diff --git a/shared-package.props b/shared-package.props
index 5457c82531..4b7ead5e6f 100644
--- a/shared-package.props
+++ b/shared-package.props
@@ -33,14 +33,6 @@
     <GeneratePackageOnBuild>True</GeneratePackageOnBuild>
   </PropertyGroup>
 
-  <PropertyGroup>
-    <!--
-      Temporary workaround for CA1873: Evaluation of this argument may be expensive and unnecessary if logging is disabled.
-      Should be revisited as part of https://github.com/SteeltoeOSS/Steeltoe/issues/969.
-      -->
-    <NoWarn>$(NoWarn);CA1873</NoWarn>
-  </PropertyGroup>
-
   <PropertyGroup Condition="'$(CI)' != ''">
     <!--
       While deterministic builds are enabled by default in .NET SDK projects, there is an extra property, ContinuousIntegrationBuild,
diff --git a/src/Common/src/Common/Extensions/MaskedUri.cs b/src/Common/src/Common/Extensions/MaskedUri.cs
new file mode 100644
index 0000000000..53540e436a
--- /dev/null
+++ b/src/Common/src/Common/Extensions/MaskedUri.cs
@@ -0,0 +1,59 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the Apache 2.0 License.
+// See the LICENSE file in the project root for more information.
+
+namespace Steeltoe.Common.Extensions;
+
+/// <summary>
+/// Represents a <see cref="Uri" /> whose username and password are masked.
+/// </summary>
+internal readonly record struct MaskedUri
+{
+    private readonly Uri? _value;
+
+    public MaskedUri(Uri? value)
+    {
+        _value = value;
+    }
+
+    public override string ToString()
+    {
+        return _value == null ? string.Empty : ToMaskedString(_value);
+    }
+
+    private static string ToMaskedString(Uri source)
+    {
+        string uris = source.ToString();
+
+        if (uris.Contains(','))
+        {
+            return string.Join(',',
+                uris.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries).Select(uri => Mask(new Uri(uri)).ToString()));
+        }
+
+        return Mask(source).ToString();
+    }
+
+    private static Uri Mask(Uri source)
+    {
+        if (string.IsNullOrEmpty(source.UserInfo))
+        {
+            return source;
+        }
+
+        var builder = new UriBuilder(source)
+        {
+            UserName = "****",
+#pragma warning disable S2068 // Hard-coded credentials are security-sensitive
+            Password = "****"
+#pragma warning restore S2068 // Hard-coded credentials are security-sensitive
+        };
+
+        return builder.Uri;
+    }
+
+    public static implicit operator MaskedUri(Uri? uri)
+    {
+        return new MaskedUri(uri);
+    }
+}
diff --git a/src/Common/src/Common/Extensions/UriExtensions.cs b/src/Common/src/Common/Extensions/UriExtensions.cs
index e1c400459b..e476d083bf 100644
--- a/src/Common/src/Common/Extensions/UriExtensions.cs
+++ b/src/Common/src/Common/Extensions/UriExtensions.cs
@@ -9,39 +9,6 @@ namespace Steeltoe.Common.Extensions;
 
 internal static class UriExtensions
 {
-    public static string ToMaskedString(this Uri source)
-    {
-        ArgumentNullException.ThrowIfNull(source);
-
-        string uris = source.ToString();
-
-        if (uris.Contains(','))
-        {
-            return string.Join(',',
-                uris.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries).Select(uri => ToMaskedUri(new Uri(uri)).ToString()));
-        }
-
-        return ToMaskedUri(source).ToString();
-    }
-
-    private static Uri ToMaskedUri(Uri source)
-    {
-        if (string.IsNullOrEmpty(source.UserInfo))
-        {
-            return source;
-        }
-
-        var builder = new UriBuilder(source)
-        {
-            UserName = "****",
-#pragma warning disable S2068 // Hard-coded credentials are security-sensitive
-            Password = "****"
-#pragma warning restore S2068 // Hard-coded credentials are security-sensitive
-        };
-
-        return builder.Uri;
-    }
-
     public static bool TryGetUsernamePassword(this Uri uri, [NotNullWhen(true)] out string? username, [NotNullWhen(true)] out string? password)
     {
         ArgumentNullException.ThrowIfNull(uri);
diff --git a/src/Common/src/Http/HttpClientExtensions.cs b/src/Common/src/Http/HttpClientExtensions.cs
index e00b96413a..9888094f25 100644
--- a/src/Common/src/Http/HttpClientExtensions.cs
+++ b/src/Common/src/Http/HttpClientExtensions.cs
@@ -73,7 +73,8 @@ public static async Task<string> GetAccessTokenAsync(this HttpClient httpClient,
 
         if (string.IsNullOrEmpty(accessToken))
         {
-            throw new HttpRequestException($"No access token was returned from '{accessTokenUri.ToMaskedString()}'.", null, response.StatusCode);
+            MaskedUri masked = accessTokenUri;
+            throw new HttpRequestException($"No access token was returned from '{masked}'.", null, response.StatusCode);
         }
 
         return accessToken;
diff --git a/src/Common/test/Common.Test/Extensions/MaskedUriTest.cs b/src/Common/test/Common.Test/Extensions/MaskedUriTest.cs
new file mode 100644
index 0000000000..780116a78a
--- /dev/null
+++ b/src/Common/test/Common.Test/Extensions/MaskedUriTest.cs
@@ -0,0 +1,43 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the Apache 2.0 License.
+// See the LICENSE file in the project root for more information.
+
+using Steeltoe.Common.Extensions;
+
+namespace Steeltoe.Common.Test.Extensions;
+
+public sealed class MaskedUriTest
+{
+    [Fact]
+    public void MaskSingleBasicAuthentication()
+    {
+        const string source = "http://username:password@www.example.com/";
+        const string expected = "http://****:****@www.example.com/";
+
+        MaskedUri uri = new Uri(source);
+
+        uri.ToString().Should().Be(expected);
+    }
+
+    [Fact]
+    public void MaskMultiBasicAuthentication()
+    {
+        const string source = "http://username:password@www.example.com/,http://user2:pass2@www.other.com/";
+        const string expected = "http://****:****@www.example.com/,http://****:****@www.other.com/";
+
+        MaskedUri uri = new Uri(source);
+
+        uri.ToString().Should().Be(expected);
+    }
+
+    [Fact]
+    public void DoNotMaskIfNoBasicAuthentication()
+    {
+        const string source = "http://www.example.com/";
+        const string expected = "http://www.example.com/";
+
+        MaskedUri uri = new Uri(source);
+
+        uri.ToString().Should().Be(expected);
+    }
+}
diff --git a/src/Common/test/Common.Test/Extensions/UriExtensionsTest.cs b/src/Common/test/Common.Test/Extensions/UriExtensionsTest.cs
index fbfa1a9062..dc660af72c 100644
--- a/src/Common/test/Common.Test/Extensions/UriExtensionsTest.cs
+++ b/src/Common/test/Common.Test/Extensions/UriExtensionsTest.cs
@@ -8,39 +8,6 @@ namespace Steeltoe.Common.Test.Extensions;
 
 public sealed class UriExtensionsTest
 {
-    [Fact]
-    public void MaskSingleBasicAuthentication()
-    {
-        var uri = new Uri("http://username:password@www.example.com/");
-        const string expected = "http://****:****@www.example.com/";
-
-        string masked = uri.ToMaskedString();
-
-        masked.Should().Be(expected);
-    }
-
-    [Fact]
-    public void MaskMultiBasicAuthentication()
-    {
-        var uri = new Uri("http://username:password@www.example.com/,http://user2:pass2@www.other.com/");
-        const string expected = "http://****:****@www.example.com/,http://****:****@www.other.com/";
-
-        string masked = uri.ToMaskedString();
-
-        masked.Should().Be(expected);
-    }
-
-    [Fact]
-    public void DoNotMaskIfNoBasicAuthentication()
-    {
-        var uri = new Uri("http://www.example.com/");
-        string expected = uri.ToString();
-
-        string masked = uri.ToMaskedString();
-
-        masked.Should().Be(expected);
-    }
-
     [Fact]
     public void TryGetUsernamePassword_AllowsColonInPassword()
     {
diff --git a/src/Configuration/src/Abstractions/CompositeConfigurationProvider.cs b/src/Configuration/src/Abstractions/CompositeConfigurationProvider.cs
index dae60f1e3f..d7d5d245a2 100644
--- a/src/Configuration/src/Abstractions/CompositeConfigurationProvider.cs
+++ b/src/Configuration/src/Abstractions/CompositeConfigurationProvider.cs
@@ -56,12 +56,7 @@ public IEnumerable<string> GetChildKeys(IEnumerable<string> earlierKeys, string?
         ArgumentNullException.ThrowIfNull(earlierKeys);
 
         string[] earlierKeysArray = earlierKeys as string[] ?? earlierKeys.ToArray();
-
-        if (_logger.IsEnabled(LogLevel.Trace))
-        {
-            string earlierKeyNames = string.Join(", ", earlierKeysArray.Select(key => $"'{key}'"));
-            LogGetChildKeys(GetType().Name, earlierKeyNames, parentPath);
-        }
+        ExpensiveLogGetChildKeys(earlierKeysArray, parentPath);
 
         IConfiguration? section = parentPath == null ? ConfigurationRoot : ConfigurationRoot?.GetSection(parentPath);
 
@@ -77,6 +72,15 @@ public IEnumerable<string> GetChildKeys(IEnumerable<string> earlierKeys, string?
         return keys;
     }
 
+    private void ExpensiveLogGetChildKeys(string[] earlierKeysArray, string? parentPath)
+    {
+        if (_logger.IsEnabled(LogLevel.Trace))
+        {
+            string earlierKeyNames = string.Join(", ", earlierKeysArray.Select(key => $"'{key}'"));
+            LogGetChildKeys(GetType().Name, earlierKeyNames, parentPath);
+        }
+    }
+
     public virtual bool TryGet(string key, out string? value)
     {
         ArgumentNullException.ThrowIfNull(key);
diff --git a/src/Configuration/src/ConfigServer/ConfigServerConfigurationProvider.cs b/src/Configuration/src/ConfigServer/ConfigServerConfigurationProvider.cs
index 71dbe8f5e0..e89a81ee0c 100644
--- a/src/Configuration/src/ConfigServer/ConfigServerConfigurationProvider.cs
+++ b/src/Configuration/src/ConfigServer/ConfigServerConfigurationProvider.cs
@@ -403,7 +403,7 @@ public override void Load()
                 // Update configuration Data dictionary with any results
                 if (env != null)
                 {
-                    LogEnvironmentLocated(env.Name, string.Join(", ", env.Profiles.Select(p => $"'{p}'")), env.Label, env.Version, env.State);
+                    ExpensiveLogEnvironmentLocated(env);
 
                     if (updateDictionary)
                     {
@@ -451,6 +451,15 @@ public override void Load()
         throw new ConfigServerException("Failed fetching remote configuration from server(s).", error);
     }
 
+    private void ExpensiveLogEnvironmentLocated(ConfigEnvironment environment)
+    {
+        if (_logger.IsEnabled(LogLevel.Debug))
+        {
+            string profiles = string.Join(", ", environment.Profiles.Select(profile => $"'{profile}'"));
+            LogEnvironmentLocated(environment.Name, profiles, environment.Label, environment.Version, environment.State);
+        }
+    }
+
     internal void ApplyLastDiscoveryLookupResultToClientOptions(ConfigServerClientOptions optionsSnapshot)
     {
         DiscoveryLookupResult? lastResult = _lastDiscoveryLookupResult;
@@ -601,7 +610,7 @@ internal async Task<HttpRequestMessage> GetConfigServerRequestMessageAsync(Confi
 
         if (requestUri.TryGetUsernamePassword(out string? username, out string? password) && password.Length > 0)
         {
-            LogAddingCredentials(requestUri.ToMaskedString());
+            LogAddingCredentials(requestUri);
 
             requestMessage.Headers.Authorization =
                 new AuthenticationHeaderValue("Basic", Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}")));
@@ -616,7 +625,7 @@ internal async Task<HttpRequestMessage> GetConfigServerRequestMessageAsync(Confi
                 string accessToken =
                     await httpClient.GetAccessTokenAsync(accessTokenUri, optionsSnapshot.ClientId, optionsSnapshot.ClientSecret, cancellationToken);
 
-                LogAccessTokenFetched(accessTokenUri.ToMaskedString());
+                LogAccessTokenFetched(accessTokenUri);
                 requestMessage.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
             }
         }
@@ -646,7 +655,7 @@ internal async Task<HttpRequestMessage> GetConfigServerRequestMessageAsync(Confi
                 // Make Config Server URI from settings
                 Uri uri = BuildConfigServerUri(optionsSnapshot, requestUri, label);
 
-                LogTryingToConnect(uri.ToMaskedString());
+                LogTryingToConnect(uri);
                 HttpRequestMessage request;
 
                 try
@@ -660,7 +669,7 @@ internal async Task<HttpRequestMessage> GetConfigServerRequestMessageAsync(Confi
                     if (!string.IsNullOrEmpty(optionsSnapshot.AccessTokenUri))
                     {
                         var accessTokenUri = new Uri(optionsSnapshot.AccessTokenUri);
-                        LogFailedToFetchAccessToken(exception, accessTokenUri.ToMaskedString());
+                        LogFailedToFetchAccessToken(exception, accessTokenUri);
 
                         continue;
                     }
@@ -672,7 +681,7 @@ internal async Task<HttpRequestMessage> GetConfigServerRequestMessageAsync(Confi
                 LogSendingHttpRequest();
                 using HttpResponseMessage response = await httpClient.SendAsync(request, cancellationToken);
 
-                LogConfigServerReturnedStatus(response.StatusCode, uri.ToMaskedString());
+                LogConfigServerReturnedStatus(uri, response.StatusCode);
 
                 if (response.StatusCode != HttpStatusCode.OK)
                 {
@@ -684,7 +693,8 @@ internal async Task<HttpRequestMessage> GetConfigServerRequestMessageAsync(Confi
                     // Throw if status >= 400
                     if (response.StatusCode >= HttpStatusCode.BadRequest)
                     {
-                        throw new HttpRequestException($"Config Server returned status: {response.StatusCode} invoking path: {uri.ToMaskedString()}");
+                        MaskedUri masked = uri;
+                        throw new HttpRequestException($"Config Server returned status: {response.StatusCode} invoking path: {masked}");
                     }
 
                     return null;
@@ -827,7 +837,7 @@ internal async Task RefreshVaultTokenAsync(ConfigServerClientOptions optionsSnap
             Uri uri = BuildVaultRenewUri(optionsSnapshot);
             HttpRequestMessage message = await GetVaultRenewRequestMessageAsync(optionsSnapshot, uri, cancellationToken);
 
-            LogRenewingVaultToken(obscuredToken, optionsSnapshot.TokenTtl, uri.ToMaskedString());
+            LogRenewingVaultToken(obscuredToken, optionsSnapshot.TokenTtl, uri);
             using HttpResponseMessage response = await httpClient.SendAsync(message, cancellationToken);
 
             if (response.StatusCode != HttpStatusCode.OK)
@@ -867,7 +877,7 @@ private async Task<HttpRequestMessage> GetVaultRenewRequestMessageAsync(ConfigSe
             string accessToken =
                 await httpClient.GetAccessTokenAsync(accessTokenUri, optionsSnapshot.ClientId, optionsSnapshot.ClientSecret, cancellationToken);
 
-            LogAccessTokenFetched(accessTokenUri.ToMaskedString());
+            LogAccessTokenFetched(accessTokenUri);
             requestMessage.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
         }
 
@@ -1019,7 +1029,7 @@ private void ShutdownTimers()
     [LoggerMessage(Level = LogLevel.Debug, Message = "Multiple Config Server uris listed.")]
     private partial void LogMultipleConfigServerUris();
 
-    [LoggerMessage(Level = LogLevel.Debug,
+    [LoggerMessage(Level = LogLevel.Debug, SkipEnabledCheck = true,
         Message = "Located environment with name {Name}, profiles {Profiles}, label {Label}, version {Version} and state {State}.")]
     private partial void LogEnvironmentLocated(string? name, string profiles, string? label, string? version, string? state);
 
@@ -1030,22 +1040,22 @@ private void ShutdownTimers()
     private partial void LogDataNotChanged();
 
     [LoggerMessage(Level = LogLevel.Warning, Message = "Failed fetching remote configuration from server(s).")]
-    private partial void LogFetchingRemoteConfigurationFailed(Exception? error);
+    private partial void LogFetchingRemoteConfigurationFailed(Exception error);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Adding credentials from '{RequestUri}' to Authorization header.")]
-    private partial void LogAddingCredentials(string requestUri);
+    private partial void LogAddingCredentials(MaskedUri requestUri);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Fetched access token from {AccessTokenUri}.")]
-    private partial void LogAccessTokenFetched(string accessTokenUri);
+    private partial void LogAccessTokenFetched(MaskedUri accessTokenUri);
 
     [LoggerMessage(Level = LogLevel.Warning, Message = "Failed to fetch access token from '{AccessTokenUri}'.")]
-    private partial void LogFailedToFetchAccessToken(Exception exception, string accessTokenUri);
+    private partial void LogFailedToFetchAccessToken(Exception exception, MaskedUri accessTokenUri);
 
     [LoggerMessage(Level = LogLevel.Trace, Message = "Entered {Method}.")]
     private partial void LogRemoteLoadEntered(string method);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Trying to connect to Config Server at {RequestUri}.")]
-    private partial void LogTryingToConnect(string requestUri);
+    private partial void LogTryingToConnect(MaskedUri requestUri);
 
     [LoggerMessage(Level = LogLevel.Trace, Message = "Building HTTP request message.")]
     private partial void LogBuildingHttpRequest();
@@ -1054,7 +1064,7 @@ private void ShutdownTimers()
     private partial void LogSendingHttpRequest();
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Config Server returned status {StatusCode} for path {RequestUri}.")]
-    private partial void LogConfigServerReturnedStatus(HttpStatusCode statusCode, string requestUri);
+    private partial void LogConfigServerReturnedStatus(MaskedUri requestUri, HttpStatusCode statusCode);
 
     [LoggerMessage(Level = LogLevel.Trace, Message = "Parsing JSON response.")]
     private partial void LogParsingJsonResponse();
@@ -1066,7 +1076,7 @@ private void ShutdownTimers()
     private partial void LogConfigServerPropertyException(Exception exception, string key, Type type);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Renewing Vault token {Token} for {Ttl} milliseconds at Uri {Uri}.")]
-    private partial void LogRenewingVaultToken(string token, int ttl, string uri);
+    private partial void LogRenewingVaultToken(string token, int ttl, MaskedUri uri);
 
     [LoggerMessage(Level = LogLevel.Warning, Message = "Renewing Vault token {Token} returned status {Status}.")]
     private partial void LogVaultTokenRenewalStatus(string token, HttpStatusCode status);
diff --git a/src/Configuration/src/ConfigServer/ConfigServerHealthContributor.cs b/src/Configuration/src/ConfigServer/ConfigServerHealthContributor.cs
index 5517cb3b11..c8ce64aa30 100644
--- a/src/Configuration/src/ConfigServer/ConfigServerHealthContributor.cs
+++ b/src/Configuration/src/ConfigServer/ConfigServerHealthContributor.cs
@@ -79,10 +79,19 @@ internal void UpdateHealth(HealthCheckResult health, IList<PropertySource> sourc
             names.Add(source.Name);
         }
 
-        LogReturningPropertySources(string.Join(", ", names));
+        ExpensiveLogReturningPropertySources(names);
         health.Details.Add("propertySources", names);
     }
 
+    private void ExpensiveLogReturningPropertySources(List<string?> names)
+    {
+        if (_logger.IsEnabled(LogLevel.Debug))
+        {
+            string propertySources = string.Join(", ", names);
+            LogReturningPropertySources(propertySources);
+        }
+    }
+
     internal async Task<IList<PropertySource>?> GetPropertySourcesAsync(ConfigServerConfigurationProvider provider, ConfigServerClientOptions optionsSnapshot,
         CancellationToken cancellationToken)
     {
@@ -133,7 +142,7 @@ internal bool IsCacheStale(long accessTime, ConfigServerClientOptions optionsSna
     [LoggerMessage(Level = LogLevel.Debug, Message = "Config Server health check returning UP.")]
     private partial void LogHealthCheckReturningUp();
 
-    [LoggerMessage(Level = LogLevel.Debug, Message = "Returning property sources: {PropertySources}.")]
+    [LoggerMessage(Level = LogLevel.Debug, SkipEnabledCheck = true, Message = "Returning property sources: {PropertySources}.")]
     private partial void LogReturningPropertySources(string propertySources);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Cache stale, fetching config server health.")]
diff --git a/src/Configuration/src/Encryption/DecryptionConfigurationProvider.cs b/src/Configuration/src/Encryption/DecryptionConfigurationProvider.cs
index b5f536f2d5..e836828333 100644
--- a/src/Configuration/src/Encryption/DecryptionConfigurationProvider.cs
+++ b/src/Configuration/src/Encryption/DecryptionConfigurationProvider.cs
@@ -56,5 +56,5 @@ private ITextDecryptor EnsureDecryptor(IConfigurationRoot configurationRoot)
     }
 
     [LoggerMessage(Level = LogLevel.Trace, Message = "Decrypted value '{CipherValue}' at key '{Key}' to '{PlainTextValue}'.")]
-    private partial void LogDecrypt(string key, string? cipherValue, string? plainTextValue);
+    private partial void LogDecrypt(string key, string cipherValue, string plainTextValue);
 }
diff --git a/src/Discovery/src/Eureka/EurekaClient.cs b/src/Discovery/src/Eureka/EurekaClient.cs
index 59bc33dc9d..912d5b06ae 100644
--- a/src/Discovery/src/Eureka/EurekaClient.cs
+++ b/src/Discovery/src/Eureka/EurekaClient.cs
@@ -247,7 +247,7 @@ private async Task<TResult> ExecuteRequestAsync<TResult>(HttpMethod method, stri
                 if (!string.IsNullOrEmpty(clientOptions.AccessTokenUri))
                 {
                     var accessTokenUri = new Uri(clientOptions.AccessTokenUri);
-                    LogFailedToFetchAccessToken(exception, accessTokenUri.ToMaskedString(), attempt);
+                    LogFailedToFetchAccessToken(exception, accessTokenUri, attempt);
 
                     continue;
                 }
@@ -257,18 +257,18 @@ private async Task<TResult> ExecuteRequestAsync<TResult>(HttpMethod method, stri
 
             if (!string.IsNullOrEmpty(requestBody))
             {
-                LogSendingRequestWithBody(request.Method, requestUri.ToMaskedString(), requestBody);
+                LogSendingRequestWithBody(request.Method, requestUri, requestBody);
             }
             else
             {
-                LogSendingRequestWithoutBody(request.Method, requestUri.ToMaskedString());
+                LogSendingRequestWithoutBody(request.Method, requestUri);
             }
 
             try
             {
                 using HttpResponseMessage response = await httpClient.SendAsync(request, cancellationToken);
 
-                LogRequestReturnedStatus(request.Method, requestUri.ToMaskedString(), (int)response.StatusCode, attempt);
+                LogRequestReturnedStatus(request.Method, requestUri, (int)response.StatusCode, attempt);
 
                 if (response.IsSuccessStatusCode)
                 {
@@ -280,19 +280,19 @@ private async Task<TResult> ExecuteRequestAsync<TResult>(HttpMethod method, stri
                     }
                     catch (JsonException exception) when (!exception.IsCancellation())
                     {
-                        LogFailedToDeserializeResponse(exception, request.Method, requestUri.ToMaskedString());
+                        LogFailedToDeserializeResponse(exception, request.Method, requestUri);
                     }
                 }
                 else
                 {
                     string responseBody = await response.Content.ReadAsStringAsync(cancellationToken);
 
-                    LogRequestFailed(request.Method, requestUri.ToMaskedString(), (int)response.StatusCode, responseBody);
+                    LogRequestFailed(request.Method, requestUri, (int)response.StatusCode, responseBody);
                 }
             }
             catch (Exception exception) when (!exception.IsCancellation())
             {
-                LogAttemptFailed(exception, request.Method, requestUri.ToMaskedString(), attempt);
+                LogAttemptFailed(exception, request.Method, requestUri, attempt);
             }
 
             _eurekaServiceUriStateManager.MarkFailingServiceUri(serviceUri);
@@ -331,7 +331,7 @@ private async Task<HttpRequestMessage> GetRequestMessageAsync(EurekaClientOption
 
         if (requestUri.TryGetUsernamePassword(out string? username, out string? password) && password.Length > 0)
         {
-            LogAddingCredentials(requestUri.ToMaskedString());
+            LogAddingCredentials(requestUri);
 
             requestMessage.Headers.Authorization =
                 new AuthenticationHeaderValue("Basic", Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}")));
@@ -346,7 +346,7 @@ private async Task<HttpRequestMessage> GetRequestMessageAsync(EurekaClientOption
                 string accessToken =
                     await httpClient.GetAccessTokenAsync(accessTokenUri, optionsSnapshot.ClientId, optionsSnapshot.ClientSecret, cancellationToken);
 
-                LogAccessTokenFetched(accessTokenUri.ToMaskedString());
+                LogAccessTokenFetched(accessTokenUri);
                 requestMessage.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
             }
         }
@@ -365,29 +365,29 @@ private async Task<HttpRequestMessage> GetRequestMessageAsync(EurekaClientOption
     private partial void LogHostNamePotentiallyInvalid();
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Sending {RequestMethod} request to '{RequestUri}' with body: '{RequestBody}'.")]
-    private partial void LogSendingRequestWithBody(HttpMethod requestMethod, string requestUri, string? requestBody);
+    private partial void LogSendingRequestWithBody(HttpMethod requestMethod, MaskedUri requestUri, string? requestBody);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Sending {RequestMethod} request to '{RequestUri}' without request body.")]
-    private partial void LogSendingRequestWithoutBody(HttpMethod requestMethod, string requestUri);
+    private partial void LogSendingRequestWithoutBody(HttpMethod requestMethod, MaskedUri requestUri);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "HTTP {RequestMethod} request to '{RequestUri}' returned status {StatusCode} in attempt {Attempt}.")]
-    private partial void LogRequestReturnedStatus(HttpMethod requestMethod, string requestUri, int statusCode, int attempt);
+    private partial void LogRequestReturnedStatus(HttpMethod requestMethod, MaskedUri requestUri, int statusCode, int attempt);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Failed to deserialize HTTP response from {RequestMethod} '{RequestUri}'.")]
-    private partial void LogFailedToDeserializeResponse(Exception exception, HttpMethod requestMethod, string requestUri);
+    private partial void LogFailedToDeserializeResponse(Exception exception, HttpMethod requestMethod, MaskedUri requestUri);
 
     [LoggerMessage(Level = LogLevel.Information, Message = "HTTP {RequestMethod} request to '{RequestUri}' failed with status {StatusCode}: '{ResponseBody}'.")]
-    private partial void LogRequestFailed(HttpMethod requestMethod, string requestUri, int statusCode, string responseBody);
+    private partial void LogRequestFailed(HttpMethod requestMethod, MaskedUri requestUri, int statusCode, string responseBody);
 
     [LoggerMessage(Level = LogLevel.Warning, Message = "Failed to execute HTTP {RequestMethod} request to '{RequestUri}' in attempt {Attempt}.")]
-    private partial void LogAttemptFailed(Exception exception, HttpMethod requestMethod, string requestUri, int attempt);
+    private partial void LogAttemptFailed(Exception exception, HttpMethod requestMethod, MaskedUri requestUri, int attempt);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Adding credentials from '{RequestUri}' to Authorization header.")]
-    private partial void LogAddingCredentials(string requestUri);
+    private partial void LogAddingCredentials(MaskedUri requestUri);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Fetched access token from '{AccessTokenUri}'.")]
-    private partial void LogAccessTokenFetched(string accessTokenUri);
+    private partial void LogAccessTokenFetched(MaskedUri accessTokenUri);
 
     [LoggerMessage(Level = LogLevel.Warning, Message = "Failed to fetch access token from '{AccessTokenUri}' in attempt {Attempt}.")]
-    private partial void LogFailedToFetchAccessToken(Exception exception, string accessTokenUri, int attempt);
+    private partial void LogFailedToFetchAccessToken(Exception exception, MaskedUri accessTokenUri, int attempt);
 }
diff --git a/src/Discovery/src/HttpClients/LoadBalancers/RandomLoadBalancer.cs b/src/Discovery/src/HttpClients/LoadBalancers/RandomLoadBalancer.cs
index 5f9ca42822..7903741d95 100644
--- a/src/Discovery/src/HttpClients/LoadBalancers/RandomLoadBalancer.cs
+++ b/src/Discovery/src/HttpClients/LoadBalancers/RandomLoadBalancer.cs
@@ -5,6 +5,7 @@
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
 using Steeltoe.Common.Discovery;
+using Steeltoe.Common.Extensions;
 
 namespace Steeltoe.Discovery.HttpClients.LoadBalancers;
 
@@ -72,5 +73,5 @@ public Task UpdateStatisticsAsync(Uri requestUri, Uri serviceInstanceUri, TimeSp
     private partial void LogNoServiceInstances(string serviceName);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Resolved '{ServiceName}' to '{ServiceInstance}'.")]
-    private partial void LogServiceInstanceResolved(string serviceName, Uri serviceInstance);
+    private partial void LogServiceInstanceResolved(string serviceName, MaskedUri serviceInstance);
 }
diff --git a/src/Discovery/src/HttpClients/LoadBalancers/RoundRobinLoadBalancer.cs b/src/Discovery/src/HttpClients/LoadBalancers/RoundRobinLoadBalancer.cs
index 4b459df508..9801280713 100644
--- a/src/Discovery/src/HttpClients/LoadBalancers/RoundRobinLoadBalancer.cs
+++ b/src/Discovery/src/HttpClients/LoadBalancers/RoundRobinLoadBalancer.cs
@@ -7,6 +7,7 @@
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
 using Steeltoe.Common.Discovery;
+using Steeltoe.Common.Extensions;
 
 namespace Steeltoe.Discovery.HttpClients.LoadBalancers;
 
@@ -136,5 +137,5 @@ public Task UpdateStatisticsAsync(Uri requestUri, Uri serviceInstanceUri, TimeSp
     private partial void LogNoServiceInstances(string serviceName);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Resolved '{ServiceName}' to '{ServiceInstance}'.")]
-    private partial void LogServiceInstanceResolved(string serviceName, Uri serviceInstance);
+    private partial void LogServiceInstanceResolved(string serviceName, MaskedUri serviceInstance);
 }
diff --git a/src/Management/src/Endpoint/Actuators/CloudFoundry/PermissionsProvider.cs b/src/Management/src/Endpoint/Actuators/CloudFoundry/PermissionsProvider.cs
index ba03042926..7e2f51b131 100644
--- a/src/Management/src/Endpoint/Actuators/CloudFoundry/PermissionsProvider.cs
+++ b/src/Management/src/Endpoint/Actuators/CloudFoundry/PermissionsProvider.cs
@@ -51,8 +51,8 @@ public async Task<SecurityResult> GetPermissionsAsync(string accessToken, Cancel
         }
 
         CloudFoundryEndpointOptions options = _optionsMonitor.CurrentValue;
-        string checkPermissionsUri = $"{options.Api}/v2/apps/{options.ApplicationId}/permissions";
-        var request = new HttpRequestMessage(HttpMethod.Get, new Uri(checkPermissionsUri, UriKind.RelativeOrAbsolute));
+        var checkPermissionsUri = new Uri($"{options.Api}/v2/apps/{options.ApplicationId}/permissions", UriKind.RelativeOrAbsolute);
+        var request = new HttpRequestMessage(HttpMethod.Get, checkPermissionsUri);
         var auth = new AuthenticationHeaderValue("bearer", accessToken);
         request.Headers.Authorization = auth;
 
@@ -64,7 +64,7 @@ public async Task<SecurityResult> GetPermissionsAsync(string accessToken, Cancel
 
             if (response.StatusCode != HttpStatusCode.OK)
             {
-                LogResponseStatus(response.StatusCode, checkPermissionsUri);
+                LogResponseStatus(checkPermissionsUri, response.StatusCode);
 
                 if (response.StatusCode is HttpStatusCode.Forbidden)
                 {
@@ -100,7 +100,7 @@ public async Task<SecurityResult> GetPermissionsAsync(string accessToken, Cancel
         try
         {
             string json = await response.Content.ReadAsStringAsync(cancellationToken);
-            LogResponseJson(SecurityUtilities.SanitizeInput(json));
+            ExpensiveLogResponseJson(json);
 
             PermissionsResponse? result = JsonSerializer.Deserialize(json, CloudFoundryJsonSerializerContext.Default.PermissionsResponse);
 
@@ -120,6 +120,15 @@ public async Task<SecurityResult> GetPermissionsAsync(string accessToken, Cancel
         }
     }
 
+    private void ExpensiveLogResponseJson(string json)
+    {
+        if (_logger.IsEnabled(LogLevel.Debug))
+        {
+            string input = SecurityUtilities.SanitizeInput(json);
+            LogResponseJson(input);
+        }
+    }
+
     private HttpClient CreateHttpClient()
     {
         HttpClient httpClient = _httpClientFactory.CreateClient(HttpClientName);
@@ -128,12 +137,12 @@ private HttpClient CreateHttpClient()
     }
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Fetching permissions from {PermissionsUri}.")]
-    private partial void LogGetPermissions(string permissionsUri);
+    private partial void LogGetPermissions(MaskedUri permissionsUri);
 
     [LoggerMessage(Level = LogLevel.Information, Message = "Cloud Foundry returned status {HttpStatus} while obtaining permissions from {PermissionsUri}.")]
-    private partial void LogResponseStatus(HttpStatusCode httpStatus, string permissionsUri);
+    private partial void LogResponseStatus(MaskedUri permissionsUri, HttpStatusCode httpStatus);
 
-    [LoggerMessage(Level = LogLevel.Debug, Message = "Permissions response returned JSON: {Json}")]
+    [LoggerMessage(Level = LogLevel.Debug, SkipEnabledCheck = true, Message = "Permissions response returned JSON: {Json}")]
     private partial void LogResponseJson(string json);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Resolved permissions to {Permissions}.")]
diff --git a/src/Management/src/Endpoint/Actuators/HttpExchanges/HttpExchangeRequest.cs b/src/Management/src/Endpoint/Actuators/HttpExchanges/HttpExchangeRequest.cs
index 2f8d0bc53a..6d26d346ad 100644
--- a/src/Management/src/Endpoint/Actuators/HttpExchanges/HttpExchangeRequest.cs
+++ b/src/Management/src/Endpoint/Actuators/HttpExchanges/HttpExchangeRequest.cs
@@ -4,6 +4,7 @@
 
 using System.Text.Json.Serialization;
 using Microsoft.Extensions.Primitives;
+using Steeltoe.Common.Extensions;
 using Steeltoe.Common.Json;
 
 namespace Steeltoe.Management.Endpoint.Actuators.HttpExchanges;
@@ -13,9 +14,19 @@ public sealed class HttpExchangeRequest
     [JsonPropertyName("method")]
     public string Method { get; }
 
-    [JsonPropertyName("uri")]
+    [JsonIgnore]
     public Uri Uri { get; }
 
+    [JsonPropertyName("uri")]
+    public string JsonUri
+    {
+        get
+        {
+            MaskedUri masked = Uri;
+            return masked.ToString();
+        }
+    }
+
     [JsonPropertyName("headers")]
     [JsonIgnoreEmptyCollection]
     public IDictionary<string, StringValues> Headers { get; }
diff --git a/src/Management/src/Endpoint/Actuators/HttpExchanges/HttpExchangesRepository.cs b/src/Management/src/Endpoint/Actuators/HttpExchanges/HttpExchangesRepository.cs
index 63107c0121..5c0afd2466 100644
--- a/src/Management/src/Endpoint/Actuators/HttpExchanges/HttpExchangesRepository.cs
+++ b/src/Management/src/Endpoint/Actuators/HttpExchanges/HttpExchangesRepository.cs
@@ -6,6 +6,7 @@
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using Microsoft.Extensions.Primitives;
+using Steeltoe.Common.Extensions;
 
 namespace Steeltoe.Management.Endpoint.Actuators.HttpExchanges;
 
@@ -106,5 +107,5 @@ private static bool HeaderShouldBeRedacted(string currentHeader, HashSet<string>
     }
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Incoming exchange for {Url}.")]
-    private partial void LogIncomingExchange(Uri url);
+    private partial void LogIncomingExchange(MaskedUri url);
 }
diff --git a/src/Management/src/Endpoint/Actuators/Loggers/LoggersEndpointHandler.cs b/src/Management/src/Endpoint/Actuators/Loggers/LoggersEndpointHandler.cs
index c0afe42906..5abeef3d99 100644
--- a/src/Management/src/Endpoint/Actuators/Loggers/LoggersEndpointHandler.cs
+++ b/src/Management/src/Endpoint/Actuators/Loggers/LoggersEndpointHandler.cs
@@ -48,7 +48,7 @@ public LoggersEndpointHandler(IOptionsMonitor<LoggersEndpointOptions> optionsMon
     {
         ArgumentNullException.ThrowIfNull(request);
 
-        LogEntering(SecurityUtilities.SanitizeInput(request.ToString()));
+        ExpensiveLogEntering(request);
 
         LoggersResponse? response;
 
@@ -65,6 +65,15 @@ public LoggersEndpointHandler(IOptionsMonitor<LoggersEndpointOptions> optionsMon
         return Task.FromResult(response);
     }
 
+    private void ExpensiveLogEntering(LoggersRequest request)
+    {
+        if (_logger.IsEnabled(LogLevel.Debug))
+        {
+            string input = SecurityUtilities.SanitizeInput(request.ToString());
+            LogEntering(input);
+        }
+    }
+
     private LoggersResponse GetLogLevels()
     {
         ICollection<DynamicLoggerState> loggerStates = _dynamicLoggerProvider.GetLogLevels();
@@ -90,7 +99,7 @@ private void SetLogLevel(string name, string? level)
         _dynamicLoggerProvider.SetLogLevel(categoryName, logLevel);
     }
 
-    [LoggerMessage(Level = LogLevel.Debug, Message = "Invoking loggers endpoint handler with request {Request}.")]
+    [LoggerMessage(Level = LogLevel.Debug, SkipEnabledCheck = true, Message = "Invoking loggers endpoint handler with request {Request}.")]
     private partial void LogEntering(string request);
 
     [LoggerMessage(Level = LogLevel.Trace, Message = "Adding state {LoggerState}.")]
diff --git a/src/Management/src/Endpoint/Middleware/EndpointMiddleware.cs b/src/Management/src/Endpoint/Middleware/EndpointMiddleware.cs
index 6a1c54177c..c25348d82d 100644
--- a/src/Management/src/Endpoint/Middleware/EndpointMiddleware.cs
+++ b/src/Management/src/Endpoint/Middleware/EndpointMiddleware.cs
@@ -7,6 +7,7 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
+using Microsoft.Extensions.Primitives;
 using Microsoft.Net.Http.Headers;
 using Steeltoe.Management.Configuration;
 using Steeltoe.Management.Endpoint.Configuration;
@@ -68,7 +69,7 @@ public async Task InvokeAsync(HttpContext context, RequestDelegate? next)
                 }
                 else if (!IsCompatibleAcceptHeader(context.Request))
                 {
-                    LogUnsupportedAcceptHeader(context.Request.Headers.Accept.ToString());
+                    LogUnsupportedAcceptHeader(context.Request.Headers.Accept);
                     context.Response.StatusCode = (int)HttpStatusCode.NotAcceptable;
                     await context.Response.WriteAsync($"Only the '{ContentType}' content type is supported.", context.RequestAborted);
                 }
@@ -154,7 +155,7 @@ protected virtual async Task WriteResponseAsync(TResponse response, HttpContext
     private partial void LogUnsupportedContentType(string? requestContentType);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Accept header '{AcceptType}' is not supported for this request.")]
-    private partial void LogUnsupportedAcceptHeader(string acceptType);
+    private partial void LogUnsupportedAcceptHeader(StringValues acceptType);
 
     [LoggerMessage(Level = LogLevel.Debug, Message = "Reading {Method} request at path {Path} using {MiddlewareType}.")]
     private partial void LogReadingRequest(string method, string? path, Type middlewareType);
diff --git a/src/Management/src/Endpoint/PublicAPI.Unshipped.txt b/src/Management/src/Endpoint/PublicAPI.Unshipped.txt
index 7dc5c58110..8761d1bf5e 100755
--- a/src/Management/src/Endpoint/PublicAPI.Unshipped.txt
+++ b/src/Management/src/Endpoint/PublicAPI.Unshipped.txt
@@ -1 +1,2 @@
 #nullable enable
+Steeltoe.Management.Endpoint.Actuators.HttpExchanges.HttpExchangeRequest.JsonUri.get -> string!
diff --git a/src/Management/test/Endpoint.Test/Actuators/HttpExchanges/HttpExchangesActuatorTest.cs b/src/Management/test/Endpoint.Test/Actuators/HttpExchanges/HttpExchangesActuatorTest.cs
index 476a670815..b28ed28eb7 100644
--- a/src/Management/test/Endpoint.Test/Actuators/HttpExchanges/HttpExchangesActuatorTest.cs
+++ b/src/Management/test/Endpoint.Test/Actuators/HttpExchanges/HttpExchangesActuatorTest.cs
@@ -183,7 +183,7 @@ public async Task Endpoint_returns_expected_data_without_filters(HostBuilderType
                   },
                   "request": {
                     "method": "GET",
-                    "uri": "http://api.test.com:8080/path/to/data?filter=A",
+                    "uri": "http://****:****@api.test.com:8080/path/to/data?filter=A",
                     "headers": {
                       "Accept": [
                         "application/json"
@@ -250,7 +250,7 @@ public async Task Endpoint_returns_expected_data_with_filters()
                   "timestamp": "2025-01-01T21:18:43Z",
                   "request": {
                     "method": "GET",
-                    "uri": "http://api.test.com:8080/"
+                    "uri": "http://****:****@api.test.com:8080/"
                   },
                   "response": {
                     "status": 200
@@ -301,7 +301,7 @@ public async Task Configured_header_names_are_case_insensitive()
                   "timestamp": "2025-01-01T21:18:43Z",
                   "request": {
                     "method": "POST",
-                    "uri": "http://localhost:80/",
+                    "uri": "http://localhost/",
                     "headers": {
                       "X-Whitelisted-Request-Header": [
                         "visible-request-header-value"
@@ -366,7 +366,7 @@ public async Task Respects_maximum_queue_capacity()
                   "timestamp": "2024-09-19T00:00:25",
                   "request": {
                     "method": "GET",
-                    "uri": "http://localhost:80/id/25"
+                    "uri": "http://localhost/id/25"
                   },
                   "response": {
                     "status": 200
@@ -376,7 +376,7 @@ public async Task Respects_maximum_queue_capacity()
                   "timestamp": "2024-09-19T00:00:24",
                   "request": {
                     "method": "GET",
-                    "uri": "http://localhost:80/id/24"
+                    "uri": "http://localhost/id/24"
                   },
                   "response": {
                     "status": 200
@@ -386,7 +386,7 @@ public async Task Respects_maximum_queue_capacity()
                   "timestamp": "2024-09-19T00:00:23",
                   "request": {
                     "method": "GET",
-                    "uri": "http://localhost:80/id/23"
+                    "uri": "http://localhost/id/23"
                   },
                   "response": {
                     "status": 200
@@ -396,7 +396,7 @@ public async Task Respects_maximum_queue_capacity()
                   "timestamp": "2024-09-19T00:00:22",
                   "request": {
                     "method": "GET",
-                    "uri": "http://localhost:80/id/22"
+                    "uri": "http://localhost/id/22"
                   },
                   "response": {
                     "status": 200
@@ -406,7 +406,7 @@ public async Task Respects_maximum_queue_capacity()
                   "timestamp": "2024-09-19T00:00:21",
                   "request": {
                     "method": "GET",
-                    "uri": "http://localhost:80/id/21"
+                    "uri": "http://localhost/id/21"
                   },
                   "response": {
                     "status": 200
@@ -467,7 +467,7 @@ public async Task Can_change_configuration_at_runtime()
                   "timestamp": "2024-09-19T00:00:02",
                   "request": {
                     "method": "GET",
-                    "uri": "http://localhost:80/id/2"
+                    "uri": "http://localhost/id/2"
                   },
                   "response": {
                     "status": 200
@@ -477,7 +477,7 @@ public async Task Can_change_configuration_at_runtime()
                   "timestamp": "2024-09-19T00:00:01",
                   "request": {
                     "method": "GET",
-                    "uri": "http://localhost:80/id/1"
+                    "uri": "http://localhost/id/1"
                   },
                   "response": {
                     "status": 200
@@ -514,7 +514,7 @@ public async Task Can_change_configuration_at_runtime()
                   "timestamp": "2024-09-19T00:00:01",
                   "request": {
                     "method": "GET",
-                    "uri": "http://localhost:80/id/1?q=test-query-string"
+                    "uri": "http://localhost/id/1?q=test-query-string"
                   },
                   "response": {
                     "status": 200
@@ -524,7 +524,7 @@ public async Task Can_change_configuration_at_runtime()
                   "timestamp": "2024-09-19T00:00:02",
                   "request": {
                     "method": "GET",
-                    "uri": "http://localhost:80/id/2?q=test-query-string"
+                    "uri": "http://localhost/id/2?q=test-query-string"
                   },
                   "response": {
                     "status": 200
@@ -549,7 +549,7 @@ private static HttpExchange CreateTestHttpExchange()
             ["X-Redacted-Response-Header"] = "Redact-Me"
         };
 
-        var request = new HttpExchangeRequest("GET", new Uri("http://api.test.com:8080/path/to/data?filter=A"), requestHeaders, "192.168.0.1");
+        var request = new HttpExchangeRequest("GET", new Uri("http://johndoe:secret@api.test.com:8080/path/to/data?filter=A"), requestHeaders, "192.168.0.1");
         var response = new HttpExchangeResponse((int)HttpStatusCode.OK, responseHeaders);
 
         return new HttpExchange(request, response, 1.January(2025).At(21, 18, 43).AsUtc(), new HttpExchangePrincipal("test-user"),
diff --git a/src/Security/src/Authorization.Certificate/CertificateAuthorizationHandler.cs b/src/Security/src/Authorization.Certificate/CertificateAuthorizationHandler.cs
index b3c251f44b..f569d803a8 100644
--- a/src/Security/src/Authorization.Certificate/CertificateAuthorizationHandler.cs
+++ b/src/Security/src/Authorization.Certificate/CertificateAuthorizationHandler.cs
@@ -74,14 +74,23 @@ private void HandleCertificateAuthorizationRequirement<T>(AuthorizationHandlerCo
         }
         else
         {
-            LogClaimValueMismatch(claimValue, context.User.FindFirstValue(claimType));
+            ExpensiveLogClaimValueMismatch(context, claimType, claimValue);
+        }
+    }
+
+    private void ExpensiveLogClaimValueMismatch(AuthorizationHandlerContext context, string claimType, string claimValue)
+    {
+        if (_logger.IsEnabled(LogLevel.Debug))
+        {
+            string? actualClaimValue = context.User.FindFirstValue(claimType);
+            LogClaimValueMismatch(claimValue, actualClaimValue);
         }
     }
 
     [LoggerMessage(Level = LogLevel.Error, Message = "Identity certificate did not match an expected pattern. Subject was '{CertificateSubject}'.")]
     private partial void LogIdentityCertificateMismatch(string certificateSubject);
 
-    [LoggerMessage(Level = LogLevel.Debug,
+    [LoggerMessage(Level = LogLevel.Debug, SkipEnabledCheck = true,
         Message = "User has the required claim, but the value doesn't match. Expected '{ExpectedClaimValue}' but got '{ActualClaimValue}'.")]
     private partial void LogClaimValueMismatch(string expectedClaimValue, string? actualClaimValue);
 }