diff --git a/dependency-check/global-suppressions.xml b/dependency-check/global-suppressions.xml
index bd8d869..e00a925 100644
--- a/dependency-check/global-suppressions.xml
+++ b/dependency-check/global-suppressions.xml
@@ -209,6 +209,15 @@
     <cve>CVE-2026-41178</cve>
     <cve>CVE-2026-44967</cve>
   </suppress>
+  <suppress>
+    <notes><![CDATA[
+      False positive: dependency-check matches cpe:opentelemetry:opentelemetry (OpenTelemetry's
+      versioning, affected below 2.8.0) to the unrelated Prometheus Java client tracer modules;
+      observed on 1.3.5, 1.3.10 and 1.9.0.
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/io\.prometheus/prometheus\-metrics\-tracer\-otel(\-agent)?@.*$</packageUrl>
+    <vulnerabilityName>CVE-2026-54285</vulnerabilityName>
+  </suppress>
   <suppress>
     <notes><![CDATA[
    CVE-2026-42582 and CVE-2026-56816 affect netty-codec-http3 which only exists in the