diff --git a/lib/src/blockdev.rs b/lib/src/blockdev.rs
index 8631902fb..cd9c58b1f 100644
--- a/lib/src/blockdev.rs
+++ b/lib/src/blockdev.rs
@@ -98,6 +98,7 @@ pub(crate) fn list_dev(dev: &Utf8Path) -> Result<Device> {
     let mut devs: DevicesOutput = Command::new("lsblk")
         .args(["-J", "-b", "-O"])
         .arg(dev)
+        .log_debug()
         .run_and_parse_json()?;
     for dev in devs.blockdevices.iter_mut() {
         dev.backfill_missing()?;
diff --git a/lib/src/lsm.rs b/lib/src/lsm.rs
index ddd308a3f..af0306658 100644
--- a/lib/src/lsm.rs
+++ b/lib/src/lsm.rs
@@ -6,6 +6,7 @@ use std::path::Path;
 use std::process::Command;
 
 use anyhow::{Context, Result};
+use bootc_utils::CommandRunExt;
 use camino::{Utf8Path, Utf8PathBuf};
 use cap_std::fs::Dir;
 #[cfg(feature = "install")]
@@ -95,7 +96,7 @@ pub(crate) fn selinux_ensure_install() -> Result<bool> {
     let mut cmd = Command::new(&tmpf);
     cmd.env(guardenv, tmpf);
     cmd.args(std::env::args_os().skip(1));
-    tracing::debug!("Re-executing {cmd:?}");
+    cmd.log_debug();
     Err(anyhow::Error::msg(cmd.exec()).context("execve"))
 }
 
diff --git a/lib/src/mount.rs b/lib/src/mount.rs
index f830df327..da5af05c0 100644
--- a/lib/src/mount.rs
+++ b/lib/src/mount.rs
@@ -38,6 +38,7 @@ fn run_findmnt(args: &[&str], path: &str) -> Result<Filesystem> {
         ])
         .args(args)
         .arg(path)
+        .log_debug()
         .run_and_parse_json()?;
     o.filesystems
         .into_iter()
diff --git a/utils/src/command.rs b/utils/src/command.rs
index 0ce4b464f..3f3e7c427 100644
--- a/utils/src/command.rs
+++ b/utils/src/command.rs
@@ -9,8 +9,12 @@ use anyhow::{Context, Result};
 
 /// Helpers intended for [`std::process::Command`].
 pub trait CommandRunExt {
+    /// Log (at debug level) the full child commandline.
+    fn log_debug(&mut self) -> &mut Self;
+
     /// Execute the child process.
     fn run(&mut self) -> Result<()>;
+
     /// Execute the child process, parsing its stdout as JSON.
     fn run_and_parse_json<T: serde::de::DeserializeOwned>(&mut self) -> Result<T>;
 }
@@ -71,9 +75,20 @@ impl CommandRunExt for Command {
     fn run(&mut self) -> Result<()> {
         let stderr = tempfile::tempfile()?;
         self.stderr(stderr.try_clone()?);
+        tracing::trace!("exec: {self:?}");
         self.status()?.check_status(stderr)
     }
 
+    /// Output a debug-level log message with this command.
+    fn log_debug(&mut self) -> &mut Self {
+        // We unconditionally log at trace level, so avoid double logging
+        if !tracing::enabled!(tracing::Level::TRACE) {
+            tracing::debug!("exec: {self:?}");
+        }
+        self
+    }
+
+    /// Synchronously execute the child, and parse its stdout as JSON.
     fn run_and_parse_json<T: serde::de::DeserializeOwned>(&mut self) -> Result<T> {
         let mut stdout = tempfile::tempfile()?;
         self.stdout(stdout.try_clone()?);