diff --git a/deploy/setup.sh b/deploy/setup.sh
index 99e28ab..2742330 100755
--- a/deploy/setup.sh
+++ b/deploy/setup.sh
@@ -8,10 +8,12 @@ id -u dbugs &>/dev/null || useradd --system --no-create-home --shell /usr/sbin/n
 install -d -o dbugs -g dbugs -m 0750 /var/lib/dbugs
 install -d -o dbugs -g dbugs -m 0750 /var/lib/dbugs/certs
 
-echo "==> automatic security updates"
+echo "==> automatic security updates + trace tooling"
 export DEBIAN_FRONTEND=noninteractive
 apt-get update -qq
-apt-get install -y -qq unattended-upgrades
+# jq: spans are JSON lines in journald (OTEL_TRACES_EXPORTER=console); jq is how
+# they're queried on the box — see deploy/README.md "Observe".
+apt-get install -y -qq unattended-upgrades jq
 systemctl enable --now unattended-upgrades
 
 echo "==> done."