diff --git a/packages/mimecast/changelog.yml b/packages/mimecast/changelog.yml
index 6926e359149..f612b4ebfb8 100644
--- a/packages/mimecast/changelog.yml
+++ b/packages/mimecast/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.4.3"
+  changes:
+    - description: Fix rendering of CEL programs in configuration.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/12542
 - version: "2.4.2"
   changes:
     - description: Fix cursor time formatting and selection.
diff --git a/packages/mimecast/data_stream/audit_events/agent/stream/cel.yml.hbs b/packages/mimecast/data_stream/audit_events/agent/stream/cel.yml.hbs
index 36bcb941682..b0714aa3e0b 100644
--- a/packages/mimecast/data_stream/audit_events/agent/stream/cel.yml.hbs
+++ b/packages/mimecast/data_stream/audit_events/agent/stream/cel.yml.hbs
@@ -65,7 +65,7 @@ program: |
           state.end_field: now.format(time_layout.RFC3339),
         }]),
       }.as(req,
-        post_request(state.url.trim_right("/") + state.path, "application/json", 
+        post_request(state.url.trim_right("/") + state.path, "application/json",
           {
             "meta": {
               "pagination": {
@@ -77,7 +77,7 @@ program: |
           }.encode_json()
         ).with({
           "Header": {
-            "Authorization": ["Bearer " + token.access_token], 
+            "Authorization": ["Bearer " + token.access_token],
             "Accept": ["application/json"],
             "Content-Type": ["application/json"],
           }
diff --git a/packages/mimecast/data_stream/cloud_integrated_logs/agent/stream/cel.yml.hbs b/packages/mimecast/data_stream/cloud_integrated_logs/agent/stream/cel.yml.hbs
index 8f39fb32c8a..ca4f0b37a56 100644
--- a/packages/mimecast/data_stream/cloud_integrated_logs/agent/stream/cel.yml.hbs
+++ b/packages/mimecast/data_stream/cloud_integrated_logs/agent/stream/cel.yml.hbs
@@ -83,7 +83,7 @@ program: |
           }.format_query()
         ).with({
           "Header": {
-            "Authorization": ["Bearer " + token.access_token], 
+            "Authorization": ["Bearer " + token.access_token],
             "Accept": ["application/json"],
             "Content-Type": ["application/json"],
           }
@@ -128,7 +128,7 @@ program: |
             }.as(to_publish, to_publish.with({
               "want_more": to_publish.want_more || size(to_publish.cursor.work_list) != 0,
             }))
-          ).as(state, 
+          ).as(state,
             // Check whether we still need to get more, but have
             // no event for this type. If we do, populate events
             // with a place-holder to be discarded by the ingest
diff --git a/packages/mimecast/data_stream/siem_logs/agent/stream/cel.yml.hbs b/packages/mimecast/data_stream/siem_logs/agent/stream/cel.yml.hbs
index a47b159f0c9..8ebeefd60e1 100644
--- a/packages/mimecast/data_stream/siem_logs/agent/stream/cel.yml.hbs
+++ b/packages/mimecast/data_stream/siem_logs/agent/stream/cel.yml.hbs
@@ -83,7 +83,7 @@ program: |
           }.format_query()
         ).with({
           "Header": {
-            "Authorization": ["Bearer " + token.access_token], 
+            "Authorization": ["Bearer " + token.access_token],
             "Accept": ["application/json"],
             "Content-Type": ["application/json"],
           }
@@ -128,7 +128,7 @@ program: |
             }.as(to_publish, to_publish.with({
               "want_more": to_publish.want_more || size(to_publish.cursor.work_list) != 0,
             }))
-          ).as(state, 
+          ).as(state,
             // Check whether we still need to get more, but have
             // no event for this type. If we do, populate events
             // with a place-holder to be discarded by the ingest
diff --git a/packages/mimecast/data_stream/threat_intel_malware_customer/agent/stream/cel.yml.hbs b/packages/mimecast/data_stream/threat_intel_malware_customer/agent/stream/cel.yml.hbs
index c70302cd4d8..c0b6b572723 100644
--- a/packages/mimecast/data_stream/threat_intel_malware_customer/agent/stream/cel.yml.hbs
+++ b/packages/mimecast/data_stream/threat_intel_malware_customer/agent/stream/cel.yml.hbs
@@ -73,11 +73,11 @@ program: |
           "fileType": "stix",
         }]),
       }.as(req,
-        post_request(state.url.trim_right("/") + state.path, "application/json", 
+        post_request(state.url.trim_right("/") + state.path, "application/json",
           req.encode_json()
         ).with({
           "Header": {
-            "Authorization": ["Bearer " + token.access_token], 
+            "Authorization": ["Bearer " + token.access_token],
             "Accept": ["application/json"],
             "Content-Type": ["application/json"],
           }
diff --git a/packages/mimecast/data_stream/threat_intel_malware_grid/agent/stream/cel.yml.hbs b/packages/mimecast/data_stream/threat_intel_malware_grid/agent/stream/cel.yml.hbs
index 6bd93e55f81..7c139c92dc4 100644
--- a/packages/mimecast/data_stream/threat_intel_malware_grid/agent/stream/cel.yml.hbs
+++ b/packages/mimecast/data_stream/threat_intel_malware_grid/agent/stream/cel.yml.hbs
@@ -73,11 +73,11 @@ program: |
           "fileType": "stix",
         }]),
       }.as(req,
-        post_request(state.url.trim_right("/") + state.path, "application/json", 
+        post_request(state.url.trim_right("/") + state.path, "application/json",
           req.encode_json()
         ).with({
           "Header": {
-            "Authorization": ["Bearer " + token.access_token], 
+            "Authorization": ["Bearer " + token.access_token],
             "Accept": ["application/json"],
             "Content-Type": ["application/json"],
           }
diff --git a/packages/mimecast/manifest.yml b/packages/mimecast/manifest.yml
index 1246be551e2..fb2ec29d2c3 100644
--- a/packages/mimecast/manifest.yml
+++ b/packages/mimecast/manifest.yml
@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: mimecast
 title: "Mimecast"
-version: "2.4.2"
+version: "2.4.3"
 description: Collect logs from Mimecast with Elastic Agent.
 type: integration
 categories: ["security", "email_security"]