diff --git a/named-hosts/matic/default.nix b/named-hosts/matic/default.nix
index 182fc12b3..6cfff4d48 100644
--- a/named-hosts/matic/default.nix
+++ b/named-hosts/matic/default.nix
@@ -52,8 +52,8 @@ import ../../hosts/nixos {
           "tpm2-device=auto"
         ];
 
-        # Pin kernel: Falcon sensor 7.31.0 lacks kernel module for 6.18+, RFM on 6.19
-        boot.kernelPackages = pkgs.linuxPackages_6_17;
+        # Pin kernel to 6.18 for CrowdStrike Falcon compatibility (RFM on 6.19)
+        boot.kernelPackages = pkgs.linuxPackages_6_18;
 
         # Filesystem hardening
         boot.kernel.sysctl = {
diff --git a/named-hosts/matic/falcon-init.sh b/named-hosts/matic/falcon-init.sh
index c6337d83d..7b5102e06 100644
--- a/named-hosts/matic/falcon-init.sh
+++ b/named-hosts/matic/falcon-init.sh
@@ -10,14 +10,33 @@ fi
 
 install -d -m 0770 /opt/CrowdStrike
 
-# Update binaries from the nix store, but preserve runtime state files.
-# falconstore contains the Agent ID (AID) — if lost, the sensor re-registers
-# as a new host and consumes another license seat.
-@rsync@/bin/rsync -a --delete \
-  --exclude=falconstore \
-  --exclude=falconstore.bak \
-  --exclude=CsConfig \
-  "@falcon@/opt/CrowdStrike/" /opt/CrowdStrike/
+# CrowdStrike pushes OTA updates that write newer versioned binaries into
+# /opt/CrowdStrike/. Only rsync the packaged binaries when the installed
+# version is not newer than the package, otherwise the rsync clobbers the
+# update and the running sensor can't find its helper binaries (ENOENT).
+pkg_ver="@falcon@/opt/CrowdStrike/falconctl"
+installed_ver=/opt/CrowdStrike/falconctl
+need_sync=true
+
+if [ -x "$installed_ver" ]; then
+  pkg_build=$(readlink -f "$pkg_ver" | grep -oP '\d+$' || echo "0")
+  inst_build=$(readlink -f "$installed_ver" | grep -oP '\d+$' || echo "0")
+  if [ "$inst_build" -gt "$pkg_build" ] 2>/dev/null; then
+    echo "falcon-init: installed build $inst_build is newer than packaged $pkg_build, skipping rsync"
+    need_sync=false
+  fi
+fi
+
+if [ "$need_sync" = true ]; then
+  # Update binaries from the nix store, but preserve runtime state files.
+  # falconstore contains the Agent ID (AID) - if lost, the sensor re-registers
+  # as a new host and consumes another license seat.
+  @rsync@/bin/rsync -a --delete \
+    --exclude=falconstore \
+    --exclude=falconstore.bak \
+    --exclude=CsConfig \
+    "@falcon@/opt/CrowdStrike/" /opt/CrowdStrike/
+fi
 
 chown -R root:root /opt/CrowdStrike