diff --git a/hack/cni-plugins-staging-contract.bats b/hack/cni-plugins-staging-contract.bats
index 594531b12..32db6a7a3 100644
--- a/hack/cni-plugins-staging-contract.bats
+++ b/hack/cni-plugins-staging-contract.bats
@@ -22,7 +22,10 @@ extract_has() {
 }
 
 DOCKERFILE="$PWD/packages/system/multus/images/multus-cni/Dockerfile"
-KUBEOVN_VALUES="$PWD/packages/system/kubeovn/values.yaml"
+# The chart's appVersion, not the values.yaml image tag: a release build
+# restamps that tag to the Cozystack version (v1.7.0), the chart keeps the
+# kube-ovn release it vendors.
+KUBEOVN_CHART="$PWD/packages/system/kubeovn/charts/kube-ovn/Chart.yaml"
 DOC="$PWD/docs/vm-external-vlan.md"
 PLATFORM_VALUES="$PWD/packages/core/platform/values.yaml"
 TEMPLATE="$PWD/packages/system/multus/templates/multus-daemonset-thick.yml"
@@ -347,13 +350,12 @@ PATCHFILE="$PWD/packages/system/multus/patches/customize-deployment.patch"
   checked=$(sed -n 's|^# kube-ovn-cni-plugins-checked-against: *\([^ ]*\) *$|\1|p' "$DOCKERFILE")
   [ -n "$checked" ]
 
-  vendored=$(yq -r '.global.images.kubeovn.tag' "$KUBEOVN_VALUES" | sed 's|@.*||')
-  [ -n "$vendored" ]
-  [ "$vendored" != "null" ]
+  vendored=$(awk '$1 == "appVersion:" {gsub(/"/, "", $2); print "v" $2}' "$KUBEOVN_CHART")
+  [ "$vendored" != "v" ]
 
   if [ "$checked" != "$vendored" ]; then
     echo "the multus CNI plugin pin was checked against kube-ovn $checked," >&2
-    echo "but packages/system/kubeovn/values.yaml now vendors $vendored." >&2
+    echo "but packages/system/kubeovn/charts/kube-ovn/Chart.yaml now vendors $vendored." >&2
     echo >&2
     echo "Read CNI_PLUGINS_VERSION in kube-ovn $vendored's base image" >&2
     echo "(dist/images/Dockerfile.base). If it still matches the" >&2
diff --git a/packages/system/monitoring/tests/vtraces_collector_test.yaml b/packages/system/monitoring/tests/vtraces_collector_test.yaml
index b450bf520..eaa5921cb 100644
--- a/packages/system/monitoring/tests/vtraces_collector_test.yaml
+++ b/packages/system/monitoring/tests/vtraces_collector_test.yaml
@@ -473,11 +473,18 @@ tests:
           path: spec.template.spec.containers[0].securityContext.capabilities.drop
           content: ALL
 
+  # The image name is not asserted: a release build swaps the upstream
+  # collector for the first-party otelcol-tracing one and restamps the tag.
+  # What must hold is that the value goes through cozy-lib.image (the cluster
+  # images-registry lands in front of it) and stays digest-pinned.
   - it: pins the collector image through the cozy-lib.image helper
+    set:
+      _cluster:
+        images-registry: mirror.example.com
     documentSelector:
       path: kind
       value: Deployment
     asserts:
       - matchRegex:
           path: spec.template.spec.containers[0].image
-          pattern: "opentelemetry-collector-contrib:.*@sha256:"
+          pattern: '^mirror\.example\.com/.+@sha256:[0-9a-f]{64}$'