diff --git a/api/client/client_test.go b/api/client/client_test.go
index 76181279b1e1a..5ed38a0e7f94f 100644
--- a/api/client/client_test.go
+++ b/api/client/client_test.go
@@ -29,7 +29,6 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -37,6 +36,7 @@ import (
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/defaults"
 	"github.com/gravitational/teleport/api/metadata"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 )
 
diff --git a/api/client/proxy/client_test.go b/api/client/proxy/client_test.go
index 6a1671aaf8f37..264991cdb8c54 100644
--- a/api/client/proxy/client_test.go
+++ b/api/client/proxy/client_test.go
@@ -30,7 +30,6 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
@@ -44,6 +43,7 @@ import (
 	"github.com/gravitational/teleport/api/client"
 	"github.com/gravitational/teleport/api/client/proto"
 	transportv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/transport/v1"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/utils/grpc/stream"
 )
 
diff --git a/api/client/proxy/transport/transportv1/client_test.go b/api/client/proxy/transport/transportv1/client_test.go
index ce1579c9ce7cd..6cc7d8b835ba4 100644
--- a/api/client/proxy/transport/transportv1/client_test.go
+++ b/api/client/proxy/transport/transportv1/client_test.go
@@ -29,7 +29,6 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh/agent"
 	"google.golang.org/grpc"
@@ -37,6 +36,7 @@ import (
 	"google.golang.org/grpc/test/bufconn"
 
 	transportv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/transport/v1"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/utils/grpc/interceptors"
 	streamutils "github.com/gravitational/teleport/api/utils/grpc/stream"
 )
diff --git a/api/client/secreport/crud.go b/api/client/secreport/crud.go
index 0126be6be2fdc..e876f29fd3612 100644
--- a/api/client/secreport/crud.go
+++ b/api/client/secreport/crud.go
@@ -20,9 +20,9 @@ import (
 	"context"
 
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 
 	pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/secreports/v1"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types/secreports"
 	v1 "github.com/gravitational/teleport/api/types/secreports/convert/v1"
 )
diff --git a/api/client/secreport/secreport.go b/api/client/secreport/secreport.go
index 075c89bb5b14f..9c1eba1c51439 100644
--- a/api/client/secreport/secreport.go
+++ b/api/client/secreport/secreport.go
@@ -20,9 +20,9 @@ import (
 	"context"
 
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 
 	pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/secreports/v1"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types/secreports"
 	v1 "github.com/gravitational/teleport/api/types/secreports/convert/v1"
 )
diff --git a/api/trail/trail.go b/api/trail/trail.go
new file mode 100644
index 0000000000000..56049af3a93cc
--- /dev/null
+++ b/api/trail/trail.go
@@ -0,0 +1,313 @@
+/*
+Copyright 2016 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package trail integrates trace errors with GRPC
+//
+// Example server that sends the GRPC error and attaches metadata:
+//
+//	func (s *server) Echo(ctx context.Context, message *gw.StringMessage) (*gw.StringMessage, error) {
+//		trace.SetDebug(true) // to tell trace to start attaching metadata
+//		// Send sends metadata via grpc header and converts error to GRPC compatible one
+//		return nil, trail.Send(ctx, trace.AccessDenied("missing authorization"))
+//	}
+//
+// Example client reading error and trace debug info:
+//
+//	var header metadata.MD
+//	r, err := c.Echo(context.Background(), &gw.StringMessage{Value: message}, grpc.Header(&header))
+//	if err != nil {
+//		// FromGRPC reads error, converts it back to trace error and attaches debug metadata
+//		// like stack trace of the error origin back to the error
+//		err = trail.FromGRPC(err, header)
+//
+//		// this line will log original trace of the error
+//		log.Errorf("error saying echo: %v", trace.DebugReport(err))
+//		return
+//	}
+package trail
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"runtime"
+
+	"github.com/gravitational/trace"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+)
+
+// DebugReportMetadata is a key in metadata holding debug information
+// about the error - stack traces and original error
+const debugReportMetadata = "trace-debug-report"
+
+// ToGRPC converts error to GRPC-compatible error
+func ToGRPC(originalErr error) error {
+	if originalErr == nil {
+		return nil
+	}
+
+	// Avoid modifying top-level gRPC errors.
+	if _, ok := status.FromError(originalErr); ok {
+		return originalErr
+	}
+
+	code := codes.Unknown
+	returnOriginal := false
+	traverseErr(originalErr, func(err error) (ok bool) {
+		if errors.Is(err, io.EOF) {
+			// Keep legacy semantics and return the original error.
+			returnOriginal = true
+			return true
+		}
+
+		if s, ok := status.FromError(err); ok {
+			code = s.Code()
+			return true
+		}
+
+		// Duplicate check from trace.IsNotFound.
+		if os.IsNotExist(err) {
+			code = codes.NotFound
+			return true
+		}
+
+		ok = true // Assume match
+
+		var (
+			accessDeniedErr      *trace.AccessDeniedError
+			alreadyExistsErr     *trace.AlreadyExistsError
+			badParameterErr      *trace.BadParameterError
+			compareFailedErr     *trace.CompareFailedError
+			connectionProblemErr *trace.ConnectionProblemError
+			limitExceededErr     *trace.LimitExceededError
+			notFoundErr          *trace.NotFoundError
+			notImplementedErr    *trace.NotImplementedError
+			oauthErr             *trace.OAuth2Error
+		)
+		if errors.As(err, &accessDeniedErr) {
+			code = codes.PermissionDenied
+		} else if errors.As(err, &alreadyExistsErr) {
+			code = codes.AlreadyExists
+		} else if errors.As(err, &badParameterErr) {
+			code = codes.InvalidArgument
+		} else if errors.As(err, &compareFailedErr) {
+			code = codes.FailedPrecondition
+		} else if errors.As(err, &connectionProblemErr) {
+			code = codes.Unavailable
+		} else if errors.As(err, &limitExceededErr) {
+			code = codes.ResourceExhausted
+		} else if errors.As(err, &notFoundErr) {
+			code = codes.NotFound
+		} else if errors.As(err, &notImplementedErr) {
+			code = codes.Unimplemented
+		} else if errors.As(err, &oauthErr) {
+			code = codes.InvalidArgument
+		} else {
+			// *trace.RetryError not mapped.
+			// *trace.TrustError not mapped.
+			ok = false
+		}
+
+		return ok
+	})
+	if returnOriginal {
+		return originalErr
+	}
+
+	return status.Error(code, trace.UserMessage(originalErr))
+}
+
+// FromGRPC converts error from GRPC error back to trace.Error
+// Debug information will be retrieved from the metadata if specified in args
+func FromGRPC(err error, args ...interface{}) error {
+	if err == nil {
+		return nil
+	}
+
+	statusErr := status.Convert(err)
+	code := statusErr.Code()
+	message := statusErr.Message()
+
+	var e error
+	switch code {
+	case codes.OK:
+		return nil
+	case codes.NotFound:
+		e = &trace.NotFoundError{Message: message}
+	case codes.AlreadyExists:
+		e = &trace.AlreadyExistsError{Message: message}
+	case codes.PermissionDenied:
+		e = &trace.AccessDeniedError{Message: message}
+	case codes.FailedPrecondition:
+		e = &trace.CompareFailedError{Message: message}
+	case codes.InvalidArgument:
+		e = &trace.BadParameterError{Message: message}
+	case codes.ResourceExhausted:
+		e = &trace.LimitExceededError{Message: message}
+	case codes.Unavailable:
+		e = &trace.ConnectionProblemError{Message: message}
+	case codes.Unimplemented:
+		e = &trace.NotImplementedError{Message: message}
+	default:
+		e = err
+	}
+	if len(args) != 0 {
+		if meta, ok := args[0].(metadata.MD); ok {
+			e = decodeDebugInfo(e, meta)
+			// We return here because if it's a trace.Error then
+			// frames was already extracted from metadata so
+			// there's no need to capture frames once again.
+			var traceErr trace.Error
+			if errors.As(e, &traceErr) {
+				return e
+			}
+		}
+	}
+	traces := captureTraces(1)
+	return &trace.TraceErr{Err: e, Traces: traces}
+}
+
+// setDebugInfo adds debug metadata about error (traces, original error)
+// to request metadata as encoded property
+func setDebugInfo(err error, meta metadata.MD) {
+	var traceErr trace.Error
+	if !errors.As(err, &traceErr) {
+		return
+	}
+
+	out, err := json.Marshal(err)
+	if err != nil {
+		return
+	}
+	meta[debugReportMetadata] = []string{
+		base64.StdEncoding.EncodeToString(out),
+	}
+}
+
+// decodeDebugInfo decodes debug information about error
+// from the metadata and returns error with enriched metadata about it
+func decodeDebugInfo(err error, meta metadata.MD) error {
+	if len(meta) == 0 {
+		return err
+	}
+	encoded, ok := meta[debugReportMetadata]
+	if !ok || len(encoded) != 1 {
+		return err
+	}
+	data, decodeErr := base64.StdEncoding.DecodeString(encoded[0])
+	if decodeErr != nil {
+		return err
+	}
+	var raw trace.RawTrace
+	if unmarshalErr := json.Unmarshal(data, &raw); unmarshalErr != nil {
+		return err
+	}
+	if len(raw.Traces) != 0 && len(raw.Err) != 0 {
+		return &trace.TraceErr{Traces: raw.Traces, Err: err, Message: raw.Message}
+	}
+	return err
+}
+
+// traverseErr traverses the err error chain until fn returns true.
+// Traversal stops on nil errors, fn(nil) is never called.
+// Returns true if fn matched, false otherwise.
+func traverseErr(err error, fn func(error) (ok bool)) (ok bool) {
+	if err == nil {
+		return false
+	}
+
+	if fn(err) {
+		return true
+	}
+
+	type singleUnwrap interface {
+		Unwrap() error
+	}
+
+	type aggregateUnwrap interface {
+		Unwrap() []error
+	}
+
+	var singleErr singleUnwrap
+	var aggregateErr aggregateUnwrap
+
+	if errors.As(err, &singleErr) {
+		return traverseErr(singleErr.Unwrap(), fn)
+	}
+
+	if errors.As(err, &aggregateErr) {
+		for _, err2 := range aggregateErr.Unwrap() {
+			if traverseErr(err2, fn) {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// FrameCursor stores the position in a call stack
+type frameCursor struct {
+	// Current specifies the current stack frame.
+	// if omitted, rest contains the complete stack
+	Current *runtime.Frame
+	// Rest specifies the rest of stack frames to explore
+	Rest *runtime.Frames
+	// N specifies the total number of stack frames
+	N int
+}
+
+// CaptureTraces gets the current stack trace with some deep frames skipped
+func captureTraces(skip int) trace.Traces {
+	var buf [32]uintptr
+	// +2 means that we also skip `CaptureTraces` and `runtime.Callers` frames.
+	n := runtime.Callers(skip+2, buf[:])
+	pcs := buf[:n]
+	frames := runtime.CallersFrames(pcs)
+	cursor := frameCursor{
+		Rest: frames,
+		N:    n,
+	}
+	return getTracesFromCursor(cursor)
+}
+
+// GetTracesFromCursor gets the current stack trace from a given cursor
+func getTracesFromCursor(cursor frameCursor) trace.Traces {
+	traces := make(trace.Traces, 0, cursor.N)
+	if cursor.Current != nil {
+		traces = append(traces, frameToTrace(*cursor.Current))
+	}
+	for i := 0; i < cursor.N; i++ {
+		frame, more := cursor.Rest.Next()
+		traces = append(traces, frameToTrace(frame))
+		if !more {
+			break
+		}
+	}
+	return traces
+}
+
+func frameToTrace(frame runtime.Frame) trace.Trace {
+	return trace.Trace{
+		Func: frame.Function,
+		Path: frame.File,
+		Line: frame.Line,
+	}
+}
diff --git a/api/trail/trail_test.go b/api/trail/trail_test.go
new file mode 100644
index 0000000000000..3e63568aaac68
--- /dev/null
+++ b/api/trail/trail_test.go
@@ -0,0 +1,188 @@
+/*
+Copyright 2016 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package trail
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/gravitational/trace"
+	"github.com/stretchr/testify/assert"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+)
+
+// TestConversion makes sure we convert all trace supported errors
+// to and back from GRPC codes
+func TestConversion(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		fn   func(error) bool
+	}{
+		{
+			name: "io.EOF",
+			err:  io.EOF,
+			fn:   func(err error) bool { return errors.Is(err, io.EOF) },
+		},
+		{
+			name: "os.ErrNotExist",
+			err:  os.ErrNotExist,
+			fn:   trace.IsNotFound,
+		},
+		{
+			name: "AccessDenied",
+			err:  trace.AccessDenied("access denied"),
+			fn:   trace.IsAccessDenied,
+		},
+		{
+			name: "AlreadyExists",
+			err:  trace.AlreadyExists("already exists"),
+			fn:   trace.IsAlreadyExists,
+		},
+		{
+			name: "BadParameter",
+			err:  trace.BadParameter("bad parameter"),
+			fn:   trace.IsBadParameter,
+		},
+		{
+			name: "CompareFailed",
+			err:  trace.CompareFailed("compare failed"),
+			fn:   trace.IsCompareFailed,
+		},
+		{
+			name: "ConnectionProblem",
+			err:  trace.ConnectionProblem(nil, "problem"),
+			fn:   trace.IsConnectionProblem,
+		},
+		{
+			name: "LimitExceeded",
+			err:  trace.LimitExceeded("exceeded"),
+			fn:   trace.IsLimitExceeded,
+		},
+		{
+			name: "NotFound",
+			err:  trace.NotFound("not found"),
+			fn:   trace.IsNotFound,
+		},
+		{
+			name: "NotImplemented",
+			err:  trace.NotImplemented("not implemented"),
+			fn:   trace.IsNotImplemented,
+		},
+		{
+			name: "Aggregated BadParameter",
+			err:  trace.NewAggregate(trace.BadParameter("bad parameter")),
+			fn:   trace.IsBadParameter,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			grpcError := ToGRPC(test.err)
+			assert.Equal(t, test.err.Error(), status.Convert(grpcError).Message(), "Error message mismatch")
+
+			out := FromGRPC(grpcError)
+			assert.True(t, test.fn(out), "Predicate failed")
+			assert.Regexp(t, ".*trail_test.go.*", line(trace.DebugReport(out)))
+			assert.NotRegexp(t, ".*trail.go.*", line(trace.DebugReport(out)))
+		})
+	}
+}
+
+// TestNil makes sure conversions of nil to and from GRPC are no-op
+func TestNil(t *testing.T) {
+	out := FromGRPC(ToGRPC(nil))
+	assert.NoError(t, out)
+}
+
+// TestFromEOF makes sure that non-grpc error such as io.EOF is preserved well.
+func TestFromEOF(t *testing.T) {
+	out := FromGRPC(trace.Wrap(io.EOF))
+	assert.True(t, trace.IsEOF(out))
+}
+
+// TestTraces makes sure we pass traces via metadata and can decode it back
+func TestTraces(t *testing.T) {
+	err := trace.BadParameter("param")
+	meta := metadata.New(nil)
+	setDebugInfo(err, meta)
+	err2 := FromGRPC(ToGRPC(err), meta)
+	assert.Regexp(t, ".*trail_test.go.*", line(trace.DebugReport(err)))
+	assert.Regexp(t, ".*trail_test.go.*", line(trace.DebugReport(err2)))
+}
+
+func line(s string) string {
+	return strings.ReplaceAll(s, "\n", "")
+}
+
+func TestToGRPCKeepCode(t *testing.T) {
+	err := status.Errorf(codes.PermissionDenied, "denied")
+	err = ToGRPC(err)
+	if code := status.Code(err); code != codes.PermissionDenied {
+		t.Errorf("after ToGRPC, got error code %v, want %v, error: %v", code, codes.PermissionDenied, err)
+	}
+	err = FromGRPC(err)
+	if !trace.IsAccessDenied(err) {
+		t.Errorf("after FromGRPC, trace.IsAccessDenied is false, want true, error: %v", err)
+	}
+}
+
+func TestToGRPC_statusError(t *testing.T) {
+	err1 := status.Errorf(codes.NotFound, "not found")
+	err2 := fmt.Errorf("go wrap: %w", trace.Wrap(err1))
+
+	tests := []struct {
+		name string
+		err  error
+		want error
+	}{
+		{
+			name: "unwrapped status",
+			err:  err1,
+			want: err1, // Exact same error.
+		},
+		{
+			name: "wrapped status",
+			err:  err2,
+			want: status.Errorf(codes.NotFound, "%s", err2.Error()),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			err := ToGRPC(test.err)
+
+			got, ok := status.FromError(err)
+			if !ok {
+				t.Fatalf("Failed to convert `got` to a status.Status: %#v", err)
+			}
+			want, ok := status.FromError(test.want)
+			if !ok {
+				t.Fatalf("Failed to convert `want` to a status.Status: %#v", err)
+			}
+
+			if got.Code() != want.Code() || got.Message() != want.Message() {
+				t.Errorf("ToGRPC = %#v, want %#v", got, test.want)
+			}
+		})
+	}
+}
diff --git a/api/utils/grpc/interceptors/errors.go b/api/utils/grpc/interceptors/errors.go
index 3b9e834b60c18..7b57ceaabb26d 100644
--- a/api/utils/grpc/interceptors/errors.go
+++ b/api/utils/grpc/interceptors/errors.go
@@ -20,8 +20,9 @@ import (
 	"io"
 
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"google.golang.org/grpc"
+
+	"github.com/gravitational/teleport/api/trail"
 )
 
 // grpcServerStreamWrapper wraps around the embedded grpc.ServerStream
diff --git a/api/utils/grpc/interceptors/mfa.go b/api/utils/grpc/interceptors/mfa.go
index e8dae8e45e1f7..1ee839e0b4e41 100644
--- a/api/utils/grpc/interceptors/mfa.go
+++ b/api/utils/grpc/interceptors/mfa.go
@@ -21,10 +21,10 @@ import (
 	"strings"
 
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"google.golang.org/grpc"
 
 	"github.com/gravitational/teleport/api/mfa"
+	"github.com/gravitational/teleport/api/trail"
 )
 
 // WithMFAUnaryInterceptor intercepts a GRPC client unary call to add MFA credentials
diff --git a/e_imports.go b/e_imports.go
index 395fe59a5ef03..3ab13c5443981 100644
--- a/e_imports.go
+++ b/e_imports.go
@@ -89,7 +89,6 @@ import (
 	_ "github.com/gravitational/license/generate"
 	_ "github.com/gravitational/roundtrip"
 	_ "github.com/gravitational/trace"
-	_ "github.com/gravitational/trace/trail"
 	_ "github.com/jackc/pgx/v5"
 	_ "github.com/jackc/pgx/v5/pgconn"
 	_ "github.com/jackc/pgx/v5/pgtype"
diff --git a/go.mod b/go.mod
index 8ae6a28acf19c..2e70fa15e85e9 100644
--- a/go.mod
+++ b/go.mod
@@ -134,7 +134,7 @@ require (
 	github.com/gravitational/license v0.0.0-20240313232707-8312e719d624
 	github.com/gravitational/roundtrip v1.0.2
 	github.com/gravitational/teleport/api v0.0.0
-	github.com/gravitational/trace v1.4.1
+	github.com/gravitational/trace v1.5.0
 	github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0
 	github.com/guptarohit/asciigraph v0.7.2
@@ -595,5 +595,5 @@ replace (
 	github.com/keys-pub/go-libfido2 => github.com/gravitational/go-libfido2 v1.5.3-teleport.1
 	github.com/microsoft/go-mssqldb => github.com/gravitational/go-mssqldb v0.11.1-0.20230331180905-0f76f1751cd3
 	github.com/redis/go-redis/v9 => github.com/gravitational/redis/v9 v9.6.1-teleport.1
-	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.1
+	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.4
 )
diff --git a/go.sum b/go.sum
index 381224dcfe575..76a1cf0099dcd 100644
--- a/go.sum
+++ b/go.sum
@@ -1568,8 +1568,8 @@ github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33 h1:VFE
 github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
 github.com/gravitational/license v0.0.0-20240313232707-8312e719d624 h1:TjiJ98fWU5N28MBktP5vj1/xohin7cX/JBPPJ8iCiTE=
 github.com/gravitational/license v0.0.0-20240313232707-8312e719d624/go.mod h1:pERQ8qtFfvV0Pfw9jA5o1WH1snupQQ3SZ+n8CVdRJNs=
-github.com/gravitational/predicate v1.3.1 h1:f1uGg2FF6z5wZbcafYpLZJ1gl+82I0MlSd0cQKDPQe0=
-github.com/gravitational/predicate v1.3.1/go.mod h1:H5e9dUW7zb/cuKkkhfnyT9SsI/WHWJ8Ra011La16DTY=
+github.com/gravitational/predicate v1.3.4 h1:9N3JhBXNPcUh0w8DdlpnVmfnH9Z3xxbw43sD3E19VBE=
+github.com/gravitational/predicate v1.3.4/go.mod h1:cTQkp40X3YejTcWsZGvzAtfa28VXfBxT10H/Grt0Fzs=
 github.com/gravitational/protobuf v1.3.2-teleport.1 h1:h5mh+UOKPurqDxn1hRVcr1WzSkmBi+D9qkXpaXA9PFM=
 github.com/gravitational/protobuf v1.3.2-teleport.1/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/gravitational/redis/v9 v9.6.1-teleport.1 h1:gPirfPKArN2nPhTKR3h9fnEg5YuYU933+CjlDJMo4H0=
@@ -1578,8 +1578,8 @@ github.com/gravitational/roundtrip v1.0.2 h1:eOCY0NEKKaB0ksJmvhO6lPMFz1pIIef+vyP
 github.com/gravitational/roundtrip v1.0.2/go.mod h1:fuI1booM2hLRA/B/m5MRAPOU6mBZNYcNycono2UuTw0=
 github.com/gravitational/saml v0.4.15-teleport.1 h1:kYSLpxEBEc7JLJJ+VjsZU8PbWI4gWxdCgll5cq1/rGU=
 github.com/gravitational/saml v0.4.15-teleport.1/go.mod h1:S4+611dxnKt8z/ulbvaJzcgSHsuhjVc1QHNTcr1R7Fw=
-github.com/gravitational/trace v1.4.1 h1:IpaQyg/HzBApX34VIyy4tCZF2wB839AEAMT13sTYYmE=
-github.com/gravitational/trace v1.4.1/go.mod h1:oEs/tamajqgZ6/oEb31Hbh50BODsd2H/1iOAkQRDkdg=
+github.com/gravitational/trace v1.5.0 h1:JbeL2HDGyzgy7G72Z2hP2gExEyA6Y2p7fCiSjyZwCJw=
+github.com/gravitational/trace v1.5.0/go.mod h1:dxezSkKm880IIDx+czWG8fq+pLnXjETBewMgN3jOBlg=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 h1:qnpSQwGEnkcRpTqNOIR6bJbR0gAorgP9CSALpRcKoAA=
diff --git a/integration/integration_test.go b/integration/integration_test.go
index 8a4580db394c4..65b49944037c6 100644
--- a/integration/integration_test.go
+++ b/integration/integration_test.go
@@ -49,7 +49,6 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"github.com/pkg/sftp"
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
@@ -71,6 +70,7 @@ import (
 	tracessh "github.com/gravitational/teleport/api/observability/tracing/ssh"
 	"github.com/gravitational/teleport/api/profile"
 	apihelpers "github.com/gravitational/teleport/api/testhelpers"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	apiutils "github.com/gravitational/teleport/api/utils"
diff --git a/integrations/event-handler/go.mod b/integrations/event-handler/go.mod
index ca8218c09fd36..af44aea29a05e 100644
--- a/integrations/event-handler/go.mod
+++ b/integrations/event-handler/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/gravitational/teleport v0.0.0-00010101000000-000000000000
 	github.com/gravitational/teleport/api v0.0.0
-	github.com/gravitational/trace v1.4.1
+	github.com/gravitational/trace v1.5.0
 	github.com/jonboulle/clockwork v0.4.0
 	github.com/json-iterator/go v1.1.12
 	github.com/manifoldco/promptui v0.9.0
@@ -360,5 +360,5 @@ replace (
 	// otherwise tests fail with a data race detection.
 	github.com/moby/spdystream => github.com/gravitational/spdystream v0.0.0-20230512133543-4e46862ca9bf
 	github.com/redis/go-redis/v9 => github.com/gravitational/redis/v9 v9.6.1-teleport.1
-	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.1
+	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.4
 )
diff --git a/integrations/event-handler/go.sum b/integrations/event-handler/go.sum
index ddfe0f0135584..ab118bd8fdec6 100644
--- a/integrations/event-handler/go.sum
+++ b/integrations/event-handler/go.sum
@@ -497,8 +497,8 @@ github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33 h1:VFE
 github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
 github.com/gravitational/license v0.0.0-20240313232707-8312e719d624 h1:TjiJ98fWU5N28MBktP5vj1/xohin7cX/JBPPJ8iCiTE=
 github.com/gravitational/license v0.0.0-20240313232707-8312e719d624/go.mod h1:pERQ8qtFfvV0Pfw9jA5o1WH1snupQQ3SZ+n8CVdRJNs=
-github.com/gravitational/predicate v1.3.1 h1:f1uGg2FF6z5wZbcafYpLZJ1gl+82I0MlSd0cQKDPQe0=
-github.com/gravitational/predicate v1.3.1/go.mod h1:H5e9dUW7zb/cuKkkhfnyT9SsI/WHWJ8Ra011La16DTY=
+github.com/gravitational/predicate v1.3.4 h1:9N3JhBXNPcUh0w8DdlpnVmfnH9Z3xxbw43sD3E19VBE=
+github.com/gravitational/predicate v1.3.4/go.mod h1:cTQkp40X3YejTcWsZGvzAtfa28VXfBxT10H/Grt0Fzs=
 github.com/gravitational/protobuf v1.3.2-teleport.1 h1:h5mh+UOKPurqDxn1hRVcr1WzSkmBi+D9qkXpaXA9PFM=
 github.com/gravitational/protobuf v1.3.2-teleport.1/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/gravitational/redis/v9 v9.6.1-teleport.1 h1:gPirfPKArN2nPhTKR3h9fnEg5YuYU933+CjlDJMo4H0=
@@ -507,8 +507,8 @@ github.com/gravitational/roundtrip v1.0.2 h1:eOCY0NEKKaB0ksJmvhO6lPMFz1pIIef+vyP
 github.com/gravitational/roundtrip v1.0.2/go.mod h1:fuI1booM2hLRA/B/m5MRAPOU6mBZNYcNycono2UuTw0=
 github.com/gravitational/spdystream v0.0.0-20230512133543-4e46862ca9bf h1:aXnqDSit8L1qhI0+QdbJh+MTUFKXG7qbkZXnfr7L96A=
 github.com/gravitational/spdystream v0.0.0-20230512133543-4e46862ca9bf/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
-github.com/gravitational/trace v1.4.1 h1:IpaQyg/HzBApX34VIyy4tCZF2wB839AEAMT13sTYYmE=
-github.com/gravitational/trace v1.4.1/go.mod h1:oEs/tamajqgZ6/oEb31Hbh50BODsd2H/1iOAkQRDkdg=
+github.com/gravitational/trace v1.5.0 h1:JbeL2HDGyzgy7G72Z2hP2gExEyA6Y2p7fCiSjyZwCJw=
+github.com/gravitational/trace v1.5.0/go.mod h1:dxezSkKm880IIDx+czWG8fq+pLnXjETBewMgN3jOBlg=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 h1:qnpSQwGEnkcRpTqNOIR6bJbR0gAorgP9CSALpRcKoAA=
diff --git a/integrations/lib/errors.go b/integrations/lib/errors.go
index d9228774fd77e..a93fe6a82711a 100644
--- a/integrations/lib/errors.go
+++ b/integrations/lib/errors.go
@@ -24,9 +24,10 @@ import (
 	"io"
 
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+
+	"github.com/gravitational/teleport/api/trail"
 )
 
 // TODO: remove this when trail.FromGRPC will understand additional error codes
diff --git a/integrations/operator/controllers/resources/testlib/login_rule_controller_tests.go b/integrations/operator/controllers/resources/testlib/login_rule_controller_tests.go
index 5bb8fc4544665..743e059faf922 100644
--- a/integrations/operator/controllers/resources/testlib/login_rule_controller_tests.go
+++ b/integrations/operator/controllers/resources/testlib/login_rule_controller_tests.go
@@ -25,12 +25,12 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	kclient "sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/gravitational/teleport/api/client"
 	loginrulepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/loginrule/v1"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/wrappers"
 	resourcesv1 "github.com/gravitational/teleport/integrations/operator/apis/resources/v1"
diff --git a/integrations/terraform/go.mod b/integrations/terraform/go.mod
index 618dd7f5dc1ce..bcec287a21662 100644
--- a/integrations/terraform/go.mod
+++ b/integrations/terraform/go.mod
@@ -15,7 +15,7 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/gravitational/teleport v0.0.0 // replaced
 	github.com/gravitational/teleport/api v0.0.0 // replaced
-	github.com/gravitational/trace v1.4.1
+	github.com/gravitational/trace v1.5.0
 	github.com/hashicorp/terraform-plugin-framework v0.10.0
 	github.com/hashicorp/terraform-plugin-go v0.18.0
 	github.com/hashicorp/terraform-plugin-log v0.9.0
@@ -466,5 +466,5 @@ replace (
 	github.com/microsoft/go-mssqldb => github.com/gravitational/go-mssqldb v0.11.1-0.20230331180905-0f76f1751cd3
 	github.com/moby/spdystream => github.com/gravitational/spdystream v0.0.0-20230512133543-4e46862ca9bf
 	github.com/redis/go-redis/v9 => github.com/gravitational/redis/v9 v9.6.1-teleport.1
-	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.1
+	github.com/vulcand/predicate => github.com/gravitational/predicate v1.3.4
 )
diff --git a/integrations/terraform/go.sum b/integrations/terraform/go.sum
index 88871bab91dcc..64d30a0b4beeb 100644
--- a/integrations/terraform/go.sum
+++ b/integrations/terraform/go.sum
@@ -735,8 +735,8 @@ github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33 h1:VFE
 github.com/gravitational/kingpin/v2 v2.1.11-0.20230515143221-4ec6b70ecd33/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
 github.com/gravitational/license v0.0.0-20240313232707-8312e719d624 h1:TjiJ98fWU5N28MBktP5vj1/xohin7cX/JBPPJ8iCiTE=
 github.com/gravitational/license v0.0.0-20240313232707-8312e719d624/go.mod h1:pERQ8qtFfvV0Pfw9jA5o1WH1snupQQ3SZ+n8CVdRJNs=
-github.com/gravitational/predicate v1.3.1 h1:f1uGg2FF6z5wZbcafYpLZJ1gl+82I0MlSd0cQKDPQe0=
-github.com/gravitational/predicate v1.3.1/go.mod h1:H5e9dUW7zb/cuKkkhfnyT9SsI/WHWJ8Ra011La16DTY=
+github.com/gravitational/predicate v1.3.4 h1:9N3JhBXNPcUh0w8DdlpnVmfnH9Z3xxbw43sD3E19VBE=
+github.com/gravitational/predicate v1.3.4/go.mod h1:cTQkp40X3YejTcWsZGvzAtfa28VXfBxT10H/Grt0Fzs=
 github.com/gravitational/protobuf v1.3.2-teleport.1 h1:h5mh+UOKPurqDxn1hRVcr1WzSkmBi+D9qkXpaXA9PFM=
 github.com/gravitational/protobuf v1.3.2-teleport.1/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/gravitational/redis/v9 v9.6.1-teleport.1 h1:gPirfPKArN2nPhTKR3h9fnEg5YuYU933+CjlDJMo4H0=
@@ -747,8 +747,8 @@ github.com/gravitational/spdystream v0.0.0-20230512133543-4e46862ca9bf h1:aXnqDS
 github.com/gravitational/spdystream v0.0.0-20230512133543-4e46862ca9bf/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
 github.com/gravitational/terraform-plugin-docs v0.19.5-0.20240627183239-7e7e22a2c1f6 h1:roGf4UO3jjf/vv2fc+ChlWFPISFMkRXFwBUKEtjH3uY=
 github.com/gravitational/terraform-plugin-docs v0.19.5-0.20240627183239-7e7e22a2c1f6/go.mod h1:8eiBaRanEugPy3lh7UZ5NW6yaISaXXS4R56pi1D962k=
-github.com/gravitational/trace v1.4.1 h1:IpaQyg/HzBApX34VIyy4tCZF2wB839AEAMT13sTYYmE=
-github.com/gravitational/trace v1.4.1/go.mod h1:oEs/tamajqgZ6/oEb31Hbh50BODsd2H/1iOAkQRDkdg=
+github.com/gravitational/trace v1.5.0 h1:JbeL2HDGyzgy7G72Z2hP2gExEyA6Y2p7fCiSjyZwCJw=
+github.com/gravitational/trace v1.5.0/go.mod h1:dxezSkKm880IIDx+czWG8fq+pLnXjETBewMgN3jOBlg=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 h1:qnpSQwGEnkcRpTqNOIR6bJbR0gAorgP9CSALpRcKoAA=
diff --git a/lib/auth/grpcserver.go b/lib/auth/grpcserver.go
index 9c0a143ae2383..32a1015d9ff1e 100644
--- a/lib/auth/grpcserver.go
+++ b/lib/auth/grpcserver.go
@@ -32,7 +32,6 @@ import (
 	"github.com/coreos/go-semver/semver"
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/sirupsen/logrus"
 	collectortracepb "go.opentelemetry.io/proto/otlp/collector/trace/v1"
@@ -78,6 +77,7 @@ import (
 	userpreferencesv1pb "github.com/gravitational/teleport/api/gen/proto/go/userpreferences/v1"
 	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/metadata"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/api/types/installers"
diff --git a/lib/auth/grpcserver_test.go b/lib/auth/grpcserver_test.go
index c7f7602b8c31e..e96920093fb30 100644
--- a/lib/auth/grpcserver_test.go
+++ b/lib/auth/grpcserver_test.go
@@ -37,7 +37,6 @@ import (
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"github.com/jonboulle/clockwork"
 	"github.com/pquerna/otp"
 	"github.com/pquerna/otp/totp"
@@ -62,6 +61,7 @@ import (
 	"github.com/gravitational/teleport/api/metadata"
 	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/api/observability/tracing"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/autoupdate"
 	"github.com/gravitational/teleport/api/types/installers"
diff --git a/lib/auth/presence/presencev1/service_test.go b/lib/auth/presence/presencev1/service_test.go
index 2b673b6517a53..47259dbead053 100644
--- a/lib/auth/presence/presencev1/service_test.go
+++ b/lib/auth/presence/presencev1/service_test.go
@@ -30,7 +30,6 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/testing/protocmp"
@@ -38,6 +37,7 @@ import (
 
 	"github.com/gravitational/teleport"
 	presencev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/presence/v1"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/lib/auth"
diff --git a/lib/backend/firestore/firestorebk.go b/lib/backend/firestore/firestorebk.go
index 71aaaf2c22076..4de5dc98f8ac0 100644
--- a/lib/backend/firestore/firestorebk.go
+++ b/lib/backend/firestore/firestorebk.go
@@ -33,7 +33,6 @@ import (
 	apiv1 "cloud.google.com/go/firestore/apiv1/admin"
 	"cloud.google.com/go/firestore/apiv1/admin/adminpb"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"github.com/jonboulle/clockwork"
 	"google.golang.org/api/option"
 	"google.golang.org/grpc"
@@ -42,6 +41,7 @@ import (
 	"google.golang.org/grpc/status"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	"github.com/gravitational/teleport/api/utils/retryutils"
diff --git a/lib/cloud/gcp/vm.go b/lib/cloud/gcp/vm.go
index 1ebbece683129..f5e09b064bb9b 100644
--- a/lib/cloud/gcp/vm.go
+++ b/lib/cloud/gcp/vm.go
@@ -37,7 +37,6 @@ import (
 	"cloud.google.com/go/resourcemanager/apiv3/resourcemanagerpb"
 	"github.com/googleapis/gax-go/v2/apierror"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/crypto/ssh"
 	"google.golang.org/api/googleapi"
@@ -45,6 +44,7 @@ import (
 	"google.golang.org/api/option"
 
 	"github.com/gravitational/teleport/api/internalutils/stream"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/utils/sshutils"
 	gcpimds "github.com/gravitational/teleport/lib/cloud/imds/gcp"
diff --git a/lib/devicetrust/enroll/enroll.go b/lib/devicetrust/enroll/enroll.go
index b7e8a18c662eb..14a277ef3cfb3 100644
--- a/lib/devicetrust/enroll/enroll.go
+++ b/lib/devicetrust/enroll/enroll.go
@@ -24,10 +24,10 @@ import (
 	"io"
 
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	log "github.com/sirupsen/logrus"
 
 	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/lib/devicetrust"
 	"github.com/gravitational/teleport/lib/devicetrust/native"
 )
diff --git a/lib/kube/grpc/grpc.go b/lib/kube/grpc/grpc.go
index 67f17fc4d5079..e0c617e90b5ff 100644
--- a/lib/kube/grpc/grpc.go
+++ b/lib/kube/grpc/grpc.go
@@ -24,7 +24,6 @@ import (
 	"slices"
 
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"github.com/sirupsen/logrus"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
@@ -32,6 +31,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/defaults"
 	proto "github.com/gravitational/teleport/api/gen/proto/go/teleport/kube/v1"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	apievents "github.com/gravitational/teleport/api/types/events"
 	"github.com/gravitational/teleport/lib/authz"
diff --git a/lib/proxy/peer/quic/client.go b/lib/proxy/peer/quic/client.go
index 49c4146759f4b..b230f111c253a 100644
--- a/lib/proxy/peer/quic/client.go
+++ b/lib/proxy/peer/quic/client.go
@@ -29,12 +29,12 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"github.com/quic-go/quic-go"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	apiutils "github.com/gravitational/teleport/api/utils"
 	quicpeeringv1a "github.com/gravitational/teleport/gen/proto/go/teleport/quicpeering/v1alpha"
diff --git a/lib/proxy/peer/quic/server.go b/lib/proxy/peer/quic/server.go
index 5aa5bb8afd765..2931837907b72 100644
--- a/lib/proxy/peer/quic/server.go
+++ b/lib/proxy/peer/quic/server.go
@@ -29,13 +29,13 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"github.com/quic-go/quic-go"
 	"golang.org/x/sync/errgroup"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	quicpeeringv1a "github.com/gravitational/teleport/gen/proto/go/teleport/quicpeering/v1alpha"
 	peerdial "github.com/gravitational/teleport/lib/proxy/peer/dial"
diff --git a/lib/srv/db/common/errors.go b/lib/srv/db/common/errors.go
index 32bb3792a9310..7d649b27f2edc 100644
--- a/lib/srv/db/common/errors.go
+++ b/lib/srv/db/common/errors.go
@@ -28,12 +28,12 @@ import (
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/go-mysql-org/go-mysql/mysql"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"github.com/jackc/pgconn"
 	"github.com/jackc/pgerrcode"
 	"google.golang.org/api/googleapi"
 	"google.golang.org/grpc/status"
 
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	awslib "github.com/gravitational/teleport/lib/cloud/aws"
 	azurelib "github.com/gravitational/teleport/lib/cloud/azure"
diff --git a/lib/teleterm/apiserver/middleware.go b/lib/teleterm/apiserver/middleware.go
index 7f8bb787a4038..ad41cde988526 100644
--- a/lib/teleterm/apiserver/middleware.go
+++ b/lib/teleterm/apiserver/middleware.go
@@ -21,9 +21,10 @@ package apiserver
 import (
 	"context"
 
-	"github.com/gravitational/trace/trail"
 	"github.com/sirupsen/logrus"
 	"google.golang.org/grpc"
+
+	"github.com/gravitational/teleport/api/trail"
 )
 
 // withErrorHandling is gRPC middleware that maps internal errors to proper gRPC error codes
diff --git a/lib/teleterm/daemon/mfaprompt.go b/lib/teleterm/daemon/mfaprompt.go
index 8d7cee331642e..89e1245ed7fb1 100644
--- a/lib/teleterm/daemon/mfaprompt.go
+++ b/lib/teleterm/daemon/mfaprompt.go
@@ -24,12 +24,12 @@ import (
 	"sync"
 
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/mfa"
+	"github.com/gravitational/teleport/api/trail"
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
 	wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
diff --git a/tool/tctl/common/accessmonitoring/command.go b/tool/tctl/common/accessmonitoring/command.go
index d4483c6ed91b2..b896752d0b9bb 100644
--- a/tool/tctl/common/accessmonitoring/command.go
+++ b/tool/tctl/common/accessmonitoring/command.go
@@ -25,10 +25,10 @@ import (
 
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"golang.org/x/exp/maps"
 
 	"github.com/gravitational/teleport"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types/header"
 	"github.com/gravitational/teleport/api/types/secreports"
 	"github.com/gravitational/teleport/lib/asciitable"
diff --git a/tool/tctl/common/devices.go b/tool/tctl/common/devices.go
index f8bfc9412ab60..166ae2f9922e2 100644
--- a/tool/tctl/common/devices.go
+++ b/tool/tctl/common/devices.go
@@ -27,11 +27,11 @@ import (
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/asciitable"
 	"github.com/gravitational/teleport/lib/auth/authclient"
diff --git a/tool/tctl/common/notification_command.go b/tool/tctl/common/notification_command.go
index 9703ae65f6065..27c4517db19db 100644
--- a/tool/tctl/common/notification_command.go
+++ b/tool/tctl/common/notification_command.go
@@ -28,7 +28,6 @@ import (
 
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/gravitational/teleport"
@@ -36,6 +35,7 @@ import (
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	notificationspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
 	"github.com/gravitational/teleport/api/mfa"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/asciitable"
 	"github.com/gravitational/teleport/lib/auth/authclient"
diff --git a/tool/tctl/common/resource_command.go b/tool/tctl/common/resource_command.go
index 8988252b2fb41..045aa8d6e4042 100644
--- a/tool/tctl/common/resource_command.go
+++ b/tool/tctl/common/resource_command.go
@@ -34,7 +34,6 @@ import (
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/crewjam/saml/samlsp"
 	"github.com/gravitational/trace"
-	"github.com/gravitational/trace/trail"
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/protobuf/encoding/protojson"
 	kyaml "k8s.io/apimachinery/pkg/util/yaml"
@@ -60,6 +59,7 @@ import (
 	workloadidentityv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
 	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/mfa"
+	"github.com/gravitational/teleport/api/trail"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/api/types/accesslist"
 	"github.com/gravitational/teleport/api/types/discoveryconfig"