diff --git a/x-pack/elastic-agent/CHANGELOG.asciidoc b/x-pack/elastic-agent/CHANGELOG.asciidoc
index b8d43f26744..edc4a44af29 100644
--- a/x-pack/elastic-agent/CHANGELOG.asciidoc
+++ b/x-pack/elastic-agent/CHANGELOG.asciidoc
@@ -34,6 +34,7 @@
 - Fixed make status readable in the log. {pull}23849[23849]
 - Fixed Monitoring filebeat and metricbeat not connecting to Agent over GRPC {pull}23843[23843]
 - Windows agent doesn't uninstall with a lowercase `c:` drive in the path {pull}23998[23998]
+- Fix reloading of log level for services {pull}[24055]24055
 
 ==== New features
 
diff --git a/x-pack/elastic-agent/pkg/agent/program/testdata/endpoint_basic-endpoint-security.yml b/x-pack/elastic-agent/pkg/agent/program/testdata/endpoint_basic-endpoint-security.yml
index b77a83633ae..d81d276f368 100644
--- a/x-pack/elastic-agent/pkg/agent/program/testdata/endpoint_basic-endpoint-security.yml
+++ b/x-pack/elastic-agent/pkg/agent/program/testdata/endpoint_basic-endpoint-security.yml
@@ -2,6 +2,7 @@ revision: 5
 fleet:
   agent:
     id: fleet-agent-id
+    logging.level: error
   host:
     id: host-agent-id
   api:
diff --git a/x-pack/elastic-agent/pkg/agent/program/testdata/endpoint_basic.yml b/x-pack/elastic-agent/pkg/agent/program/testdata/endpoint_basic.yml
index 728b4813a4e..1681926c56e 100644
--- a/x-pack/elastic-agent/pkg/agent/program/testdata/endpoint_basic.yml
+++ b/x-pack/elastic-agent/pkg/agent/program/testdata/endpoint_basic.yml
@@ -3,6 +3,7 @@ name: Endpoint Host
 fleet:
   agent:
     id: fleet-agent-id
+    logging.level: error
   host:
     id: host-agent-id
   access_api_key: VuaCfGcBCdbkQm-e5aOx:ui2lp2axTNmsyakw9tvNnw
diff --git a/x-pack/elastic-agent/pkg/config/config.go b/x-pack/elastic-agent/pkg/config/config.go
index 593631f0050..2de84972a6b 100644
--- a/x-pack/elastic-agent/pkg/config/config.go
+++ b/x-pack/elastic-agent/pkg/config/config.go
@@ -116,6 +116,12 @@ func NewConfigFrom(from interface{}, opts ...interface{}) (*Config, error) {
 	}
 	if len(skippedKeys) > 0 {
 		err = cfg.Merge(skippedKeys, ucfg.ResolveNOOP)
+
+		// we modified incoming object
+		// cleanup so skipped keys are not missing
+		for k, v := range skippedKeys {
+			data[k] = v
+		}
 	}
 	return newConfigFrom(cfg), err
 }
diff --git a/x-pack/elastic-agent/pkg/core/server/server.go b/x-pack/elastic-agent/pkg/core/server/server.go
index f0b8ac73d8a..97517eb6ce6 100644
--- a/x-pack/elastic-agent/pkg/core/server/server.go
+++ b/x-pack/elastic-agent/pkg/core/server/server.go
@@ -249,9 +249,13 @@ func (s *Server) Checkin(server proto.ElasticAgent_CheckinServer) error {
 	}()
 
 	var ok bool
+	var observedConfigStateIdx uint64
 	var firstCheckin *proto.StateObserved
 	select {
 	case firstCheckin, ok = <-firstCheckinChan:
+		if firstCheckin != nil {
+			observedConfigStateIdx = firstCheckin.ConfigStateIdx
+		}
 		break
 	case <-time.After(InitialCheckinTimeout):
 		// close connection
@@ -281,6 +285,13 @@ func (s *Server) Checkin(server proto.ElasticAgent_CheckinServer) error {
 		s.logger.Debug("check-in stream cannot connect, application is being destroyed; closing connection")
 		return status.Error(codes.Unavailable, "application cannot connect being destroyed")
 	}
+
+	// application is running as a service and counter is already counting
+	// force config reload
+	if observedConfigStateIdx > 0 {
+		appState.expectedConfigIdx = observedConfigStateIdx + 1
+	}
+
 	checkinDone := make(chan bool)
 	appState.checkinDone = checkinDone
 	appState.checkinLock.Unlock()