diff --git a/Dockerfile b/Dockerfile
index cf6a662..62637b6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,7 @@ RUN sudo ln -sf /usr/bin/opam-2.1 /usr/bin/opam
 # Pin last known-good version for reproducible builds.
 # Remove this line (and the base image pin above) if you want to test with the
 # latest versions.
-RUN cd /home/opam/opam-repository && git fetch origin master && git reset --hard 632ef7fd6add02a7789f896751c51b408dca0373 && opam update
+RUN cd /home/opam/opam-repository && git fetch origin master && git reset --hard 0f451c34c56458ee18495a98eb35d7dcb14f519a && opam update
 
 RUN opam install -y mirage opam-monorepo
 RUN mkdir /home/opam/qubes-mirage-firewall
diff --git a/config.ml b/config.ml
index d33bf23..8f187ae 100644
--- a/config.ml
+++ b/config.ml
@@ -28,7 +28,7 @@ let main =
       package "mirage-net-xen";
       package "ipaddr" ~min:"5.2.0";
       package "mirage-qubes" ~min:"0.9.1";
-      package "mirage-nat" ~min:"2.2.1";
+      package "mirage-nat" ~min:"3.0.0";
       package "mirage-logs";
       package "mirage-xen" ~min:"8.0.0";
       package ~min:"6.1.0" "dns-client";