diff --git a/go.mod b/go.mod
index 0c802bf..b02c7b3 100644
--- a/go.mod
+++ b/go.mod
@@ -58,7 +58,7 @@
 require (
 	4d63.com/gocheckcompilerdirectives v1.2.1
 	cloud.google.com/go/storage v1.43.0
-	git.dolansoft.org/dolansoft/k8s-nft-npc v0.0.0-20250205205926-b7f770fa8391
+	git.dolansoft.org/dolansoft/k8s-nft-npc v0.0.0-20250227164540-47778d43dcec
 	github.com/adrg/xdg v0.4.0
 	github.com/bazelbuild/rules_go v0.53.0
 	github.com/cavaliergopher/cpio v1.0.1
diff --git a/go.sum b/go.sum
index 6d00367..b113d29 100644
--- a/go.sum
+++ b/go.sum
@@ -1365,8 +1365,8 @@
 dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
-git.dolansoft.org/dolansoft/k8s-nft-npc v0.0.0-20250205205926-b7f770fa8391 h1:VcDYYx80mOeRWBwBr2Hs1grbz1E1Tmf0yrJEZuF2L6U=
-git.dolansoft.org/dolansoft/k8s-nft-npc v0.0.0-20250205205926-b7f770fa8391/go.mod h1:JVUzK3P8vcS9HGrEDu4Ye+Ll4g3hxJr/DDYkpiuNZik=
+git.dolansoft.org/dolansoft/k8s-nft-npc v0.0.0-20250227164540-47778d43dcec h1:z+Ov7vv6XDd9JGgpTD4zwKNHYkFi0crSFTFNpZHM90E=
+git.dolansoft.org/dolansoft/k8s-nft-npc v0.0.0-20250227164540-47778d43dcec/go.mod h1:5eIJqMVpmmf5Ox4Hy1oZ/qqoeX8p37+ivO1TXi5//pY=
 git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20210715213245-6c3934b029d8/go.mod h1:CzsSbkDixRphAF5hS6wbMKq0eI6ccJRb7/A0M6JBnwg=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
diff --git a/metropolis/node/kubernetes/networkpolicy/networkpolicy.go b/metropolis/node/kubernetes/networkpolicy/networkpolicy.go
index 618ff03..c43ef40 100644
--- a/metropolis/node/kubernetes/networkpolicy/networkpolicy.go
+++ b/metropolis/node/kubernetes/networkpolicy/networkpolicy.go
@@ -75,7 +75,10 @@
 	eventBroadcaster.StartRecordingToSink(&typedcorev1.EventSinkImpl{Interface: c.Kubernetes.CoreV1().Events("")})
 	recorder := eventBroadcaster.NewRecorder(scheme.Scheme, v1.EventSource{Component: "npc"})
 
-	nft := nftctrl.New(recorder, node.LinkGroupK8sPod)
+	nft, err := nftctrl.New(recorder, node.LinkGroupK8sPod)
+	if err != nil {
+		return fmt.Errorf("failed to create nftables controller: %w", err)
+	}
 	defer nft.Close()
 	l := supervisor.Logger(ctx)