diff --git a/packages/core-eslint/base.js b/packages/core-eslint/base.js
index 34cf5ab..bab3131 100644
--- a/packages/core-eslint/base.js
+++ b/packages/core-eslint/base.js
@@ -85,17 +85,36 @@ export default [
     },
   },
   // R40 allowlist — the only paths permitted to import @sentry/*.
+  // After the OTel migration (ADR-017): server-side Sentry SDK usage is limited to
+  // the OTel bridge + browser/client init files. The @sentry/* ESLint restriction
+  // stays; the allowlist is narrowed from the original "**/instrumentation/sentry/**".
   // Patterns are double-star prefixed so they match whether eslint runs from
   // the repo root or from inside a sub-package.
   {
     files: [
-      "**/instrumentation/sentry/**",
+      // OTel bridge — the only server-side file that may import @sentry/opentelemetry
       "**/instrumentation/otel/sentry-bridge.{ts,js}",
       "**/instrumentation/otel/sentry-bridge.test.{ts,js}",
+      // OTel DI binder — may import @sentry/opentelemetry via sentry-bridge
       "**/instrumentation/di/bind-otel-instrumentation.{ts,js}",
       "**/instrumentation/di/bind-otel-instrumentation.test.{ts,js}",
+      // Browser-side Sentry init helpers (server-only migration — browser keeps Sentry SDK directly)
+      "**/instrumentation/sentry/init-client.{ts,js}",
+      "**/instrumentation/sentry/init-client.test.{ts,js}",
+      "**/instrumentation/sentry/init-client-react.{ts,js}",
+      "**/instrumentation/sentry/init-client-react.test.{ts,js}",
+      // Server-side Sentry SDK init still used by apps (calls Sentry.init with DSN)
+      "**/instrumentation/sentry/init-server.{ts,js}",
+      "**/instrumentation/sentry/init-server.test.{ts,js}",
+      "**/instrumentation/sentry/init-server-node.{ts,js}",
+      "**/instrumentation/sentry/init-server-node.test.{ts,js}",
+      // Test guard — mocks Sentry + OTel SDKs to prevent real init in test processes
+      "**/setup/no-instrumentation.{ts,js}",
+      "**/setup/no-instrumentation.test.{ts,js}",
+      // Legacy alias for one release cycle
       "**/setup/no-sentry.{ts,js}",
       "**/setup/no-sentry.test.{ts,js}",
+      // App-level instrumentation entry points and build config
       "**/instrumentation.{ts,js,mjs}",
       "**/instrumentation-client.{ts,js,mjs}",
       "**/next.config.{mjs,ts,js}",
@@ -107,12 +126,20 @@ export default [
     },
   },
   // R52 — OTel SDK packages (@opentelemetry/sdk-*, @opentelemetry/resources,
-  // @opentelemetry/semantic-conventions, @sentry/opentelemetry) are restricted
-  // to core-shared/instrumentation/otel/ and app-level init paths. The
-  // vendor-neutral API packages (@opentelemetry/api, @opentelemetry/api-logs)
-  // are unrestricted and do not need a rule here.
+  // @opentelemetry/semantic-conventions, @opentelemetry/instrumentation-*,
+  // @sentry/opentelemetry) are restricted to core-shared/instrumentation/otel/
+  // and app-level init paths.
+  // The vendor-neutral API packages (@opentelemetry/api, @opentelemetry/api-logs)
+  // are unrestricted within core-shared/instrumentation/ — features use them for
+  // advanced tracing without coupling to the SDK.
   {
-    files: ["**/instrumentation/otel/**/*.{ts,tsx,mjs,cjs,js}"],
+    files: [
+      "**/instrumentation/otel/**/*.{ts,tsx,mjs,cjs,js}",
+      // App-level init and build config also allowed to import OTel SDK packages
+      "**/instrumentation.{ts,js,mjs}",
+      "**/next.config.{mjs,ts,js}",
+      "**/vite.config.{ts,mjs,js}",
+    ],
     rules: {
       "no-restricted-imports": "off",
     },