diff --git a/Dockerfiles/arkime.Dockerfile b/Dockerfiles/arkime.Dockerfile
index 4b246041f..a6e573a78 100644
--- a/Dockerfiles/arkime.Dockerfile
+++ b/Dockerfiles/arkime.Dockerfile
@@ -148,7 +148,7 @@ RUN export DEBARCH=$(dpkg --print-architecture) && \
     mkdir -p "${ARKIME_DIR}"/plugins && \
       curl -fsSL -o "${ARKIME_DIR}/plugins/ja4plus.${DEBARCH}.so" "$(echo "${ARKIME_JA4_SO_URL}" | sed "s/XXX/${DEBARCH}/g")" && \
       chmod 755 "${ARKIME_DIR}/plugins/ja4plus.${DEBARCH}.so" && \
-    python3 -m pip install --break-system-packages --no-compile --no-cache-dir beautifulsoup4 pyzmq watchdog==5.0.0 && \
+    python3 -m pip install --break-system-packages --no-compile --no-cache-dir beautifulsoup4 pyzmq watchdog==4.0.2 && \
     ln -sfr $ARKIME_DIR/bin/npm /usr/local/bin/npm && \
       ln -sfr $ARKIME_DIR/bin/node /usr/local/bin/node && \
       ln -sfr $ARKIME_DIR/bin/npx /usr/local/bin/npx && \
diff --git a/Dockerfiles/file-monitor.Dockerfile b/Dockerfiles/file-monitor.Dockerfile
index bfbee2de5..caa686704 100644
--- a/Dockerfiles/file-monitor.Dockerfile
+++ b/Dockerfiles/file-monitor.Dockerfile
@@ -159,7 +159,7 @@ RUN export BINARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
       python-magic \
       stream-zip \
       supervisor \
-      watchdog==5.0.0 \
+      watchdog==4.0.2 \
       yara-python && \
     curl -fsSL -o /usr/local/bin/supercronic "${SUPERCRONIC_URL}${BINARCH}" && \
       chmod +x /usr/local/bin/supercronic && \
diff --git a/Dockerfiles/filebeat.Dockerfile b/Dockerfiles/filebeat.Dockerfile
index 021077425..25272e5a3 100644
--- a/Dockerfiles/filebeat.Dockerfile
+++ b/Dockerfiles/filebeat.Dockerfile
@@ -101,7 +101,7 @@ RUN export EVTXARCH=$(uname -m | sed 's/arm64/aarch64/') && \
         unar \
         unzip \
         xz-utils && \
-    python3 -m pip install --no-compile --no-cache-dir patool entrypoint2 pyunpack python-magic ordered-set supervisor watchdog==5.0.0 && \
+    python3 -m pip install --no-compile --no-cache-dir patool entrypoint2 pyunpack python-magic ordered-set supervisor watchdog==4.0.2 && \
     curl -fsSL -o /usr/local/bin/supercronic "${SUPERCRONIC_URL}${BINARCH}" && \
       chmod +x /usr/local/bin/supercronic && \
     curl -fsSL -o /usr/local/bin/yq "${YQ_URL}${BINARCH}" && \
diff --git a/Dockerfiles/pcap-monitor.Dockerfile b/Dockerfiles/pcap-monitor.Dockerfile
index c5187fcab..b710fcb23 100644
--- a/Dockerfiles/pcap-monitor.Dockerfile
+++ b/Dockerfiles/pcap-monitor.Dockerfile
@@ -68,7 +68,7 @@ RUN apt-get -q update && \
       python-magic \
       pyzmq \
       requests \
-      watchdog==5.0.0 && \
+      watchdog==4.0.2 && \
     groupadd --gid ${DEFAULT_GID} ${PGROUP} && \
       useradd -M --uid ${DEFAULT_UID} --gid ${DEFAULT_GID} ${PUSER}
 
diff --git a/Dockerfiles/suricata.Dockerfile b/Dockerfiles/suricata.Dockerfile
index 9ccc973a2..d2872cac8 100644
--- a/Dockerfiles/suricata.Dockerfile
+++ b/Dockerfiles/suricata.Dockerfile
@@ -108,7 +108,7 @@ RUN export BINARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
     apt-get install -q -y --no-install-recommends -t bookworm-backports \
         suricata=${SURICATA_VERSION_PATTERN} \
         suricata-update && \
-    python3 -m pip install --break-system-packages --no-compile --no-cache-dir watchdog==5.0.0 && \
+    python3 -m pip install --break-system-packages --no-compile --no-cache-dir watchdog==4.0.2 && \
     curl -fsSL -o /usr/local/bin/supercronic "${SUPERCRONIC_URL}${BINARCH}" && \
       chmod +x /usr/local/bin/supercronic && \
     curl -fsSL -o /usr/bin/yq "${YQ_URL}${BINARCH}" && \
diff --git a/hedgehog-iso/config/hooks/normal/0169-pip-installs.hook.chroot b/hedgehog-iso/config/hooks/normal/0169-pip-installs.hook.chroot
index 16aba39e8..0667b4b72 100755
--- a/hedgehog-iso/config/hooks/normal/0169-pip-installs.hook.chroot
+++ b/hedgehog-iso/config/hooks/normal/0169-pip-installs.hook.chroot
@@ -20,4 +20,4 @@ pip3 install --break-system-packages --no-compile --no-cache-dir --force-reinsta
   stix2 \
   stream-zip \
   taxii2-client \
-  watchdog==5.0.0
+  watchdog==4.0.2
diff --git a/shared/bin/pcap_watcher.py b/shared/bin/pcap_watcher.py
index 428723f95..25816e13d 100755
--- a/shared/bin/pcap_watcher.py
+++ b/shared/bin/pcap_watcher.py
@@ -46,7 +46,7 @@
 
 from watchdog.observers import Observer
 from watchdog.observers.polling import PollingObserver
-from watchdog.utils import WatchdogShutdownError
+from watchdog.utils import WatchdogShutdown
 
 ###################################################################################################
 MINIMUM_CHECKED_FILE_SIZE_DEFAULT = 24
@@ -564,9 +564,9 @@ def main():
         logging.info(f"{scriptName}:\tshutting down...")
 
         if shuttingDown[0]:
-            raise WatchdogShutdownError()
+            raise WatchdogShutdown()
 
-    except WatchdogShutdownError:
+    except WatchdogShutdown:
         observer.unschedule_all()
 
     finally:
diff --git a/shared/bin/watch_common.py b/shared/bin/watch_common.py
index e448ee8f2..9457a1604 100644
--- a/shared/bin/watch_common.py
+++ b/shared/bin/watch_common.py
@@ -20,7 +20,7 @@
 
 from multiprocessing.pool import ThreadPool
 from threading import get_native_id
-from watchdog.utils import WatchdogShutdownError
+from watchdog.utils import WatchdogShutdown
 from watchdog.observers import Observer
 from watchdog.observers.polling import PollingObserver
 from collections import namedtuple, defaultdict, OrderedDict
@@ -327,9 +327,9 @@ def WatchAndProcessDirectory(
             observer.join(1)
 
         if shuttingDown[0]:
-            raise WatchdogShutdownError()
+            raise WatchdogShutdown()
 
-    except WatchdogShutdownError:
+    except WatchdogShutdown:
         observer.unschedule_all()
 
     finally:
diff --git a/shared/bin/zeek_carve_watcher.py b/shared/bin/zeek_carve_watcher.py
index e457edd19..960464905 100755
--- a/shared/bin/zeek_carve_watcher.py
+++ b/shared/bin/zeek_carve_watcher.py
@@ -24,7 +24,7 @@
 from multiprocessing.pool import ThreadPool
 from watchdog.observers import Observer
 from watchdog.observers.polling import PollingObserver
-from watchdog.utils import WatchdogShutdownError
+from watchdog.utils import WatchdogShutdown
 
 from zeek_carve_utils import (
     CAPA_VIV_MIME,
@@ -320,9 +320,9 @@ def main():
         logging.info(f"{scriptName}:\tshutting down...")
 
         if shuttingDown[0]:
-            raise WatchdogShutdownError()
+            raise WatchdogShutdown()
 
-    except WatchdogShutdownError:
+    except WatchdogShutdown:
         observer.unschedule_all()
 
     finally: