diff --git a/backend/v3/instrumentation/tracing.go b/backend/v3/instrumentation/tracing.go
index 2cb80f7d4..179147338 100644
--- a/backend/v3/instrumentation/tracing.go
+++ b/backend/v3/instrumentation/tracing.go
@@ -20,8 +20,9 @@ import (
 )
 
 type TraceConfig struct {
-	Fraction float64
-	Exporter ExporterConfig
+	Fraction         float64
+	Exporter         ExporterConfig
+	TrustRemoteSpans bool
 }
 
 // TODO: remove for v5 release
diff --git a/cmd/defaults.yaml b/cmd/defaults.yaml
index d46509599..1b78b9b5c 100644
--- a/cmd/defaults.yaml
+++ b/cmd/defaults.yaml
@@ -2,6 +2,9 @@ Instrumentation:
   ServiceName: "zitadel" # ZITADEL_INSTRUMENTATION_SERVICENAME
   Trace:
     Fraction: 1.0 # ZITADEL_INSTRUMENTATION_TRACE_FRACTION
+    # Trust incoming trace context from remote services for distributed tracing.
+    # Enable only in controlled environments; defaults to false for security.
+    TrustRemoteSpans: false # ZITADEL_INSTRUMENTATION_TRACE_TRUSTREMOTESPANS
     Exporter:
       # The following exporter types are supported:
       # "none": Disables trace exporting
diff --git a/cmd/mirror/defaults.yaml b/cmd/mirror/defaults.yaml
index 3b55ecb8a..d6fbbb433 100644
--- a/cmd/mirror/defaults.yaml
+++ b/cmd/mirror/defaults.yaml
@@ -2,6 +2,9 @@ Instrumentation:
   ServiceName: "zitadel-mirror" # ZITADEL_INSTRUMENTATION_SERVICENAME
   Trace:
     Fraction: 1.0 # ZITADEL_INSTRUMENTATION_TRACE_FRACTION
+    # Trust incoming trace context from remote services for distributed tracing.
+    # Enable only in controlled environments; defaults to false for security.
+    TrustRemoteSpans: false # ZITADEL_INSTRUMENTATION_TRACE_TRUSTREMOTESPANS
     Exporter:
       # The following exporter types are supported:
       # "none": Disables trace exporting
diff --git a/cmd/setup/steps.yaml b/cmd/setup/steps.yaml
index 5dcb6913c..8552b2fc0 100644
--- a/cmd/setup/steps.yaml
+++ b/cmd/setup/steps.yaml
@@ -2,6 +2,9 @@ Instrumentation:
   ServiceName: "zitadel-setup" # ZITADEL_INSTRUMENTATION_SERVICENAME
   Trace:
     Fraction: 1.0 # ZITADEL_INSTRUMENTATION_TRACE_FRACTION
+    # Trust incoming trace context from remote services for distributed tracing.
+    # Enable only in controlled environments; defaults to false for security.
+    TrustRemoteSpans: false # ZITADEL_INSTRUMENTATION_TRACE_TRUSTREMOTESPANS
     Exporter:
       # The following exporter types are supported:
       # "none": Disables trace exporting
diff --git a/cmd/start/start.go b/cmd/start/start.go
index 2102add32..6a0fa478c 100644
--- a/cmd/start/start.go
+++ b/cmd/start/start.go
@@ -480,6 +480,7 @@ func startAPIs(
 		limitingAccessInterceptor,
 		keys.Target,
 		translator,
+		config.Instrumentation.Trace.TrustRemoteSpans,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("error creating api %w", err)
diff --git a/internal/api/api.go b/internal/api/api.go
index 4a4f1f72f..754922aae 100644
--- a/internal/api/api.go
+++ b/internal/api/api.go
@@ -110,6 +110,7 @@ func New(
 	accessInterceptor *http_mw.AccessInterceptor,
 	targetEncryptionAlgorithm crypto.EncryptionAlgorithm,
 	translator *i18n.Translator,
+	trustRemoteSpans bool,
 ) (_ *API, err error) {
 	api := &API{
 		port:                      port,
@@ -132,12 +133,16 @@ func New(
 	if err != nil {
 		return nil, err
 	}
-	api.connectOTELInterceptor, err = otelconnect.NewInterceptor(
+	otelOpts := []otelconnect.Option{
 		otelconnect.WithTracerProvider(otel.GetTracerProvider()),
 		otelconnect.WithMeterProvider(otel.GetMeterProvider()),
 		otelconnect.WithPropagator(otel.GetTextMapPropagator()),
 		otelconnect.WithoutServerPeerAttributes(),
-	)
+	}
+	if trustRemoteSpans {
+		otelOpts = append(otelOpts, otelconnect.WithTrustRemote())
+	}
+	api.connectOTELInterceptor, err = otelconnect.NewInterceptor(otelOpts...)
 	if err != nil {
 		return nil, err
 	}