diff --git a/k8s/keycloak/deployment.yaml b/k8s/keycloak/deployment.yaml
index 7245936..e2c93c2 100644
--- a/k8s/keycloak/deployment.yaml
+++ b/k8s/keycloak/deployment.yaml
@@ -20,6 +20,16 @@ spec:
         app.kubernetes.io/component: idp
         app.kubernetes.io/part-of: keycloak
     spec:
+      initContainers:
+        - name: download-otel-agent
+          image: curlimages/curl:8.10.0
+          command:
+            - "sh"
+            - "-c"
+            - "curl -sSL -o /otel/opentelemetry-javaagent.jar https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/download/v2.31.0/opentelemetry-javaagent.jar"
+          volumeMounts:
+            - name: otel-agent
+              mountPath: /otel
       containers:
         - name: keycloak
           image: quay.io/keycloak/keycloak:26.6.0
@@ -86,7 +96,33 @@ spec:
             - name: KC_HOSTNAME_BACKCHANNEL_DYNAMIC
               value: "false"
             - name: KC_FEATURES
-              value: "token-exchange,admin-fine-grained-authz"
+              value: "token-exchange,admin-fine-grained-authz,log-mdc"
+            - name: JAVA_OPTS_APPEND
+              value: "-javaagent:/otel/opentelemetry-javaagent.jar"
+            - name: OTEL_SERVICE_NAME
+              value: "keycloak"
+            - name: OTEL_EXPORTER_OTLP_ENDPOINT
+              value: "http://jaeger.observability.svc.cluster.local:4318"
+            - name: OTEL_EXPORTER_OTLP_PROTOCOL
+              value: "http/protobuf"
+            - name: OTEL_TRACES_EXPORTER
+              value: "otlp"
+            - name: OTEL_METRICS_EXPORTER
+              value: "none"
+            - name: OTEL_LOGS_EXPORTER
+              value: "none"
+            - name: KC_HTTP_ACCESS_LOG_ENABLED
+              value: "true"
+            - name: KC_LOG_LEVEL
+              value: "INFO,org.keycloak.events:DEBUG"
+            - name: KC_LOG_CONSOLE_OUTPUT
+              value: "json"
+            - name: KC_LOG_MDC_ENABLED
+              value: "true"
+            - name: KC_LOG_SERVICE_NAME
+              value: "keycloak"
+            - name: KC_LOG_SERVICE_ENVIRONMENT
+              value: "local"
             - name: KC_HEALTH_ENABLED
               value: "true"
             - name: KC_METRICS_ENABLED
@@ -116,7 +152,11 @@ spec:
             - name: realm-import
               mountPath: /opt/keycloak/data/import
               readOnly: true
+            - name: otel-agent
+              mountPath: /otel
       volumes:
         - name: realm-import
           configMap:
             name: keycloak-realm-classic-models
+        - name: otel-agent
+          emptyDir: {}