diff --git a/wgbridge-rs/Cargo.lock b/wgbridge-rs/Cargo.lock
index 10d948eb5..90fe10b31 100644
--- a/wgbridge-rs/Cargo.lock
+++ b/wgbridge-rs/Cargo.lock
@@ -399,9 +399,9 @@ dependencies = [
 
 [[package]]
 name = "gotatun"
-version = "0.7.2"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09e8590454839d406160792e2c5617e463a0d223f7370687528d0dd6560140b9"
+checksum = "87942cf21be131088380c8b3cb3dc9a8528a7f840a8230bed0e79b2e202d0629"
 dependencies = [
  "aead",
  "base64",
@@ -420,7 +420,6 @@ dependencies = [
  "ip_network_table",
  "ipnetwork",
  "libc",
- "log",
  "nix",
  "parking_lot",
  "rand",
@@ -431,6 +430,7 @@ dependencies = [
  "thiserror 1.0.69",
  "tokio",
  "tokio-util",
+ "tracing",
  "typed-builder",
  "windows-sys 0.61.2",
  "x25519-dalek",
@@ -985,6 +985,37 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
 [[package]]
 name = "typed-builder"
 version = "0.21.2"
diff --git a/wgbridge-rs/Cargo.toml b/wgbridge-rs/Cargo.toml
index 0ea749a98..1cbe271bf 100644
--- a/wgbridge-rs/Cargo.toml
+++ b/wgbridge-rs/Cargo.toml
@@ -9,7 +9,7 @@ publish = false
 crate-type = ["cdylib", "lib"]
 
 [dependencies]
-gotatun = { version = "=0.7.2", default-features = false, features = ["ring", "device"] }
+gotatun = { version = "=0.8.1", default-features = false, features = ["ring", "device"] }
 tokio = { version = "1.43", features = ["rt-multi-thread", "net", "sync", "time", "macros"] }
 base64 = "0.22"
 hex = "0.4"
diff --git a/wgbridge-rs/src/transport/udp.rs b/wgbridge-rs/src/transport/udp.rs
index e51115cd2..b2cdbf00e 100644
--- a/wgbridge-rs/src/transport/udp.rs
+++ b/wgbridge-rs/src/transport/udp.rs
@@ -4,7 +4,7 @@
 //! doubles as "rebind the UDP sockets on the new default network".
 
 use std::io;
-use std::os::fd::{AsFd, AsRawFd};
+use std::os::fd::AsRawFd;
 use std::sync::Arc;
 
 use gotatun::udp::socket::{UdpSocket, UdpSocketFactory};
@@ -26,7 +26,9 @@ impl ProtectedUdpFactory {
     }
 
     fn protect(&self, socket: &UdpSocket) -> io::Result<()> {
-        let fd = socket.as_fd().as_raw_fd();
+        // gotatun 0.8.x hides the inner socket behind an enum; socket() exposes
+        // the underlying tokio UdpSocket (0.8.1+) so we can protect its fd.
+        let fd = socket.socket()?.as_raw_fd();
         if !self.protector.protect(fd) {
             // Fail closed: an unprotected socket would loop through the TUN.
             return Err(io::Error::other(format!(