diff --git a/packages/crowdstrike/changelog.yml b/packages/crowdstrike/changelog.yml
index fc14c2ea1ef..e6fa3c105c7 100644
--- a/packages/crowdstrike/changelog.yml
+++ b/packages/crowdstrike/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "4.5.1"
+  changes:
+    - description: Use inclusive >= cursor boundary in host CEL program to avoid permanently skipping same-timestamp records at page or error boundaries.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20524
 - version: "4.5.0"
   changes:
     - description: Map CommandHistory events to ECS process fields.
diff --git a/packages/crowdstrike/data_stream/host/_dev/test/policy/test-default.expected b/packages/crowdstrike/data_stream/host/_dev/test/policy/test-default.expected
index a41426ca6dc..b453936356a 100644
--- a/packages/crowdstrike/data_stream/host/_dev/test/policy/test-default.expected
+++ b/packages/crowdstrike/data_stream/host/_dev/test/policy/test-default.expected
@@ -45,7 +45,10 @@ inputs:
                           optional.of(
                             [
                               [
-                                ?filter.optMap(f, "modified_timestamp:>\"" + f + "\""),
+                                // Inclusive lower bound: records sharing the boundary timestamp can span a page
+                                // or error boundary, so ">=" avoids permanently skipping same-timestamp records.
+                                // Re-fetched records are de-duplicated downstream by the fingerprint _id
+                                ?filter.optMap(f, "modified_timestamp:>=\"" + f + "\""),
                                 ?state.?query.optMap(q, "(" + q + ")"),
                               ].join("+"),
                             ]
@@ -81,6 +84,7 @@ inputs:
                             ),
                           },
                         },
+                        "offset": 0,
                         "want_more": false,
                         "next": {},
                       }
@@ -128,6 +132,7 @@ inputs:
                                 ),
                               },
                             },
+                            "offset": 0,
                             "want_more": false,
                             "next": {},
                           }
@@ -154,7 +159,10 @@ inputs:
                         "sort": ["modified_timestamp|asc"],
                         "filter": [
                           [
-                            "modified_timestamp:>'" + start_time + "'",
+                            // Inclusive lower bound: records sharing the boundary timestamp can span a page
+                            // or error boundary, so ">=" avoids permanently skipping same-timestamp records.
+                            // Re-fetched records are de-duplicated downstream by the fingerprint _id
+                            "modified_timestamp:>='" + start_time + "'",
                             ?state.?query.optMap(q, "(" + q + ")"),
                           ].join("+"),
                         ],
diff --git a/packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs b/packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs
index a7d3ee90272..58659496cc1 100644
--- a/packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs
+++ b/packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs
@@ -64,7 +64,10 @@ program: |-
                 optional.of(
                   [
                     [
-                      ?filter.optMap(f, "modified_timestamp:>\"" + f + "\""),
+                      // Inclusive lower bound: records sharing the boundary timestamp can span a page
+                      // or error boundary, so ">=" avoids permanently skipping same-timestamp records.
+                      // Re-fetched records are de-duplicated downstream by the fingerprint _id
+                      ?filter.optMap(f, "modified_timestamp:>=\"" + f + "\""),
                       ?state.?query.optMap(q, "(" + q + ")"),
                     ].join("+"),
                   ]
@@ -100,6 +103,7 @@ program: |-
                   ),
                 },
               },
+              "offset": 0,
               "want_more": false,
               "next": {},
             }
@@ -147,6 +151,7 @@ program: |-
                       ),
                     },
                   },
+                  "offset": 0,
                   "want_more": false,
                   "next": {},
                 }
@@ -173,7 +178,10 @@ program: |-
               "sort": ["modified_timestamp|asc"],
               "filter": [
                 [
-                  "modified_timestamp:>'" + start_time + "'",
+                  // Inclusive lower bound: records sharing the boundary timestamp can span a page
+                  // or error boundary, so ">=" avoids permanently skipping same-timestamp records.
+                  // Re-fetched records are de-duplicated downstream by the fingerprint _id
+                  "modified_timestamp:>='" + start_time + "'",
                   ?state.?query.optMap(q, "(" + q + ")"),
                 ].join("+"),
               ],
diff --git a/packages/crowdstrike/manifest.yml b/packages/crowdstrike/manifest.yml
index 11adba50b19..df73f1f36d7 100644
--- a/packages/crowdstrike/manifest.yml
+++ b/packages/crowdstrike/manifest.yml
@@ -1,6 +1,6 @@
 name: crowdstrike
 title: CrowdStrike
-version: "4.5.0"
+version: "4.5.1"
 description: Collect logs from Crowdstrike with Elastic Agent.
 type: integration
 format_version: "3.4.0"