diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 00000000..6ff2a2fc
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,9 @@
+# This is also used as the default configuration for the Zizmor reusable
+# workflow.
+
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        actions/*: any # trust GitHub
+        grafana/*: any # trust Grafana
diff --git a/docker/Dockerfile b/docker/Dockerfile
index c2ba7d0c..2e3787da 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -9,7 +9,7 @@ ARG LOKI_VERSION=v3.5.0
 # renovate: datasource=github-releases depName=pyroscope packageName=grafana/pyroscope
 ARG PYROSCOPE_VERSION=v1.13.2
 # renovate: datasource=github-releases depName=opentelemetry-collector packageName=open-telemetry/opentelemetry-collector-releases
-ARG OPENTELEMETRY_COLLECTOR_VERSION=v0.125.0
+ARG OPENTELEMETRY_COLLECTOR_VERSION=v0.126.0
 
 # hadolint global ignore=DL3059
 FROM redhat/ubi9:9.5-1747112166 AS builder
diff --git a/examples/ebpf-profiler/oats.yaml b/examples/ebpf-profiler/oats.yaml
index f37901ee..b748be7b 100644
--- a/examples/ebpf-profiler/oats.yaml
+++ b/examples/ebpf-profiler/oats.yaml
@@ -8,7 +8,7 @@ expected:
     - query: 'process_cpu:cpu:nanoseconds:cpu:nanoseconds{process_executable_name=~"python.*"}'
       flamebearers:
         # not very useful, because the python function names are not in the flamegraph
-        contains: "python3"
+        contains: "python"
     - query: 'process_cpu:cpu:nanoseconds:cpu:nanoseconds{process_executable_name="java"}'
       flamebearers:
         contains: "void org.springframework.boot.SpringApplication.refreshContext(org.springframework.context.ConfigurableApplicationContext)"