diff --git a/rpc/grpcclientidentity/authlistener_grpc_adaptor.go b/rpc/grpcclientidentity/authlistener_grpc_adaptor.go
index 267516c..ec7d5a1 100644
--- a/rpc/grpcclientidentity/authlistener_grpc_adaptor.go
+++ b/rpc/grpcclientidentity/authlistener_grpc_adaptor.go
@@ -99,7 +99,9 @@ func (*transportCredentials) OverrideServerName(string) error {
 	panic("not implemented")
 }
 
-func NewInterceptors(logger Logger, clientIdentityKey interface{}) (unary grpc.UnaryServerInterceptor, stream grpc.StreamServerInterceptor) {
+type ContextInterceptor = func(ctx context.Context) context.Context
+
+func NewInterceptors(logger Logger, clientIdentityKey interface{}, ctxInterceptor ContextInterceptor) (unary grpc.UnaryServerInterceptor, stream grpc.StreamServerInterceptor) {
 	unary = func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp interface{}, err error) {
 		logger.WithField("fullMethod", info.FullMethod).Debug("request")
 		p, ok := peer.FromContext(ctx)
@@ -113,8 +115,13 @@ func NewInterceptors(logger Logger, clientIdentityKey interface{}) (unary grpc.U
 		}
 		logger.WithField("peer_client_identity", a.clientIdentity).Debug("peer client identity")
 		ctx = context.WithValue(ctx, clientIdentityKey, a.clientIdentity)
+		if ctxInterceptor != nil {
+			ctx = ctxInterceptor(ctx)
+		}
 		return handler(ctx, req)
 	}
-	stream = nil
+	stream = func(srv interface{}, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		panic("unimplemented")
+	}
 	return
 }
diff --git a/rpc/grpcclientidentity/example/main.go b/rpc/grpcclientidentity/example/main.go
index 0b0001e..81e7f61 100644
--- a/rpc/grpcclientidentity/example/main.go
+++ b/rpc/grpcclientidentity/example/main.go
@@ -92,7 +92,7 @@ func server() {
 		onErr(err, "cannot listen")
 	}
 
-	srv, serve := grpchelper.NewServer(authListener, clientIdentityKey, log)
+	srv, serve := grpchelper.NewServer(authListener, clientIdentityKey, log, nil)
 
 	svc := &greeter{"hello "}
 	pdu.RegisterGreeterServer(srv, svc)
diff --git a/rpc/grpcclientidentity/grpchelper/authlistener_grpc_adaptor_wrapper.go b/rpc/grpcclientidentity/grpchelper/authlistener_grpc_adaptor_wrapper.go
index f9d9f3b..85486de 100644
--- a/rpc/grpcclientidentity/grpchelper/authlistener_grpc_adaptor_wrapper.go
+++ b/rpc/grpcclientidentity/grpchelper/authlistener_grpc_adaptor_wrapper.go
@@ -50,7 +50,7 @@ func ClientConn(cn transport.Connecter, log Logger) *grpc.ClientConn {
 }
 
 // NewServer is a convenience interface around the TransportCredentials and Interceptors interface.
-func NewServer(authListener transport.AuthenticatedListener, clientIdentityKey interface{}, logger grpcclientidentity.Logger) (srv *grpc.Server, serve func() error) {
+func NewServer(authListener transport.AuthenticatedListener, clientIdentityKey interface{}, logger grpcclientidentity.Logger, ctxInterceptor grpcclientidentity.ContextInterceptor) (srv *grpc.Server, serve func() error) {
 	ka := grpc.KeepaliveParams(keepalive.ServerParameters{
 		Time:    StartKeepalivesAfterInactivityDuration,
 		Timeout: KeepalivePeerTimeout,
@@ -60,7 +60,7 @@ func NewServer(authListener transport.AuthenticatedListener, clientIdentityKey i
 		PermitWithoutStream: true,
 	})
 	tcs := grpcclientidentity.NewTransportCredentials(logger)
-	unary, stream := grpcclientidentity.NewInterceptors(logger, clientIdentityKey)
+	unary, stream := grpcclientidentity.NewInterceptors(logger, clientIdentityKey, ctxInterceptor)
 	srv = grpc.NewServer(grpc.Creds(tcs), grpc.UnaryInterceptor(unary), grpc.StreamInterceptor(stream), ka, ep)
 
 	serve = func() error {
diff --git a/rpc/rpc_server.go b/rpc/rpc_server.go
index b135c57..69e6335 100644
--- a/rpc/rpc_server.go
+++ b/rpc/rpc_server.go
@@ -35,9 +35,10 @@ type HandlerContextInterceptor func(ctx context.Context) context.Context
 // config must be valid (use its Validate function).
 func NewServer(handler Handler, loggers Loggers, ctxInterceptor HandlerContextInterceptor) *Server {
 
+	// setup control server
 	controlServerServe := func(ctx context.Context, controlListener transport.AuthenticatedListener, errOut chan<- error) {
 
-		controlServer, serve := grpchelper.NewServer(controlListener, endpoint.ClientIdentityKey, loggers.Control)
+		controlServer, serve := grpchelper.NewServer(controlListener, endpoint.ClientIdentityKey, loggers.Control, ctxInterceptor)
 		pdu.RegisterReplicationServer(controlServer, handler)
 
 		// give time for graceful stop until deadline expires, then hard stop