diff --git a/packages/aws/changelog.yml b/packages/aws/changelog.yml
index c277b5f408b..72a36124849 100644
--- a/packages/aws/changelog.yml
+++ b/packages/aws/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "6.21.1"
+  changes:
+    - description: Derive the OpenTelemetry-compatible 32-character hex `trace.id` from the X-Ray format trace ID in ELB access logs, enabling correlation with APM traces.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/20000
 - version: "6.21.0"
   changes:
     - description: Poll Amazon Inspector findings on `updatedAt` instead of `lastObservedAt` so that findings AWS marks CLOSED or SUPPRESSED are collected and no longer remain stale in Elastic.
diff --git a/packages/aws/data_stream/elb_logs/_dev/test/pipeline/test-alb.log-expected.json b/packages/aws/data_stream/elb_logs/_dev/test/pipeline/test-alb.log-expected.json
index cf28c7f3b71..8c695cc7783 100644
--- a/packages/aws/data_stream/elb_logs/_dev/test/pipeline/test-alb.log-expected.json
+++ b/packages/aws/data_stream/elb_logs/_dev/test/pipeline/test-alb.log-expected.json
@@ -82,7 +82,7 @@
                 "preserve_original_event"
             ],
             "trace": {
-                "id": "Root=1-58337262-36d228ad5d99923122bbe354"
+                "id": "5833726236d228ad5d99923122bbe354"
             },
             "url": {
                 "domain": "www.example.com",
@@ -172,7 +172,7 @@
                 "preserve_original_event"
             ],
             "trace": {
-                "id": "Root=1-627cac19-4c6df30820daa80e3fd72ced"
+                "id": "627cac194c6df30820daa80e3fd72ced"
             },
             "url": {
                 "domain": "127.0.0.1",
diff --git a/packages/aws/data_stream/elb_logs/elasticsearch/ingest_pipeline/default.yml b/packages/aws/data_stream/elb_logs/elasticsearch/ingest_pipeline/default.yml
index cc3931a2788..ea9d2eb176e 100644
--- a/packages/aws/data_stream/elb_logs/elasticsearch/ingest_pipeline/default.yml
+++ b/packages/aws/data_stream/elb_logs/elasticsearch/ingest_pipeline/default.yml
@@ -173,11 +173,24 @@ processors:
       field: event.outcome
       value: failure
       if: 'ctx?.http?.response?.status_code != null && ctx.http.response.status_code >= 400'
-  - set:
-      tag: set_trace_id_53565e4a
-      field: trace.id
-      value: '{{aws.elb.trace_id}}'
+  - script:
+      tag: script_derive_trace_id_from_xray
+      lang: painless
+      description: Derive the OpenTelemetry-compatible trace ID from the X-Ray format trace ID (Root=1-{8 hex}-{24 hex}) so ELB access logs and APM spans share the same trace.id. Falls back to the raw value for unrecognized formats.
       if: ctx?.aws?.elb?.trace_id != null
+      source: |-
+        String traceId = ctx.aws.elb.trace_id;
+        String root = traceId.splitOnToken(';')[0];
+        if (root.startsWith('Root=1-')) {
+          String[] parts = root.substring(7).splitOnToken('-');
+          if (parts.length == 2 && parts[0].length() == 8 && parts[1].length() == 24) {
+            traceId = parts[0] + parts[1];
+          }
+        }
+        if (ctx.trace == null) {
+          ctx.trace = new HashMap();
+        }
+        ctx.trace.id = traceId;
   - split:
       tag: split__tmp_actions_executed_to_aws_elb_action_executed_2b54cfea
       field: _tmp.actions_executed
diff --git a/packages/aws/data_stream/elb_logs/sample_event.json b/packages/aws/data_stream/elb_logs/sample_event.json
index 5328412c329..7746708d122 100644
--- a/packages/aws/data_stream/elb_logs/sample_event.json
+++ b/packages/aws/data_stream/elb_logs/sample_event.json
@@ -121,7 +121,7 @@
         "aws-elb-logs"
     ],
     "trace": {
-        "id": "Root=1-58337262-36d228ad5d99923122bbe354"
+        "id": "5833726236d228ad5d99923122bbe354"
     },
     "url": {
         "domain": "www.example.com",
diff --git a/packages/aws/docs/elb.md b/packages/aws/docs/elb.md
index 3399315502b..4c756e33bb3 100644
--- a/packages/aws/docs/elb.md
+++ b/packages/aws/docs/elb.md
@@ -275,7 +275,7 @@ An example event for `elb` looks as following:
         "aws-elb-logs"
     ],
     "trace": {
-        "id": "Root=1-58337262-36d228ad5d99923122bbe354"
+        "id": "5833726236d228ad5d99923122bbe354"
     },
     "url": {
         "domain": "www.example.com",
diff --git a/packages/aws/manifest.yml b/packages/aws/manifest.yml
index ee9dae64487..86139d1d39e 100644
--- a/packages/aws/manifest.yml
+++ b/packages/aws/manifest.yml
@@ -1,7 +1,7 @@
 format_version: 3.4.0
 name: aws
 title: AWS
-version: 6.21.0
+version: 6.21.1
 description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent.
 type: integration
 categories: