diff --git a/stack/observability/otel-collector/install.sh b/stack/observability/otel-collector/install.sh
index 3e59110..d76d2a5 100755
--- a/stack/observability/otel-collector/install.sh
+++ b/stack/observability/otel-collector/install.sh
@@ -14,6 +14,6 @@ kubectl create namespace monitoring --dry-run=client -o yaml | kubectl apply -f
 
 helm upgrade --install otel-collector open-telemetry/opentelemetry-collector \
   --namespace monitoring \
-  --version 0.166.0 \
+  --version 0.169.0 \
   --values "${SCRIPT_DIR}/values.yaml" \
   --wait
diff --git a/stack/observability/otel-collector/values.yaml b/stack/observability/otel-collector/values.yaml
index 4ddcd2a..d049628 100644
--- a/stack/observability/otel-collector/values.yaml
+++ b/stack/observability/otel-collector/values.yaml
@@ -28,7 +28,12 @@ mode: deployment
 
 image:
   repository: otel/opentelemetry-collector-contrib
-  tag: "0.157.0"
+  # No `tag:` deliberately. The chart renders
+  # `.Values.image.tag | default .Chart.AppVersion`, so leaving it unset makes the
+  # image follow the chart pin instead of being a second fact maintained beside
+  # it — mirror-check compares chart versions and would never see the two drift.
+  # The contrib distro publishes the same version numbers as the core collector
+  # the appVersion tracks.
 
 # Stable object name, matching upstream — the `telemetry` Service alias below
 # selects on it, and a rename would break the tenant contract silently.
diff --git a/stack/upstream.json b/stack/upstream.json
index e915465..52dd023 100644
--- a/stack/upstream.json
+++ b/stack/upstream.json
@@ -3,7 +3,7 @@
   "upstream": {
     "repository": "nanohype/eks-gitops",
     "path": "applicationsets",
-    "ref": "46f9f8e94d7d63a7092007f22dcf77a7de6fd9e5"
+    "ref": "9c7ce0476cd44aa2637b893f592a1f40fda99f81"
   },
   "divergences": [
     {