diff --git a/keystore2/Android.bp b/keystore2/Android.bp
index b591d8c..9c3ce6e 100644
--- a/keystore2/Android.bp
+++ b/keystore2/Android.bp
@@ -106,6 +106,7 @@
         "libkeystore2",
         "liblog_rust",
         "liblegacykeystore-rust",
+        "librusqlite",
     ],
     init_rc: ["keystore2.rc"],
 
diff --git a/keystore2/src/keystore2_main.rs b/keystore2/src/keystore2_main.rs
index f1f01c6..abab4b6 100644
--- a/keystore2/src/keystore2_main.rs
+++ b/keystore2/src/keystore2_main.rs
@@ -25,7 +25,8 @@
 use keystore2::{authorization::AuthorizationManager, id_rotation::IdRotationState};
 use legacykeystore::LegacyKeystore;
 use log::{error, info};
-use std::{panic, path::Path, sync::mpsc::channel};
+use rusqlite::trace as sqlite_trace;
+use std::{os::raw::c_int, panic, path::Path, sync::mpsc::channel};
 
 static KS2_SERVICE_NAME: &str = "android.system.keystore2.IKeystoreService/default";
 static APC_SERVICE_NAME: &str = "android.security.apc";
@@ -52,6 +53,14 @@
     let mut args = std::env::args();
     args.next().expect("That's odd. How is there not even a first argument?");
 
+    // This must happen early before any other sqlite operations.
+    log::info!("Setting up sqlite logging for keystore2");
+    fn sqlite_log_handler(err: c_int, message: &str) {
+        log::error!("[SQLITE3] {}: {}", err, message);
+    }
+    unsafe { sqlite_trace::config_log(Some(sqlite_log_handler)) }
+        .expect("Error setting sqlite log callback.");
+
     // Write/update keystore.crash_count system property.
     metrics_store::update_keystore_crash_sysprop();