diff --git a/.pipelines/templates/stages/trident_rpms/release.yml b/.pipelines/templates/stages/trident_rpms/release.yml
index 0cd2cd86a1..fb0bbe6ba1 100644
--- a/.pipelines/templates/stages/trident_rpms/release.yml
+++ b/.pipelines/templates/stages/trident_rpms/release.yml
@@ -58,6 +58,10 @@ steps:
       version=$(echo $full_version | cut -d'-' -f1)
       prerelease=$(echo $full_version | cut -d'-' -f2-)
 
+      # Application Insights connection string identifying best-effort
+      # telemetry as coming from Trident's own CI/CD pipeline builds
+      AZURE_MONITOR_CONNECTION_STRING="InstrumentationKey=e32fc20f-2cc6-4d86-9e12-ab5d24b366f7;IngestionEndpoint=https://eastus2-3.in.applicationinsights.azure.com/;LiveEndpoint=https://eastus2.livediagnostics.monitor.azure.com/;ApplicationId=fb8e8afb-99bd-4143-ae31-22f9070005e2"
+
       # Build RPMs and export only the artifact tarball (no image load/unpack).
       # CARGO_REGISTRIES_BMP_PUBLICPACKAGES_TOKEN is populated by the CargoAuthenticate task.
       outdir="/tmp/_rpm_artifacts"
@@ -80,6 +84,7 @@ steps:
         --build-arg RPM_PACKAGES="$RPM_PACKAGES" \
         --build-arg RUST_PACKAGE="$RUST_PACKAGE" \
         --build-arg RPM_DEST="$RPM_DEST" \
+        --build-arg AZURE_MONITOR_CONNECTION_STRING="$AZURE_MONITOR_CONNECTION_STRING" \
         --target artifact \
         --output type=local,dest="$outdir" \
         .
diff --git a/packaging/docker/Dockerfile.full b/packaging/docker/Dockerfile.full
index d2766bb73a..1f5f94d404 100644
--- a/packaging/docker/Dockerfile.full
+++ b/packaging/docker/Dockerfile.full
@@ -36,6 +36,12 @@ ARG TRIDENT_VERSION=dev-build
 ARG RPM_VER=0.1.0
 ARG RPM_REL=1
 
+# Application Insights connection string identifying telemetry as coming
+# from Trident's own CI/CD pipeline builds. Set in pipeline template 
+# release.yml -- see trident.spec for how this is consumed
+# (%{trident_azmon_conn_str}).
+ARG AZURE_MONITOR_CONNECTION_STRING=""
+
 ARG RPM_DEST=/usr/src/azl
 
 # This entry needs to exist in the config.toml file to allow cargo to use the
@@ -49,10 +55,14 @@ RUN --mount=type=secret,id=registry_token \
     export CARGO_REGISTRIES_BMP_PUBLICPACKAGES_TOKEN=$(cat /run/secrets/registry_token) && \
     sed -i "s/^Version:.*/Version:        $RPM_VER/" trident.spec && \
     sed -i "s/^Release:.*/Release:        $RPM_REL/" trident.spec && \
-    rpmbuild -bb --build-in-place trident.spec \
+    set -- \
     --define="trident_version $TRIDENT_VERSION" \
     --define="rpm_ver $RPM_VER" \
     --define="rpm_rel $RPM_REL" && \
+    if [ -n "${AZURE_MONITOR_CONNECTION_STRING:-}" ]; then \
+        set -- "$@" --define="trident_azmon_conn_str $AZURE_MONITOR_CONNECTION_STRING"; \
+    fi && \
+    rpmbuild -bb --build-in-place trident.spec "$@" && \
     tar -czvf trident-rpms.tar.gz -C $RPM_DEST ./RPMS
 
 FROM scratch AS artifact
diff --git a/packaging/rpm/trident.spec b/packaging/rpm/trident.spec
index ee37f3a83c..cfdac30fe7 100644
--- a/packaging/rpm/trident.spec
+++ b/packaging/rpm/trident.spec
@@ -11,6 +11,10 @@
 
 %global selinuxtype targeted
 
+# Azure Monitor / Application Insights connection string compiled into the
+# azurelinux distro build of trident binary for best-effort telemetry.
+%global trident_azmon_conn_str_public InstrumentationKey=cb38fc09-8473-4b4a-b5e4-208aa66a974f;IngestionEndpoint=https://eastus-8.in.applicationinsights.azure.com/;LiveEndpoint=https://eastus.livediagnostics.monitor.azure.com/;ApplicationId=b9814e3f-a121-4d99-9ba7-eeaf56195c29
+
 Summary:        Declarative, security-first OS lifecycle agent designed primarily for Azure Linux
 Name:           trident
 # Use hard-coded versions for distro build
@@ -275,9 +279,25 @@ EOF
 %if %{undefined rpm_ver}
 # Use %{version}-%{release} for TRIDENT_VERSION in distro build
 export TRIDENT_VERSION="%{version}-%{release}"
+# Public-usage placeholder connection string (see comment near the top of
+# this spec file).
+export AZURE_MONITOR_CONNECTION_STRING="%{trident_azmon_conn_str_public}"
 %else
 # Use %{trident_version} for Trident repo build
 export TRIDENT_VERSION="%{trident_version}"
+# Connection string identifying telemetry as coming from Trident's own
+# CI/CD pipeline builds (as opposed to azurelinux distro-package installs,
+# which use the different, hardcoded connection string above). Hardcoded in
+# .pipelines/templates/stages/trident_rpms/release.yml and passed through
+# to this spec as an rpmbuild --define, the same way %{trident_version} is.
+#
+# Use the optional-expansion form (`%{?...}`): repo-build paths that define
+# rpm_ver but do not pass --define trident_azmon_conn_str (e.g.
+# packaging/docker/Dockerfile.full.public) must fall back to an empty
+# string, matching the documented no-telemetry default -- not the literal,
+# undefined `%{trident_azmon_conn_str}` text RPM would otherwise leave in
+# place.
+export AZURE_MONITOR_CONNECTION_STRING="%{?trident_azmon_conn_str}"
 %endif
 cargo build --release -p trident -p trident-acl-agent