diff --git a/libsignal-service-actix/Cargo.toml b/libsignal-service-actix/Cargo.toml
index 7d8124c69..c3a609c55 100644
--- a/libsignal-service-actix/Cargo.toml
+++ b/libsignal-service-actix/Cargo.toml
@@ -18,6 +18,7 @@ actix-rt = "2.4"
 mpart-async = "0.5"
 serde_json = "1.0"
 futures = "0.3"
+tracing = "0.1"
 bytes = "1"
 rustls = "0.20"
 rustls-pemfile = "0.3"
diff --git a/libsignal-service-hyper/Cargo.toml b/libsignal-service-hyper/Cargo.toml
index ef977fbaf..c0f814e46 100644
--- a/libsignal-service-hyper/Cargo.toml
+++ b/libsignal-service-hyper/Cargo.toml
@@ -12,6 +12,7 @@ async-trait = "0.1"
 base64 = "0.13"
 bytes = "1.0"
 futures = "0.3"
+tracing = "0.1"
 log = "0.4"
 mpart-async = "0.6"
 serde = "1.0"
diff --git a/libsignal-service/Cargo.toml b/libsignal-service/Cargo.toml
index 390092a9f..7afc4f0ca 100644
--- a/libsignal-service/Cargo.toml
+++ b/libsignal-service/Cargo.toml
@@ -34,6 +34,8 @@ thiserror = "1.0"
 url = { version = "2.1", features = ["serde"] }
 uuid = { version = "1", features = ["serde"] }
 
+tracing = "0.1"
+
 [build-dependencies]
 prost-build = "0.10"
 
diff --git a/libsignal-service/src/cipher.rs b/libsignal-service/src/cipher.rs
index 8154cad54..dbd598c65 100644
--- a/libsignal-service/src/cipher.rs
+++ b/libsignal-service/src/cipher.rs
@@ -58,6 +58,7 @@ where
     /// Opens ("decrypts") an envelope.
     ///
     /// Envelopes may be empty, in which case this method returns `Ok(None)`
+    #[tracing::instrument]
     pub async fn open_envelope(
         &mut self,
         envelope: Envelope,
@@ -89,6 +90,7 @@ where
     /// Triage of legacy messages happens inside this method, as opposed to the
     /// Java implementation, because it makes the borrow checker and the
     /// author happier.
+    #[tracing::instrument]
     async fn decrypt(
         &mut self,
         envelope: &Envelope,
@@ -263,6 +265,7 @@ where
         Ok(plaintext)
     }
 
+    #[tracing::instrument]
     pub(crate) async fn encrypt(
         &mut self,
         address: &ProtocolAddress,
@@ -417,6 +420,7 @@ pub async fn get_preferred_protocol_address<S: SessionStore>(
 /// is then validated against the `trust_root` baked into the client to ensure that the sender's
 /// identity was not forged.
 #[allow(clippy::too_many_arguments)]
+#[tracing::instrument]
 async fn sealed_sender_decrypt(
     ciphertext: &[u8],
     trust_root: &PublicKey,
diff --git a/libsignal-service/src/envelope.rs b/libsignal-service/src/envelope.rs
index 8e9d7be00..b08f9e1da 100644
--- a/libsignal-service/src/envelope.rs
+++ b/libsignal-service/src/envelope.rs
@@ -25,6 +25,7 @@ impl TryFrom<EnvelopeEntity> for Envelope {
 }
 
 impl Envelope {
+    #[tracing::instrument]
     pub fn decrypt(
         input: &[u8],
         signaling_key: &SignalingKey,