diff --git a/src/lib/observability/__tests__/redact-payload.test.ts b/src/lib/observability/__tests__/redact-payload.test.ts
index 40db5cc1e..cf9194a5a 100644
--- a/src/lib/observability/__tests__/redact-payload.test.ts
+++ b/src/lib/observability/__tests__/redact-payload.test.ts
@@ -115,16 +115,37 @@ describe("redactSensitiveFields", () => {
     // one of the documented patterns.
     const required = [
       "password",
+      "passphrase",
       "token",
       "secret",
       "apikey",
       "authorization",
       "csrfstate",
       "nonce",
+      "otp",
+      "recoveryCode",
+      "glitchtipDsn",
     ];
     for (const key of required) {
       const matched = SENSITIVE_KEY_PATTERNS.some((re) => re.test(key));
       expect(matched, `pattern set should match ${key}`).toBe(true);
     }
   });
+
+  it("redacts the credential-adjacent additions (passphrase / otp / recovery / dsn)", () => {
+    const body = {
+      backupPassphrase: "correct horse battery staple",
+      emailOtp: "123456",
+      recoveryCode: "abcd-efgh-ijkl",
+      glitchtipDsn: "https://abc@glitchtip.example/1",
+      benignField: "kept",
+    };
+    expect(redactSensitiveFields(body)).toEqual({
+      backupPassphrase: "[redacted]",
+      emailOtp: "[redacted]",
+      recoveryCode: "[redacted]",
+      glitchtipDsn: "[redacted]",
+      benignField: "kept",
+    });
+  });
 });
diff --git a/src/lib/observability/redact-payload.ts b/src/lib/observability/redact-payload.ts
index 4e8b4967b..420fa177f 100644
--- a/src/lib/observability/redact-payload.ts
+++ b/src/lib/observability/redact-payload.ts
@@ -26,6 +26,7 @@
 
 export const SENSITIVE_KEY_PATTERNS: readonly RegExp[] = [
   /password/i,
+  /passphrase/i,
   /token/i,
   /secret/i,
   /apikey/i,
@@ -34,6 +35,14 @@ export const SENSITIVE_KEY_PATTERNS: readonly RegExp[] = [
   /csrfstate/i,
   /csrf[_-]state/i,
   /nonce/i,
+  // Credential-adjacent keys that aren't already covered by the broader
+  // `token` / `secret` patterns. TOTP / email-OTP one-time codes,
+  // account-recovery codes, and the observability DSNs that double as
+  // auth (Glitchtip / Sentry-style `https://<key>@host`) all carry
+  // material worth keeping out of wide-event excerpts.
+  /otp/i,
+  /recovery/i,
+  /dsn/i,
 ];
 
 const REDACTED = "[redacted]";