diff --git a/bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2 b/bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2
index 619125bc..21a0b20d 100644
--- a/bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/addons/kube-prometheus-stack/app/helmrelease.yaml.j2
@@ -42,29 +42,29 @@ spec:
       enabled: false
     kube-state-metrics:
       metricLabelsAllowlist:
-        - "pods=[*]"
         - "deployments=[*]"
         - "persistentvolumeclaims=[*]"
+        - "pods=[*]"
       prometheus:
         monitor:
           enabled: true
           relabelings:
             - action: replace
+              sourceLabels: ["__meta_kubernetes_pod_node_name"]
               regex: ^(.*)$
               replacement: $1
-              sourceLabels: ["__meta_kubernetes_pod_node_name"]
               targetLabel: kubernetes_node
     kubelet:
       enabled: true
       serviceMonitor:
         metricRelabelings:
           # Remove duplicate labels provided by k3s
-          - sourceLabels: ["__name__"]
+          - action: keep
+            sourceLabels: ["__name__"]
             regex: (apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authentication_token|cadvisor_version|container_blkio|container_cpu|container_fs|container_last|container_memory|container_network|container_oom|container_processes|container|csi_operations|disabled_metric|get_token|go|hidden_metric|kubelet_certificate|kubelet_cgroup|kubelet_container|kubelet_containers|kubelet_cpu|kubelet_device|kubelet_graceful|kubelet_http|kubelet_lifecycle|kubelet_managed|kubelet_node|kubelet_pleg|kubelet_pod|kubelet_run|kubelet_running|kubelet_runtime|kubelet_server|kubelet_started|kubelet_volume|kubernetes_build|kubernetes_feature|machine_cpu|machine_memory|machine_nvm|machine_scrape|node_namespace|plugin_manager|prober_probe|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|storage_operation|volume_manager|volume_operation|workqueue)_(.+)
-            action: keep
-          - sourceLabels: ["node"]
+          - action: replace
+            sourceLabels: ["node"]
             targetLabel: instance
-            action: replace
           # Drop high cardinality labels
           - action: labeldrop
             regex: (uid)
@@ -78,16 +78,16 @@ spec:
       serviceMonitor:
         metricRelabelings:
           # Remove duplicate labels provided by k3s
-          - sourceLabels: ["__name__"]
+          - action: keep
+            sourceLabels: ["__name__"]
             regex: (aggregator_openapi|aggregator_unavailable|apiextensions_openapi|apiserver_admission|apiserver_audit|apiserver_cache|apiserver_cel|apiserver_client|apiserver_crd|apiserver_current|apiserver_envelope|apiserver_flowcontrol|apiserver_init|apiserver_kube|apiserver_longrunning|apiserver_request|apiserver_requested|apiserver_response|apiserver_selfrequest|apiserver_storage|apiserver_terminated|apiserver_tls|apiserver_watch|apiserver_webhooks|authenticated_user|authentication|disabled_metric|etcd_bookmark|etcd_lease|etcd_request|field_validation|get_token|go|grpc_client|hidden_metric|kube_apiserver|kubernetes_build|kubernetes_feature|node_authorizer|pod_security|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|serviceaccount_legacy|serviceaccount_stale|serviceaccount_valid|watch_cache|workqueue)_(.+)
-            action: keep
           # Drop high cardinality labels
-          - sourceLabels: ["__name__"]
+          - action: drop
+            sourceLabels: ["__name__"]
             regex: (apiserver|etcd|rest_client)_request(|_sli|_slo)_duration_seconds_bucket
-            action: drop
-          - sourceLabels: ["__name__"]
+          - action: drop
+            sourceLabels: ["__name__"]
             regex: (apiserver_response_sizes_bucket|apiserver_watch_events_sizes_bucket)
-            action: drop
     kubeControllerManager:
       enabled: true
       endpoints: &cp
@@ -97,9 +97,9 @@ spec:
       serviceMonitor:
         metricRelabelings:
           # Remove duplicate labels provided by k3s
-          - sourceLabels: ["__name__"]
+          - action: keep
+            sourceLabels: ["__name__"]
             regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|attachdetach_controller|authenticated_user|authentication|cronjob_controller|disabled_metric|endpoint_slice|ephemeral_volume|garbagecollector_controller|get_token|go|hidden_metric|job_controller|kubernetes_build|kubernetes_feature|leader_election|node_collector|node_ipam|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|pv_collector|registered_metric|replicaset_controller|rest_client|retroactive_storageclass|root_ca|running_managed|scrape_duration|scrape_samples|scrape_series|service_controller|storage_count|storage_operation|ttl_after|volume_operation|workqueue)_(.+)"
-            action: keep
     kubeEtcd:
       enabled: true
       endpoints: *cp
@@ -109,9 +109,9 @@ spec:
       serviceMonitor:
         metricRelabelings:
           # Remove duplicate labels provided by k3s
-          - sourceLabels: ["__name__"]
+          - action: keep
+            sourceLabels: ["__name__"]
             regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authenticated_user|authentication|disabled_metric|go|hidden_metric|kubernetes_build|kubernetes_feature|leader_election|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scheduler|scrape_duration|scrape_samples|scrape_series|workqueue)_(.+)"
-            action: keep
     kubeProxy:
       enabled: false # Disabled due to eBPF
     prometheus: