diff --git a/Cargo.lock b/Cargo.lock
index 8562c86a2c..e9c138c203 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4832,6 +4832,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "rustls 0.21.12",
+ "rustls-native-certs",
  "rustls-pemfile 1.0.4",
  "serde",
  "serde_json",
diff --git a/crates/containerd-shimkit/Cargo.toml b/crates/containerd-shimkit/Cargo.toml
index e21e568afa..996e2b88c5 100644
--- a/crates/containerd-shimkit/Cargo.toml
+++ b/crates/containerd-shimkit/Cargo.toml
@@ -51,6 +51,7 @@ opentelemetry-otlp = { version = "0.16.0", default-features = false, features =
     "grpc-tonic",
     "http-proto",
     "reqwest-client",
+    "reqwest-rustls",
     "trace",
 ], optional = true }
 opentelemetry_sdk = { version = "0.23", default-features = false, features = [
diff --git a/crates/containerd-shimkit/src/sandbox/cli.rs b/crates/containerd-shimkit/src/sandbox/cli.rs
index c419148b72..8c3ab2150b 100644
--- a/crates/containerd-shimkit/src/sandbox/cli.rs
+++ b/crates/containerd-shimkit/src/sandbox/cli.rs
@@ -269,13 +269,18 @@ where
     }
 
     #[cfg(feature = "opentelemetry")]
-    if otel_traces_enabled() {
+    // Only initialize OTEL in serve mode (empty action).
+    if otel_traces_enabled() && flags.action.is_empty() {
         // opentelemetry uses tokio, so we need to initialize a runtime
         async {
-            let otlp_config = OtlpConfig::build_from_env().expect("Failed to build OtelConfig.");
-            let _guard = otlp_config
-                .init()
-                .expect("Failed to initialize OpenTelemetry.");
+            let _guard = OtlpConfig::build_from_env()
+                .and_then(|c| c.init())
+                .map_err(|e| {
+                    eprintln!(
+                        "Failed to initialize OpenTelemetry (continuing without tracing): {e}"
+                    )
+                })
+                .ok();
             tokio::task::block_in_place(move || {
                 shim_main_inner::<I>(name, config);
             });
diff --git a/crates/containerd-shimkit/src/sandbox/shim/otel.rs b/crates/containerd-shimkit/src/sandbox/shim/otel.rs
index dbaec9334c..07bae70942 100644
--- a/crates/containerd-shimkit/src/sandbox/shim/otel.rs
+++ b/crates/containerd-shimkit/src/sandbox/shim/otel.rs
@@ -88,7 +88,7 @@ impl Config {
     /// Initializes the tracer, sets up the telemetry and subscriber layers, and sets the global subscriber.
     ///
     /// Note: this function should be called only once and be called by the binary entry point.
-    pub fn init(&self) -> anyhow::Result<impl Drop> {
+    pub fn init(&self) -> anyhow::Result<ShutdownGuard> {
         let tracer = self.init_tracer()?;
         let telemetry = tracing_opentelemetry::layer().with_tracer(tracer);
         set_text_map_propagator(TraceContextPropagator::new());
@@ -154,7 +154,7 @@ impl Config {
 
 /// Shutdown of the open telemetry services will automatically called when the OtelConfig instance goes out of scope.
 #[must_use]
-struct ShutdownGuard;
+pub struct ShutdownGuard;
 
 impl Drop for ShutdownGuard {
     fn drop(&mut self) {
diff --git a/crates/containerd-shimkit/src/sandbox/sync.rs b/crates/containerd-shimkit/src/sandbox/sync.rs
index 281033d2a0..414d505b87 100644
--- a/crates/containerd-shimkit/src/sandbox/sync.rs
+++ b/crates/containerd-shimkit/src/sandbox/sync.rs
@@ -80,7 +80,7 @@ impl<T> WaitableCell<T> {
     /// The function `f` will always be called, regardless of whether the `WaitableCell` has a value or not.
     /// The `WaitableCell` is going to be set even in the case of an unwind. In this case, ff the function `f`
     /// panics it will cause an abort, so it's recommended to avoid any panics in `f`.
-    pub fn set_guard_with<R: Into<T>, F: FnOnce() -> R>(&self, f: F) -> impl Drop + use<F, T, R> {
+    pub fn set_guard_with<R: Into<T>, F: FnOnce() -> R>(&self, f: F) -> impl Drop {
         let cell = (*self).clone();
         WaitableCellSetGuard { f: Some(f), cell }
     }