environment_registry.connect",
+        skip_all,
+        fields(
+            otel.kind = "client",
+            otel.name = "codex.exec_server.remote.environment_registry.connect",
+            environment_id = %environment_id,
+        )
+    )]
     async fn connect_environment(
         &self,
         environment_id: &str,
@@ -182,6 +191,7 @@ impl EnvironmentRegistryClient {
                 &format!("/cloud/environment/{environment_id}/connect"),
             ))
             .headers(self.auth_provider.to_auth_headers())
+            .headers(current_trace_context_headers())
             .json(&EnvironmentRegistryConnectRequest { harness_public_key })
             .timeout(self.connect_timeout)
             .send()
@@ -248,6 +258,16 @@ impl HarnessKeyValidator for RegistryHarnessKeyValidator {
     /// Authorize the harness key recovered from the first IK message.
     /// Noise proves key possession; the registry decides whether that key may use
     /// this executor. The authorization token and public key are checked together.
+    #[tracing::instrument(
+        name = "codex.exec_server.remote.environment_registry.validate_harness_key",
+        skip_all,
+        fields(
+            otel.kind = "client",
+            otel.name = "codex.exec_server.remote.environment_registry.validate_harness_key",
+            environment_id = %self.environment_id,
+            executor_registration_id = %self.executor_registration_id,
+        )
+    )]
     async fn validate_harness_key(
         &self,
         harness_public_key: &NoiseChannelPublicKey,
@@ -262,6 +282,7 @@ impl HarnessKeyValidator for RegistryHarnessKeyValidator {
                 &format!("/cloud/environment/{environment_id}/validate"),
             ))
             .headers(self.client.auth_provider.to_auth_headers())
+            .headers(current_trace_context_headers())
             .json(&EnvironmentRegistryHarnessKeyValidationRequest {
                 executor_registration_id: self.executor_registration_id.clone(),
                 harness_public_key: harness_public_key.clone(),