diff --git a/persistence/sql/persister_client.go b/persistence/sql/persister_client.go
index c85893c1df8..b3a484af564 100644
--- a/persistence/sql/persister_client.go
+++ b/persistence/sql/persister_client.go
@@ -6,6 +6,8 @@ package sql
 import (
 	"context"
 
+	"go.opentelemetry.io/otel/trace"
+
 	"github.com/ory/hydra/v2/x/events"
 
 	"github.com/gobuffalo/pop/v6"
@@ -20,7 +22,9 @@ import (
 )
 
 func (p *Persister) GetConcreteClient(ctx context.Context, id string) (c *client.Client, err error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.GetConcreteClient")
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.GetConcreteClient",
+		trace.WithAttributes(events.ClientID(id)),
+	)
 	defer otelx.End(span, &err)
 
 	var cl client.Client
@@ -35,7 +39,9 @@ func (p *Persister) GetClient(ctx context.Context, id string) (fosite.Client, er
 }
 
 func (p *Persister) UpdateClient(ctx context.Context, cl *client.Client) (err error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.UpdateClient")
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.UpdateClient",
+		trace.WithAttributes(events.ClientID(cl.ID)),
+	)
 	defer otelx.End(span, &err)
 
 	return p.Transaction(ctx, func(ctx context.Context, c *pop.Connection) error {
@@ -77,7 +83,9 @@ func (p *Persister) UpdateClient(ctx context.Context, cl *client.Client) (err er
 }
 
 func (p *Persister) AuthenticateClient(ctx context.Context, id string, secret []byte) (_ *client.Client, err error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.AuthenticateClient")
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.AuthenticateClient",
+		trace.WithAttributes(events.ClientID(id)),
+	)
 	defer otelx.End(span, &err)
 
 	c, err := p.GetConcreteClient(ctx, id)
@@ -117,7 +125,9 @@ func (p *Persister) CreateClient(ctx context.Context, c *client.Client) (err err
 }
 
 func (p *Persister) DeleteClient(ctx context.Context, id string) (err error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.DeleteClient")
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.DeleteClient",
+		trace.WithAttributes(events.ClientID(id)),
+	)
 	defer otelx.End(span, &err)
 
 	c, err := p.GetConcreteClient(ctx, id)
diff --git a/persistence/sql/persister_oauth2.go b/persistence/sql/persister_oauth2.go
index 083e67ac5da..80246afed72 100644
--- a/persistence/sql/persister_oauth2.go
+++ b/persistence/sql/persister_oauth2.go
@@ -366,7 +366,9 @@ func (p *Persister) InvalidateAuthorizeCodeSession(ctx context.Context, signatur
 }
 
 func (p *Persister) CreateAccessTokenSession(ctx context.Context, signature string, requester fosite.Requester) (err error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.CreateAccessTokenSession")
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.CreateAccessTokenSession",
+		trace.WithAttributes(events.AccessTokenSignature(signature)),
+	)
 	defer otelx.End(span, &err)
 
 	events.Trace(ctx, events.AccessTokenIssued,
@@ -377,7 +379,9 @@ func (p *Persister) CreateAccessTokenSession(ctx context.Context, signature stri
 }
 
 func (p *Persister) GetAccessTokenSession(ctx context.Context, signature string, session fosite.Session) (request fosite.Requester, err error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.GetAccessTokenSession")
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.GetAccessTokenSession",
+		trace.WithAttributes(events.AccessTokenSignature(signature)),
+	)
 	defer otelx.End(span, &err)
 
 	r := OAuth2RequestSQL{Table: sqlTableAccess}
@@ -406,7 +410,9 @@ func (p *Persister) GetAccessTokenSession(ctx context.Context, signature string,
 }
 
 func (p *Persister) DeleteAccessTokenSession(ctx context.Context, signature string) (err error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.DeleteAccessTokenSession")
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.DeleteAccessTokenSession",
+		trace.WithAttributes(events.AccessTokenSignature(signature)),
+	)
 	defer otelx.End(span, &err)
 
 	err = sqlcon.HandleError(
@@ -446,14 +452,18 @@ func toEventOptions(requester fosite.Requester) []trace.EventOption {
 }
 
 func (p *Persister) CreateRefreshTokenSession(ctx context.Context, signature string, requester fosite.Requester) (err error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.CreateRefreshTokenSession")
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.CreateRefreshTokenSession",
+		trace.WithAttributes(events.RefreshTokenSignature(signature)),
+	)
 	defer otelx.End(span, &err)
 	events.Trace(ctx, events.RefreshTokenIssued, toEventOptions(requester)...)
 	return p.createSession(ctx, signature, requester, sqlTableRefresh, requester.GetSession().GetExpiresAt(fosite.RefreshToken).UTC())
 }
 
 func (p *Persister) GetRefreshTokenSession(ctx context.Context, signature string, session fosite.Session) (request fosite.Requester, err error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.GetRefreshTokenSession")
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.GetRefreshTokenSession",
+		trace.WithAttributes(events.RefreshTokenSignature(signature)),
+	)
 	defer otelx.End(span, &err)
 
 	r := OAuth2RefreshTable{OAuth2RequestSQL: OAuth2RequestSQL{Table: sqlTableRefresh}}
@@ -486,7 +496,9 @@ func (p *Persister) GetRefreshTokenSession(ctx context.Context, signature string
 }
 
 func (p *Persister) DeleteRefreshTokenSession(ctx context.Context, signature string) (err error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.DeleteRefreshTokenSession")
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.DeleteRefreshTokenSession",
+		trace.WithAttributes(events.RefreshTokenSignature(signature)),
+	)
 	defer otelx.End(span, &err)
 	return p.deleteSessionBySignature(ctx, signature, sqlTableRefresh)
 }
@@ -531,7 +543,9 @@ func (p *Persister) DeletePKCERequestSession(ctx context.Context, signature stri
 }
 
 func (p *Persister) RevokeRefreshToken(ctx context.Context, id string) (err error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.RevokeRefreshToken")
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.RevokeRefreshToken",
+		trace.WithAttributes(events.ConsentRequestID(id)),
+	)
 	defer otelx.End(span, &err)
 	return p.deactivateSessionByRequestID(ctx, id, sqlTableRefresh)
 }
@@ -553,7 +567,9 @@ func (p *Persister) RevokeRefreshTokenMaybeGracePeriod(ctx context.Context, id s
 }
 
 func (p *Persister) RevokeAccessToken(ctx context.Context, id string) (err error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.RevokeAccessToken")
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.RevokeAccessToken",
+		trace.WithAttributes(events.ConsentRequestID(id)),
+	)
 	defer otelx.End(span, &err)
 	return p.deleteSessionByRequestID(ctx, id, sqlTableAccess)
 }
@@ -605,7 +621,9 @@ func (p *Persister) FlushInactiveRefreshTokens(ctx context.Context, notAfter tim
 }
 
 func (p *Persister) DeleteAccessTokens(ctx context.Context, clientID string) (err error) {
-	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.DeleteAccessTokens")
+	ctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.DeleteAccessTokens",
+		trace.WithAttributes(events.ClientID(clientID)),
+	)
 	defer otelx.End(span, &err)
 	/* #nosec G201 table is static */
 	return sqlcon.HandleError(
diff --git a/x/events/events.go b/x/events/events.go
index b93843f9db9..998892f77d9 100644
--- a/x/events/events.go
+++ b/x/events/events.go
@@ -58,11 +58,14 @@ const (
 )
 
 const (
-	attributeKeyOAuth2ClientName  = "OAuth2ClientName"
-	attributeKeyOAuth2ClientID    = "OAuth2ClientID"
-	attributeKeyOAuth2Subject     = "OAuth2Subject"
-	attributeKeyOAuth2GrantType   = "OAuth2GrantType"
-	attributeKeyOAuth2TokenFormat = "OAuth2TokenFormat" //nolint:gosec
+	attributeKeyOAuth2ClientName            = "OAuth2ClientName"
+	attributeKeyOAuth2ClientID              = "OAuth2ClientID"
+	attributeKeyOAuth2Subject               = "OAuth2Subject"
+	attributeKeyOAuth2GrantType             = "OAuth2GrantType"
+	attributeKeyOAuth2ConsentRequestID      = "OAuth2ConsentRequestID"
+	attributeKeyOAuth2TokenFormat           = "OAuth2TokenFormat"           //nolint:gosec
+	attributeKeyOAuth2RefreshTokenSignature = "OAuth2RefreshTokenSignature" //nolint:gosec
+	attributeKeyOAuth2AccessTokenSignature  = "OAuth2AccessTokenSignature"  //nolint:gosec
 )
 
 // WithTokenFormat emits the token format as part of the event.
@@ -75,9 +78,25 @@ func WithGrantType(grantType string) trace.EventOption {
 	return trace.WithAttributes(otelattr.String(attributeKeyOAuth2GrantType, grantType))
 }
 
+func ClientID(clientID string) otelattr.KeyValue {
+	return otelattr.String(attributeKeyOAuth2ClientID, clientID)
+}
+
+func RefreshTokenSignature(signature string) otelattr.KeyValue {
+	return otelattr.String(attributeKeyOAuth2RefreshTokenSignature, signature)
+}
+
+func AccessTokenSignature(signature string) otelattr.KeyValue {
+	return otelattr.String(attributeKeyOAuth2AccessTokenSignature, signature)
+}
+
+func ConsentRequestID(id string) otelattr.KeyValue {
+	return otelattr.String(attributeKeyOAuth2ConsentRequestID, id)
+}
+
 // WithClientID emits the client ID as part of the event.
 func WithClientID(clientID string) trace.EventOption {
-	return trace.WithAttributes(otelattr.String(attributeKeyOAuth2ClientID, clientID))
+	return trace.WithAttributes(ClientID(clientID))
 }
 
 // WithClientName emits the client name as part of the event.