diff --git a/x-pack/osquerybeat/internal/osqd/args.go b/x-pack/osquerybeat/internal/osqd/args.go
index 4fdb30fef12e..c9bc77ec51fb 100644
--- a/x-pack/osquerybeat/internal/osqd/args.go
+++ b/x-pack/osquerybeat/internal/osqd/args.go
@@ -82,6 +82,14 @@ var protectedFlags = Flags{
 	"config_refresh": 10,
 }
 
+func init() {
+	// Append platform specific flags
+	plArgs := platformArgs()
+	for k, v := range plArgs {
+		protectedFlags[k] = v
+	}
+}
+
 func convertToArgs(flags Flags) Args {
 	if flags == nil {
 		return nil
diff --git a/x-pack/osquerybeat/internal/osqd/osqueryd_unix.go b/x-pack/osquerybeat/internal/osqd/osqueryd_unix.go
index 4840bad4329a..d698ce599dbb 100644
--- a/x-pack/osquerybeat/internal/osqd/osqueryd_unix.go
+++ b/x-pack/osquerybeat/internal/osqd/osqueryd_unix.go
@@ -45,7 +45,7 @@ func SocketPath(dir string) string {
 	return filepath.Join(dir, "osquery.sock")
 }
 
-func platformArgs() []string {
+func platformArgs() map[string]interface{} {
 	return nil
 }
 
diff --git a/x-pack/osquerybeat/internal/osqd/osqueryd_windows.go b/x-pack/osquerybeat/internal/osqd/osqueryd_windows.go
index 5be16ba86690..720a94a6ad76 100644
--- a/x-pack/osquerybeat/internal/osqd/osqueryd_windows.go
+++ b/x-pack/osquerybeat/internal/osqd/osqueryd_windows.go
@@ -28,9 +28,9 @@ func SocketPath(dir string) string {
 	return `\\.\pipe\elastic\osquery\` + uuid.Must(uuid.NewV4()).String()
 }
 
-func platformArgs() []string {
-	return []string{
-		"--allow_unsafe",
+func platformArgs() map[string]interface{} {
+	return map[string]interface{}{
+		"allow_unsafe": true,
 	}
 }