diff --git a/salt/common/packages.sls b/salt/common/packages.sls
index 5f4a348e7..fe36a1fa1 100644
--- a/salt/common/packages.sls
+++ b/salt/common/packages.sls
@@ -21,7 +21,6 @@ commonpkgs:
       - python3-dateutil
       - python3-docker
       - python3-packaging
-      - python3-watchdog
       - python3-lxml
       - git
       - rsync
@@ -78,7 +77,6 @@ commonpkgs:
       - python3-packaging
       - python3-pyyaml
       - python3-rich
-      - python3-watchdog
       - rsync
       - sqlite
       - tcpdump
diff --git a/salt/strelka/filestream/config.sls b/salt/strelka/filestream/config.sls
index 993a59650..a254e9253 100644
--- a/salt/strelka/filestream/config.sls
+++ b/salt/strelka/filestream/config.sls
@@ -47,6 +47,14 @@ filestream_config:
         FILESTREAMCONFIG: {{ STRELKAMERGED.filestream.config }}
 
 # Filecheck Section
+remove_old_watchdog:
+  pkg.removed:
+    - name: python3-watchdog
+
+install_watchdog:
+  pkg.installed:
+    - name: securityonion-python39-watchdog
+
 filecheck_logdir:
   file.directory:
     - name: /opt/so/log/strelka