diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 33e96f14867a..298f376bf42e 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -138,7 +138,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...main[Check the HEAD dif
 
 *Packetbeat*
 
-- Add automated OEM Npcap installation handling. {pull}29112[29112] {pull}30396[30396]
+- Add automated OEM Npcap installation handling. {pull}29112[29112] {pull}30438[30438]
 - Add support for capturing TLS random number and OCSP status request details. {issue}29962[29962] {pull}30102[30102]
 
 *Functionbeat*
diff --git a/packetbeat/beater/packetbeat.go b/packetbeat/beater/packetbeat.go
index d72a98d4a5f9..2bbc81cc0015 100644
--- a/packetbeat/beater/packetbeat.go
+++ b/packetbeat/beater/packetbeat.go
@@ -95,6 +95,12 @@ func New(b *beat.Beat, rawConfig *common.Config) (beat.Beater, error) {
 		return nil, err
 	}
 
+	// Install Npcap if needed.
+	err := installNpcap(b)
+	if err != nil {
+		return nil, err
+	}
+
 	return &packetbeat{
 		config:  rawConfig,
 		factory: factory,
diff --git a/packetbeat/beater/processor.go b/packetbeat/beater/processor.go
index e502b7d10786..a228c90ba097 100644
--- a/packetbeat/beater/processor.go
+++ b/packetbeat/beater/processor.go
@@ -113,12 +113,6 @@ func (p *processorFactory) Create(pipeline beat.PipelineConnector, cfg *common.C
 		return nil, err
 	}
 
-	// Install Npcap if needed.
-	err = installNpcap(p.beat)
-	if err != nil {
-		return nil, err
-	}
-
 	publisher, err := publish.NewTransactionPublisher(
 		p.beat.Info.Name,
 		p.beat.Publisher,