diff --git a/main/postmarketos-base/APKBUILD b/main/postmarketos-base/APKBUILD
index 7247cd3a2..bd46b1877 100644
--- a/main/postmarketos-base/APKBUILD
+++ b/main/postmarketos-base/APKBUILD
@@ -1,6 +1,6 @@
 pkgname=postmarketos-base
 pkgver=11
-pkgrel=1
+pkgrel=2
 pkgdesc="Meta package for minimal postmarketOS base"
 url="https://postmarketos.org"
 arch="noarch"
@@ -13,6 +13,7 @@ depends="
 	dnsmasq
 	eudev
 	haveged
+	nftables
 	openssh
 	postmarketos-mkinitfs
 	postmarketos-mvcfg
@@ -29,6 +30,7 @@ subpackages="
 	$pkgname-tinydm
 	$pkgname-x11
 	$pkgname-pulseaudio
+	$pkgname-nftables
 	"
 options="!check"
 replaces="
@@ -136,6 +138,12 @@ pulseaudio() {
 	amove etc/pulse/daemon.conf.d/90-postmarketos.conf
 }
 
+nftables() {
+	install_if="$pkgname=$pkgver-r$pkgrel nftables"
+	depends="postmarketos-config-nftables"
+	mkdir "$subpkgdir"
+}
+
 sha512sums="
 e529f5cef1f31481b577f99b8917704f2cfefb963d98bf40a14b017938e55a00134d2033f81d2cb0b8489c5e9b4a92fdc0a788013f1adb4cd46d9580c9988186  rootfs-etc-sudoers
 e5d049db1d82c510bab9246208b51b8ec2711d008d67792fc10d4c0b65ed4dece7b5ae3c3dd28a8539d177b6849c1f921cb9fef3d2c7bee0355451f7b4757ec6  rootfs-etc-chrony-chrony.conf
diff --git a/main/postmarketos-base/postmarketos-base.post-install b/main/postmarketos-base/postmarketos-base.post-install
index 45db45081..5f14c188b 100644
--- a/main/postmarketos-base/postmarketos-base.post-install
+++ b/main/postmarketos-base/postmarketos-base.post-install
@@ -11,7 +11,7 @@ done
 for service in hwclock modules sysctl hostname bootmisc syslog; do
 	rc-update -q add $service boot
 done
-for service in dbus haveged sshd swapfile wpa_supplicant chronyd local rfkill; do
+for service in dbus haveged sshd swapfile wpa_supplicant chronyd local rfkill nftables; do
 	rc-update -q add $service default
 done
 for service in mount-ro killprocs savecache; do