diff --git a/stable/datadog/Chart.yaml b/stable/datadog/Chart.yaml
old mode 100755
new mode 100644
index 66fda8d802..24f5749c30
--- a/stable/datadog/Chart.yaml
+++ b/stable/datadog/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: datadog
-version: 1.38.10
+version: 1.38.11
 appVersion: "6"
 description: DataDog Agent
 keywords:
diff --git a/stable/datadog/README.md b/stable/datadog/README.md
index 0955fcbbb7..3db35ec030 100644
--- a/stable/datadog/README.md
+++ b/stable/datadog/README.md
@@ -372,6 +372,7 @@ helm install --name <RELEASE_NAME> \
 | `clusterchecksDeployment.rbac.serviceAccount`            | existing ServiceAccount to use (ignored if rbac.create=true) for clusterchecks                | `default`                                   |
 | `clusterchecksDeployment.strategy`                       | Which update strategy to deploy the Cluster Checks Deployment                                 | RollingUpdate with 0 maxUnavailable, 1 maxSurge |
 | `systemProbe.enabled`                  | If both this flag and `daemonset.useDedicatedContainers` are true, enable system probe collection 	        | `false`                                           |
+| `systemProbe.seccomp`                  | Apply an ad-hoc seccomp profile to system-probe to restrict its privileges                                 | `localhost/system-probe`                          |
 | `systemProbe.seccompRoot`              | Seccomp root directory for system-probe                                                                    | `/var/lib/kubelet/seccomp`                        |
 | `systemProbe.debugPort`                | The port to expose pprof and expvar for system-probe agent, it is not enabled if the value is set to 0     | `0`                                               |
 | `systemProbe.enableConntrack`          | If true, system-probe connects to the netlink/conntrack subsystem to add NAT information to connection data. Ref: http://conntrack-tools.netfilter.org/| `true`|
diff --git a/stable/datadog/ci/no_hardened_seccomp.yaml b/stable/datadog/ci/no_hardened_seccomp.yaml
new file mode 100644
index 0000000000..4050954a15
--- /dev/null
+++ b/stable/datadog/ci/no_hardened_seccomp.yaml
@@ -0,0 +1,5 @@
+# Empty values file for testing default parameters.
+
+systemProbe:
+  enabled: true
+  seccomp: runtime/default
diff --git a/stable/datadog/templates/daemonset.yaml b/stable/datadog/templates/daemonset.yaml
index 9661677498..2281335850 100644
--- a/stable/datadog/templates/daemonset.yaml
+++ b/stable/datadog/templates/daemonset.yaml
@@ -44,7 +44,9 @@ spec:
         {{- end }}
         {{- if and .Values.systemProbe.enabled .Values.daemonset.useDedicatedContainers }}
         container.apparmor.security.beta.kubernetes.io/system-probe: {{ .Values.systemProbe.apparmor }}
-        container.seccomp.security.alpha.kubernetes.io/system-probe: localhost/system-probe
+        {{- if .Values.systemProbe.seccomp }}
+        container.seccomp.security.alpha.kubernetes.io/system-probe: {{ .Values.systemProbe.seccomp }}
+        {{- end }}
         {{- end }}
       {{- if .Values.daemonset.podAnnotations }}
 {{ toYaml .Values.daemonset.podAnnotations | indent 8 }}
@@ -86,7 +88,7 @@ spec:
       {{- if .Values.daemonset.useDedicatedContainers }}
       initContainers:
         {{ include "containers-init" . | nindent 8 }}
-        {{- if .Values.systemProbe.enabled }}
+        {{- if and .Values.systemProbe.enabled (eq .Values.systemProbe.seccomp "localhost/system-probe") }}
           {{ include "system-probe-init" . | nindent 8 }}
         {{- end }}
       {{- end }}
@@ -142,15 +144,17 @@ spec:
           name: passwd
         {{- end }}
         {{- if and .Values.systemProbe.enabled .Values.daemonset.useDedicatedContainers }}
-        - name: datadog-agent-security
-          configMap:
-            name: datadog-agent-security
         - name: sysprobe-config
           configMap:
             name: system-probe-config
+        {{- if eq .Values.systemProbe.seccomp "localhost/system-probe" }}
+        - name: datadog-agent-security
+          configMap:
+            name: datadog-agent-security
         - hostPath:
             path: {{ .Values.systemProbe.seccompRoot }}
           name: seccomp-root
+        {{- end }}
         - hostPath:
             path: /sys/kernel/debug
           name: debugfs
diff --git a/stable/datadog/templates/system-probe-configmap.yaml b/stable/datadog/templates/system-probe-configmap.yaml
index 731a34c464..e19dc129f4 100644
--- a/stable/datadog/templates/system-probe-configmap.yaml
+++ b/stable/datadog/templates/system-probe-configmap.yaml
@@ -23,6 +23,7 @@ data:
       sysprobe_socket: /opt/datadog-agent/run/sysprobe.sock
       enable_conntrack : {{ $.Values.systemProbe.enableConntrack }}
       bpf_debug: {{ $.Values.systemProbe.bpfDebug }}
+{{- if eq .Values.systemProbe.seccomp "localhost/system-probe" }}
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -197,3 +198,4 @@ data:
       ]
     }
 {{- end }}
+{{- end }}
diff --git a/stable/datadog/values.yaml b/stable/datadog/values.yaml
index 86d26cea56..40baa5450e 100644
--- a/stable/datadog/values.yaml
+++ b/stable/datadog/values.yaml
@@ -307,6 +307,12 @@ systemProbe:
   #
   enableConntrack: true
 
+  ## @param seccomp - string - required
+  ## Apply an ad-hoc seccomp profile to the system-probe agent to restrict its privileges
+  ## Note that this will break `kubectl exec … -c system-probe -- /bin/bash`
+  #
+  seccomp: localhost/system-probe
+
   ## @param seccompRoot - string - required
   ## Specify the seccomp profile root directory
   #