diff --git a/lib/datadog/appsec/contrib/rack/gateway/watcher.rb b/lib/datadog/appsec/contrib/rack/gateway/watcher.rb
index 87c2e7da2ff..603f99793ef 100644
--- a/lib/datadog/appsec/contrib/rack/gateway/watcher.rb
+++ b/lib/datadog/appsec/contrib/rack/gateway/watcher.rb
@@ -27,7 +27,6 @@ def self.watch
                   # TODO: factor out
                   if defined?(Datadog::Tracing) && Datadog::Tracing.respond_to?(:active_span)
                     active_trace = Datadog::Tracing.active_trace
-                    root_span = active_trace.send(:root_span) if active_trace
                     active_span = Datadog::Tracing.active_span
 
                     Datadog.logger.debug { "active span: #{active_span.span_id}" } if active_span
@@ -45,7 +44,6 @@ def self.watch
                       event = {
                         waf_result: result,
                         trace: active_trace,
-                        root_span: root_span,
                         span: active_span,
                         request: request,
                         action: action
@@ -77,7 +75,6 @@ def self.watch
                   # TODO: factor out
                   if defined?(Datadog::Tracing) && Datadog::Tracing.respond_to?(:active_span)
                     active_trace = Datadog::Tracing.active_trace
-                    root_span = active_trace.send(:root_span) if active_trace
                     active_span = Datadog::Tracing.active_span
 
                     Datadog.logger.debug { "active span: #{active_span.span_id}" } if active_span
@@ -95,7 +92,6 @@ def self.watch
                       event = {
                         waf_result: result,
                         trace: active_trace,
-                        root_span: root_span,
                         span: active_span,
                         response: response,
                         action: action
diff --git a/lib/datadog/appsec/event.rb b/lib/datadog/appsec/event.rb
index 02b5895757f..025dd28f1a0 100644
--- a/lib/datadog/appsec/event.rb
+++ b/lib/datadog/appsec/event.rb
@@ -43,26 +43,20 @@ def self.record(*events)
       end
 
       # rubocop:disable Metrics/AbcSize
-      # rubocop:disable Metrics/MethodLength
       def self.record_via_span(*events)
-        events.group_by { |e| e[:root_span] }.each do |root_span, event_group|
-          unless root_span
-            Datadog.logger.debug { "{ error: 'no root span: cannot record', event_group: #{event_group.inspect}}" }
+        events.group_by { |e| e[:trace] }.each do |trace, event_group|
+          unless trace
+            Datadog.logger.debug { "{ error: 'no trace: cannot record', event_group: #{event_group.inspect}}" }
             next
           end
 
-          # TODO: this is a hack but there is no API to do that
-          root_span_tags = root_span.send(:meta).keys
+          trace.keep!
 
           # prepare and gather tags to apply
-          root_tags = event_group.each_with_object({}) do |event, tags|
+          trace_tags = event_group.each_with_object({}) do |event, tags|
             span = event[:span]
-            trace = event[:trace]
 
-            if span
-              span.set_tag('appsec.event', 'true')
-              trace.keep!
-            end
+            span.set_tag('appsec.event', 'true') if span
 
             request = event[:request]
             response = event[:response]
@@ -98,16 +92,15 @@ def self.record_via_span(*events)
           # apply tags to root span
 
           # complex types are unsupported, we need to serialize to a string
-          triggers = root_tags.delete('_dd.appsec.triggers')
-          root_span.set_tag('_dd.appsec.json', JSON.dump({ triggers: triggers }))
+          triggers = trace_tags.delete('_dd.appsec.triggers')
+          trace.send(:set_tag, '_dd.appsec.json', JSON.dump({ triggers: triggers }))
 
-          root_tags.each do |key, value|
-            root_span.set_tag(key, value.is_a?(String) ? value.encode('UTf-8') : value) unless root_span_tags.include?(key)
+          trace_tags.each do |key, value|
+            trace.send(:set_tag, key, value.is_a?(String) ? value.encode('UTF-8') : value)
           end
         end
       end
       # rubocop:enable Metrics/AbcSize
-      # rubocop:enable Metrics/MethodLength
     end
   end
 end