diff --git a/libsignal-service/src/cipher.rs b/libsignal-service/src/cipher.rs
index 9b6a71283..a592fffaa 100644
--- a/libsignal-service/src/cipher.rs
+++ b/libsignal-service/src/cipher.rs
@@ -1,4 +1,4 @@
-use std::{convert::TryFrom, time::SystemTime};
+use std::{convert::TryFrom, fmt, time::SystemTime};
 
 use aes::cipher::block_padding::{Iso7816, RawPadding};
 use libsignal_protocol::{
@@ -34,6 +34,18 @@ pub struct ServiceCipher<S, R> {
     local_device_id: u32,
 }
 
+impl<S, R> fmt::Debug for ServiceCipher<S, R> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("ServiceCipher")
+            .field("protocol_store", &"...")
+            .field("csprng", &"...")
+            .field("trust_root", &"...")
+            .field("local_uuid", &self.local_uuid)
+            .field("local_device_id", &self.local_device_id)
+            .finish()
+    }
+}
+
 impl<S, R> ServiceCipher<S, R>
 where
     S: ProtocolStore + KyberPreKeyStore + SenderKeyStore + Clone,
@@ -429,7 +441,16 @@ pub async fn get_preferred_protocol_address<S: SessionStore>(
 /// is then validated against the `trust_root` baked into the client to ensure that the sender's
 /// identity was not forged.
 #[allow(clippy::too_many_arguments)]
-#[tracing::instrument]
+#[tracing::instrument(skip(
+    ciphertext,
+    trust_root,
+    identity_store,
+    session_store,
+    pre_key_store,
+    signed_pre_key_store,
+    sender_key_store,
+    kyber_pre_key_store
+))]
 async fn sealed_sender_decrypt(
     ciphertext: &[u8],
     trust_root: &PublicKey,