@@ -2,7 +2,7 @@ import type { Span } from '@opentelemetry/api';
 import type { ReadableSpan } from '@opentelemetry/sdk-trace-base';
 import { HTTP_METHOD, HTTP_REQUEST_METHOD, HTTP_URL, URL_FULL } from '@sentry/conventions/attributes';
 import type { SanitizedRequestData } from '@sentry/core';
-import { getSanitizedUrlString, parseUrl } from '@sentry/core';
+import { filterCollectedUrlQuery, getSanitizedUrlString, parseUrl } from '@sentry/core';
 import { spanHasAttributes } from './spanTypes';
 
 /**
@@ -34,8 +34,10 @@ export function getRequestSpanData(span: Span | ReadableSpan): Partial<Sanitized
 
       data.url = getSanitizedUrlString(url);
 
-      if (url.search) {
-        data['http.query'] = url.search;
+      // The URL may come from a third-party instrumentation that never ran it through the SDK's filtering.
+      const query = filterCollectedUrlQuery(url.search);
+      if (query) {
+        data['http.query'] = query;
       }
       if (url.hash) {
         data['http.fragment'] = url.hash;
 
@@ -49,6 +49,22 @@ describe('getRequestSpanData', () => {
     });
   });
 
+  it('filters sensitive query params according to dataCollection.urlQueryParams', () => {
+    const span = createSpan('test-span');
+    span.setAttributes({
+      [HTTP_URL]: 'http://example.com/reset?token=secret&page=1',
+      [HTTP_METHOD]: 'GET',
+    });
+
+    const data = getRequestSpanData(span);
+
+    expect(data).toEqual({
+      url: 'http://example.com/reset',
+      'http.method': 'GET',
+      'http.query': '?token=[Filtered]&page=1',
+    });
+  });
+
   it('works without method', () => {
     const span = createSpan('test-span');
     span.setAttributes({
 
@@ -181,9 +181,10 @@ async function instrumentHandle(
           [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: 'auto.http.sveltekit',
           [SEMANTIC_ATTRIBUTE_SENTRY_SOURCE]: routeName ? 'route' : 'url',
           'sveltekit.tracing.original_name': originalName,
-          [URL_FULL]:
+          [URL_FULL]: filterCollectedUrl(
             // oxlint-disable-next-line typescript-eslint(no-deprecated)
-            kitRootSpanAttributes[URL_FULL] ?? kitRootSpanAttributes[HTTP_URL] ?? filterCollectedUrl(event.url.href),
+            (kitRootSpanAttributes[URL_FULL] ?? kitRootSpanAttributes[HTTP_URL] ?? event.url.href) as string,
+          ),
           [URL_PATH]: kitRootSpanAttributes[URL_PATH] ?? event.url.pathname,
           ...(routeName && {
             [HTTP_ROUTE]: routeName,
 
@@ -177,6 +177,25 @@ describe('sentryHandle', () => {
       kitRootSpan.end();
     });
 
+    it('filters sensitive query params in the URL taken over from the sveltekit root span', async () => {
+      const kitRootSpan = SentryCore.startInactiveSpan({
+        name: 'sveltekit.handle.root',
+        attributes: { 'url.full': 'https://example.com/reset?token=secret&page=1' },
+      });
+
+      try {
+        await sentryHandle()({
+          event: mockEvent({ tracing: { enabled: true, root: kitRootSpan } }),
+          resolve: resolve(type, isError),
+        });
+      } catch {
+        //
+      }
+
+      expect(spanToJSON(kitRootSpan).data?.['url.full']).toEqual('https://example.com/reset?token=[Filtered]&page=1');
+      kitRootSpan.end();
+    });
+
     it('starts a child span for nested server calls (i.e. if there is an active span)', async () => {
       let _span: Span | undefined = undefined;
       let txnCount = 0;