diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc
index 68b377a5a01..3bd300bdc32 100644
--- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc
+++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc
@@ -93,6 +93,7 @@
 - Allow HTTP metrics to run in bootstrap mode. Add ability to adjust timeouts for Fleet Server. {pull}28260[28260]
 - Increase the download artifact timeout to 10mins and add log download statistics. {pull}31461[31461]
 - Add filemod times to files in diagnostics collect bundle. {pull}31986[31986]
+- Allow ':' characters in dynamic variables. {pull}32407[32407]
 - Allow the - char to appear as part of variable names in eql expressions. {pull}32350[32350]
 
 ==== New features
diff --git a/x-pack/elastic-agent/pkg/agent/transpiler/vars.go b/x-pack/elastic-agent/pkg/agent/transpiler/vars.go
index e1818cdd160..72fdc77adfb 100644
--- a/x-pack/elastic-agent/pkg/agent/transpiler/vars.go
+++ b/x-pack/elastic-agent/pkg/agent/transpiler/vars.go
@@ -15,7 +15,7 @@ import (
 	"github.com/elastic/beats/v7/libbeat/common"
 )
 
-var varsRegex = regexp.MustCompile(`\${([\p{L}\d\s\\\-_|.'"]*)}`)
+var varsRegex = regexp.MustCompile(`\${([\p{L}\d\s\\\-_|.'":]*)}`)
 
 // ErrNoMatch is return when the replace didn't fail, just that no vars match to perform the replace.
 var ErrNoMatch = fmt.Errorf("no matching vars")
diff --git a/x-pack/elastic-agent/pkg/agent/transpiler/vars_test.go b/x-pack/elastic-agent/pkg/agent/transpiler/vars_test.go
index 452239f7958..d5bedb022a7 100644
--- a/x-pack/elastic-agent/pkg/agent/transpiler/vars_test.go
+++ b/x-pack/elastic-agent/pkg/agent/transpiler/vars_test.go
@@ -87,12 +87,24 @@ func TestVars_Replace(t *testing.T) {
 			false,
 			false,
 		},
+		{
+			`${"with:colon"}`,
+			NewStrVal("with:colon"),
+			false,
+			false,
+		},
 		{
 			`${un-der_score.}`,
 			NewStrVal(""),
 			true,
 			false,
 		},
+		{
+			`${un-der_score.missing|'with:colon'}`,
+			NewStrVal("with:colon"),
+			false,
+			false,
+		},
 		{
 			`${un-der_score.missing|"oth}`,
 			NewStrVal(""),