diff --git a/ansible/roles/testlists/tasks/main.yml b/ansible/roles/testlists/tasks/main.yml
index dabe6280..0e03375b 100644
--- a/ansible/roles/testlists/tasks/main.yml
+++ b/ansible/roles/testlists/tasks/main.yml
@@ -91,6 +91,7 @@
 - name: Ensure testlists is running
   community.docker.docker_container:
     env:
+      APP_NAME: "testlists"
       PROMETHEUS_METRICS_PASSWORD: "{{ prometheus_metrics_password }}"
       CLICKHOUSE_URL: "{{ clickhouse_url }}"
       JWT_ENCRYPTION_KEY: "{{ jwt_encryption_key }}"
diff --git a/tf/modules/ooniapi_service/main.tf b/tf/modules/ooniapi_service/main.tf
index 94bebfd8..08a2eb91 100644
--- a/tf/modules/ooniapi_service/main.tf
+++ b/tf/modules/ooniapi_service/main.tf
@@ -69,8 +69,10 @@ resource "aws_ecs_task_definition" "ooniapi_service" {
         }
       ],
 
+      # APP_NAME is used by the API services to tag their clickhouse queries
+      # (log_comment), so we can tell them apart in system.query_log
       environment = [
-        for k, v in var.task_environment : {
+        for k, v in merge({ APP_NAME = var.service_name }, var.task_environment) : {
           name  = k,
           value = v
         }