diff --git a/manifests/params.pp b/manifests/params.pp
index bb31d2aa..fa5c67ce 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -257,7 +257,14 @@
   $forwarder_pkg_src = "${src_root}/products/universalforwarder/releases/${version}/${forwarder_src_subdir}/${forwarder_src_pkg}"
   $create_password   = true
 
-  $forwarder_pkg_ensure = 'installed'
+  case $::osfamily {
+    'RedHat': {
+      $forwarder_pkg_ensure = $version
+    }
+    default: {
+      $forwarder_pkg_ensure = 'installed'
+    }
+  }
 
   # A meta resource so providers know where splunk is installed:
   splunk_config { 'splunk':