diff --git a/internal/rosa/netfilter.go b/internal/rosa/netfilter.go
index 04785e94..bbbc460e 100644
--- a/internal/rosa/netfilter.go
+++ b/internal/rosa/netfilter.go
@@ -96,15 +96,13 @@ func init() {
 func (t Toolchain) newIPTables() (pkg.Artifact, string) {
 	const (
 		version  = "1.8.13"
-		checksum = "JsNI7dyZHnHLtDkKWAxzAIMZ5t-ff3LkSPqNJsn5VM5Eq2m1bA5NKI-XfMRpQsg6"
+		checksum = "TUA-cFIAsiMvtRR-XzQvXzoIhJUOc9J2gQDJCbBRjmgmVfGfPTCf58wL7e-cUKVQ"
 	)
-	return t.NewPackage("iptables", version, pkg.NewHTTPGet(
-		nil, "https://www.netfilter.org/projects/iptables/files/"+
-			"iptables-"+version+".tar.xz",
+	return t.NewPackage("iptables", version, t.NewViaGit(
+		"https://git.netfilter.org/iptables",
+		"refs/tags/v"+version,
 		mustDecode(checksum),
 	), &PackageAttr{
-		SourceKind: SourceKindTarXZ,
-
 		ScriptEarly: `
 rm \
 	extensions/libxt_connlabel.txlate \
@@ -115,6 +113,7 @@ sed -i \
 	extensions/libebt_snat.txlate
 `,
 	}, &MakeHelper{
+		Generate: "./autogen.sh",
 		Configure: []KV{
 			{"enable-static"},
 		},
@@ -123,7 +122,8 @@ ln -s ../system/bin/bash /bin/
 chmod +w /etc/ && ln -s ../usr/src/iptables/etc/ethertypes /etc/
 		`,
 	},
-		XZ,
+		Automake,
+		Libtool,
 		PkgConfig,
 		Bash,
 		Python,