diff --git a/devenv.nix b/devenv.nix
index fbb9207..df88a7f 100644
--- a/devenv.nix
+++ b/devenv.nix
@@ -39,6 +39,13 @@
     protoc-gen-tonic
     protoc-gen-prost
 
+    # torad VPN mode (--wireguard-config): pasta creates the unprivileged
+    # namespace, wireguard-go is the userspace datapath, `ip` configures the
+    # tunnel. See tora/devenv.nix for why wireguard-tools is not needed.
+    passt
+    wireguard-go
+    iproute2
+
     opencode
   ];
 
diff --git a/tora b/tora
index e321300..b489ff7 160000
--- a/tora
+++ b/tora
@@ -1 +1 @@
-Subproject commit e321300f677d0b493d9d745127b762e5b01efe61
+Subproject commit b489ff71355501b55f871f5a116f28018802563b