diff --git a/packages/core-eslint/base.js b/packages/core-eslint/base.js
index 1c2fd36..90ed3ef 100644
--- a/packages/core-eslint/base.js
+++ b/packages/core-eslint/base.js
@@ -118,6 +118,17 @@ export default [
               message:
                 "Import from @repo/core-shared/instrumentation instead — feature packages must not depend on Sentry directly.",
             },
+            {
+              group: [
+                "@opentelemetry/sdk-*",
+                "@opentelemetry/exporter-*",
+                "@opentelemetry/instrumentation-*",
+                "@opentelemetry/resources",
+                "@opentelemetry/semantic-conventions",
+              ],
+              message:
+                "OTel SDK imports are restricted to core-shared/instrumentation/otel/ and app init paths — import @repo/core-shared/instrumentation instead (ADR-017).",
+            },
           ],
         },
       ],
@@ -176,6 +187,9 @@ export default [
       "**/instrumentation.{ts,js,mjs}",
       "**/next.config.{mjs,ts,js}",
       "**/vite.config.{ts,mjs,js}",
+      // core-audit's trace-id enrichment test builds a real in-memory tracer
+      // (@opentelemetry/sdk-trace-base) to assert trace-id propagation.
+      "**/trace-id-enriching-audit-log.test.{ts,js}",
     ],
     rules: {
       "no-restricted-imports": "off",