diff --git a/detection_rules/rule_formatter.py b/detection_rules/rule_formatter.py
index 46469f24d..cea3d8b0a 100644
--- a/detection_rules/rule_formatter.py
+++ b/detection_rules/rule_formatter.py
@@ -24,6 +24,12 @@ DQ = '"'
 TRIPLE_SQ = SQ * 3
 TRIPLE_DQ = DQ * 3
 
+# Fields from nested objects (not BaseRuleData fields) that need to be perserved.
+# NOTE: we treat these as globally unique which might not be true in all cases
+# Excluded fields:
+# - actions[].params.message
+NESTED_PRESERVED_FIELD_NAMES: set[str] = {"message"}
+
 
 @cached
 def get_preserved_fmt_fields() -> set[str]:
@@ -34,6 +40,9 @@ def get_preserved_fmt_fields() -> set[str]:
     for field in dataclasses.fields(BaseRuleData):
         if field.type in (definitions.Markdown, definitions.Markdown | None):
             preserved_keys.add(field.metadata.get("data_key", field.name))
+
+    preserved_keys.update(NESTED_PRESERVED_FIELD_NAMES)
+
     return preserved_keys
 
 
diff --git a/pyproject.toml b/pyproject.toml
index a28439ef4..0832c3dd3 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "detection_rules"
-version = "1.5.30"
+version = "1.5.31"
 description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
 readme = "README.md"
 requires-python = ">=3.12"