diff --git a/include/haproxy/ssl_trace-t.h b/include/haproxy/ssl_trace-t.h
index 4575fda82..8652ff4d4 100644
--- a/include/haproxy/ssl_trace-t.h
+++ b/include/haproxy/ssl_trace-t.h
@@ -26,6 +26,7 @@ extern struct trace_source trace_ssl;
 #define SSL_EV_CONN_SEND_EARLY     (1ULL <<  5)
 #define SSL_EV_CONN_RECV           (1ULL <<  6)
 #define SSL_EV_CONN_RECV_EARLY     (1ULL <<  7)
+#define SSL_EV_CONN_IO_CB          (1ULL <<  8)
 
 #define TRACE_SOURCE &trace_ssl
 
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 326a5d739..77fbc4055 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -5720,6 +5720,8 @@ struct task *ssl_sock_io_cb(struct task *t, void *context, unsigned int state)
 	int conn_in_list;
 	int ret = 0;
 
+	TRACE_ENTER(SSL_EV_CONN_IO_CB, ctx->conn);
+
 	if (state & TASK_F_USR1) {
 		/* the tasklet was idling on an idle connection, it might have
 		 * been stolen, let's be careful!
@@ -5792,10 +5794,12 @@ leave:
 	if (!ret && conn_in_list) {
 		struct server *srv = objt_server(conn->target);
 
+		TRACE_DEVEL("adding conn back to idle list", SSL_EV_CONN_IO_CB, conn);
 		HA_SPIN_LOCK(IDLE_CONNS_LOCK, &idle_conns[tid].idle_conns_lock);
 		_srv_add_idle(srv, conn, conn_in_list == CO_FL_SAFE_LIST);
 		HA_SPIN_UNLOCK(IDLE_CONNS_LOCK, &idle_conns[tid].idle_conns_lock);
 	}
+	TRACE_LEAVE(SSL_EV_CONN_IO_CB, conn);
 	return t;
 }
 
diff --git a/src/ssl_trace.c b/src/ssl_trace.c
index 49a4cb173..3c00f73c6 100644
--- a/src/ssl_trace.c
+++ b/src/ssl_trace.c
@@ -34,6 +34,7 @@ static const struct trace_event ssl_trace_events[] = {
 	{ .mask = SSL_EV_CONN_SEND_EARLY,     .name = "sslc_send_early",     .desc = "Tx on SSL connection (early data)" },
 	{ .mask = SSL_EV_CONN_RECV,           .name = "sslc_recv",           .desc = "Rx on SSL connection" },
 	{ .mask = SSL_EV_CONN_RECV_EARLY,     .name = "sslc_recv_early",     .desc = "Rx on SSL connection (early data)" },
+	{ .mask = SSL_EV_CONN_IO_CB,          .name = "sslc_io_cb",          .desc = "SSL io callback"},
 	{ }
 };