diff --git a/x-pack/elastic-agent/CHANGELOG.asciidoc b/x-pack/elastic-agent/CHANGELOG.asciidoc
index 619850f4bc8..6a216900089 100644
--- a/x-pack/elastic-agent/CHANGELOG.asciidoc
+++ b/x-pack/elastic-agent/CHANGELOG.asciidoc
@@ -30,6 +30,7 @@
 - Fix incorrect hash when upgrading agent {pull}22322[22322]
 - Fix refresh of monitoring configuration {pull}23619[23619]
 - Fixed nil pointer during unenroll {pull}23609[23609]
+- Fixed reenroll scenario {pull}23686[23686]
 
 ==== New features
 
diff --git a/x-pack/elastic-agent/pkg/agent/application/enroll_cmd.go b/x-pack/elastic-agent/pkg/agent/application/enroll_cmd.go
index 7d905b80f8c..fe4cafa7594 100644
--- a/x-pack/elastic-agent/pkg/agent/application/enroll_cmd.go
+++ b/x-pack/elastic-agent/pkg/agent/application/enroll_cmd.go
@@ -209,6 +209,12 @@ func (c *EnrollCmd) Execute() error {
 		return err
 	}
 
+	// clear action store
+	// fail only if file exists and there was a failure
+	if err := os.Remove(info.AgentStateStoreFile()); !os.IsNotExist(err) {
+		return err
+	}
+
 	return nil
 }
 
diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go
index 3734e0ea3e0..9b7a271a9d7 100644
--- a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go
+++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go
@@ -247,19 +247,25 @@ func rollbackInstall(ctx context.Context, hash string) {
 }
 
 func copyActionStore(newHash string) error {
-	currentActionStorePath := info.AgentActionStoreFile()
+	storePaths := []string{info.AgentActionStoreFile(), info.AgentStateStoreFile()}
 
-	newHome := filepath.Join(filepath.Dir(paths.Home()), fmt.Sprintf("%s-%s", agentName, newHash))
-	newActionStorePath := filepath.Join(newHome, filepath.Base(currentActionStorePath))
+	for _, currentActionStorePath := range storePaths {
+		newHome := filepath.Join(filepath.Dir(paths.Home()), fmt.Sprintf("%s-%s", agentName, newHash))
+		newActionStorePath := filepath.Join(newHome, filepath.Base(currentActionStorePath))
 
-	currentActionStore, err := ioutil.ReadFile(currentActionStorePath)
-	if os.IsNotExist(err) {
-		// nothing to copy
-		return nil
-	}
-	if err != nil {
-		return err
+		currentActionStore, err := ioutil.ReadFile(currentActionStorePath)
+		if os.IsNotExist(err) {
+			// nothing to copy
+			continue
+		}
+		if err != nil {
+			return err
+		}
+
+		if err := ioutil.WriteFile(newActionStorePath, currentActionStore, 0600); err != nil {
+			return err
+		}
 	}
 
-	return ioutil.WriteFile(newActionStorePath, currentActionStore, 0600)
+	return nil
 }
diff --git a/x-pack/packetbeat/packetbeat.reference.yml b/x-pack/packetbeat/packetbeat.reference.yml
index b65ba79e677..43790cca594 100644
--- a/x-pack/packetbeat/packetbeat.reference.yml
+++ b/x-pack/packetbeat/packetbeat.reference.yml
@@ -80,7 +80,7 @@ packetbeat.flows:
 
 packetbeat.protocols:
 - type: icmp
-  # Enable ICMPv4 and ICMPv6 monitoring. Default: true
+  # Enable ICMPv4 and ICMPv6 monitoring. The default is true.
   #enabled: true
 
   # Set to true to publish fields with null values in events.
diff --git a/x-pack/packetbeat/packetbeat.yml b/x-pack/packetbeat/packetbeat.yml
index 2ac9186d43e..15a0df9ebd1 100644
--- a/x-pack/packetbeat/packetbeat.yml
+++ b/x-pack/packetbeat/packetbeat.yml
@@ -38,7 +38,7 @@ packetbeat.flows:
 
 packetbeat.protocols:
 - type: icmp
-  # Enable ICMPv4 and ICMPv6 monitoring. Default: false
+  # Enable ICMPv4 and ICMPv6 monitoring. The default is true.
   enabled: true
 
 - type: amqp
@@ -47,7 +47,8 @@ packetbeat.protocols:
   ports: [5672]
 
 - type: cassandra
-  #Cassandra port for traffic monitoring.
+  # Configure the ports where to listen for Cassandra traffic. You can disable
+  # the Cassandra protocol by commenting out the list of ports.
   ports: [9042]
 
 - type: dhcpv4
@@ -112,7 +113,8 @@ packetbeat.protocols:
     - 9243  # Elasticsearch
 
 - type: sip
-  # Configure the ports where to listen for SIP traffic. You can disable the SIP protocol by commenting out the list of ports.
+  # Configure the ports where to listen for SIP traffic. You can disable
+  # the SIP protocol by commenting out the list of ports.
   ports: [5060]
 
 # ======================= Elasticsearch template setting =======================