diff --git a/driver/registry_sql.go b/driver/registry_sql.go
index 5efd273d111..7660a884c90 100644
--- a/driver/registry_sql.go
+++ b/driver/registry_sql.go
@@ -72,6 +72,8 @@ func (m *RegistrySQL) Init(
 		if m.Tracer(ctx).IsLoaded() {
 			opts = []instrumentedsql.Opt{
 				instrumentedsql.WithTracer(otelsql.NewTracer()),
+				instrumentedsql.WithOmitArgs(), // don't risk leaking PII or secrets
+				instrumentedsql.WithOpsExcluded(instrumentedsql.OpSQLRowsNext),
 			}
 		}