diff --git a/pkg/storage/secret/encryption/data_key_store.go b/pkg/storage/secret/encryption/data_key_store.go
index aa94333b629..b80da516acd 100644
--- a/pkg/storage/secret/encryption/data_key_store.go
+++ b/pkg/storage/secret/encryption/data_key_store.go
@@ -37,11 +37,16 @@ func ProvideDataKeyStorage(
 }
 
 func (ss *encryptionStoreImpl) GetDataKey(ctx context.Context, namespace, uid string) (*contracts.SecretDataKey, error) {
+	start := time.Now()
 	ctx, span := ss.tracer.Start(ctx, "DataKeyStorage.GetDataKey", trace.WithAttributes(
 		attribute.String("namespace", namespace),
 		attribute.String("uid", uid),
 	))
-	defer span.End()
+
+	defer func() {
+		span.End()
+		ss.metrics.GetDataKeyDuration.Observe(float64(time.Since(start)))
+	}()
 
 	req := readDataKey{
 		SQLTemplate: sqltemplate.New(ss.dialect),
@@ -95,11 +100,15 @@ func (ss *encryptionStoreImpl) GetDataKey(ctx context.Context, namespace, uid st
 }
 
 func (ss *encryptionStoreImpl) GetCurrentDataKey(ctx context.Context, namespace, label string) (*contracts.SecretDataKey, error) {
+	start := time.Now()
 	ctx, span := ss.tracer.Start(ctx, "DataKeyStorage.GetCurrentDataKey", trace.WithAttributes(
 		attribute.String("namespace", namespace),
 		attribute.String("label", label),
 	))
-	defer span.End()
+	defer func() {
+		span.End()
+		ss.metrics.GetCurrentDataKeyDuration.Observe(float64(time.Since(start)))
+	}()
 
 	req := readCurrentDataKey{
 		SQLTemplate: sqltemplate.New(ss.dialect),
@@ -153,10 +162,14 @@ func (ss *encryptionStoreImpl) GetCurrentDataKey(ctx context.Context, namespace,
 }
 
 func (ss *encryptionStoreImpl) GetAllDataKeys(ctx context.Context, namespace string) ([]*contracts.SecretDataKey, error) {
+	start := time.Now()
 	ctx, span := ss.tracer.Start(ctx, "DataKeyStorage.GetAllDataKeys", trace.WithAttributes(
 		attribute.String("namespace", namespace),
 	))
-	defer span.End()
+	defer func() {
+		span.End()
+		ss.metrics.GetAllDataKeysDuration.Observe(float64(time.Since(start)))
+	}()
 
 	req := listDataKeys{
 		SQLTemplate: sqltemplate.New(ss.dialect),
@@ -210,12 +223,16 @@ func (ss *encryptionStoreImpl) GetAllDataKeys(ctx context.Context, namespace str
 }
 
 func (ss *encryptionStoreImpl) CreateDataKey(ctx context.Context, dataKey *contracts.SecretDataKey) error {
+	start := time.Now()
 	ctx, span := ss.tracer.Start(ctx, "DataKeyStorage.CreateDataKey", trace.WithAttributes(
 		attribute.String("uid", dataKey.UID),
 		attribute.String("namespace", dataKey.Namespace),
 		attribute.Bool("active", dataKey.Active),
 	))
-	defer span.End()
+	defer func() {
+		span.End()
+		ss.metrics.CreateDataKeyDuration.Observe(float64(time.Since(start)))
+	}()
 
 	if !dataKey.Active {
 		return fmt.Errorf("cannot insert deactivated data keys")
@@ -252,10 +269,14 @@ func (ss *encryptionStoreImpl) CreateDataKey(ctx context.Context, dataKey *contr
 }
 
 func (ss *encryptionStoreImpl) DisableDataKeys(ctx context.Context, namespace string) error {
+	start := time.Now()
 	ctx, span := ss.tracer.Start(ctx, "DataKeyStorage.DisableDataKeys", trace.WithAttributes(
 		attribute.String("namespace", namespace),
 	))
-	defer span.End()
+	defer func() {
+		span.End()
+		ss.metrics.DisableDataKeysDuration.Observe(float64(time.Since(start)))
+	}()
 
 	req := disableDataKeys{
 		SQLTemplate: sqltemplate.New(ss.dialect),
@@ -286,11 +307,15 @@ func (ss *encryptionStoreImpl) DisableDataKeys(ctx context.Context, namespace st
 }
 
 func (ss *encryptionStoreImpl) DeleteDataKey(ctx context.Context, namespace, uid string) error {
+	start := time.Now()
 	ctx, span := ss.tracer.Start(ctx, "DataKeyStorage.DeleteDataKey", trace.WithAttributes(
 		attribute.String("uid", uid),
 		attribute.String("namespace", namespace),
 	))
-	defer span.End()
+	defer func() {
+		span.End()
+		ss.metrics.DeleteDataKeyDuration.Observe(float64(time.Since(start)))
+	}()
 
 	if len(uid) == 0 {
 		return fmt.Errorf("data key id is missing")
diff --git a/pkg/storage/secret/encryption/metrics.go b/pkg/storage/secret/encryption/metrics.go
index a7a116541ce..5a18d400764 100644
--- a/pkg/storage/secret/encryption/metrics.go
+++ b/pkg/storage/secret/encryption/metrics.go
@@ -17,7 +17,6 @@ type DataKeyMetrics struct {
 	GetAllDataKeysDuration    prometheus.Histogram
 	DisableDataKeysDuration   prometheus.Histogram
 	DeleteDataKeyDuration     prometheus.Histogram
-	ReEncryptDataKeysDuration prometheus.Histogram
 }
 
 func newDataKeyMetrics() *DataKeyMetrics {
@@ -64,17 +63,11 @@ func newDataKeyMetrics() *DataKeyMetrics {
 			Help:      "Duration of delete data key operations",
 			Buckets:   prometheus.DefBuckets,
 		}),
-		ReEncryptDataKeysDuration: prometheus.NewHistogram(prometheus.HistogramOpts{
-			Namespace: namespace,
-			Subsystem: subsystem,
-			Name:      "re_encrypt_data_keys_duration_seconds",
-			Help:      "Duration of re-encrypt data keys operations",
-			Buckets:   prometheus.DefBuckets,
-		}),
 	}
 }
 
-// NewDataKeyMetrics returns a singleton instance of the SecretsMetrics struct containing registered metrics
+// NewDataKeyMetrics returns an instance of the DataKeyMetrics
+// struct containing registered metrics if [reg] is not nil.
 func NewDataKeyMetrics(reg prometheus.Registerer) *DataKeyMetrics {
 	m := newDataKeyMetrics()
 
@@ -86,13 +79,8 @@ func NewDataKeyMetrics(reg prometheus.Registerer) *DataKeyMetrics {
 			m.GetAllDataKeysDuration,
 			m.DisableDataKeysDuration,
 			m.DeleteDataKeyDuration,
-			m.ReEncryptDataKeysDuration,
 		)
 	}
 
 	return m
 }
-
-func NewTestMetrics() *DataKeyMetrics {
-	return newDataKeyMetrics()
-}