diff --git a/client/internal/pqkem_transport.go b/client/internal/pqkem_transport.go
index 5dfd088bd..825aeb096 100644
--- a/client/internal/pqkem_transport.go
+++ b/client/internal/pqkem_transport.go
@@ -7,7 +7,8 @@ import (
 	"sync"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // DefaultPort is the preferred UDP port for the ML-KEM data-path service, bound on
@@ -34,7 +35,7 @@ type pqTransport struct {
 // clients): the overlay IP then exists only inside that userspace stack, so the socket
 // is opened there and its datagrams ride the tunnel like any other overlay traffic. A
 // nil ns binds on the host.
-func newPQTransport(overlayIP netip.Addr, ns *netstack.Net) (*pqTransport, error) {
+func newPQTransport(overlayIP netip.Addr, ns *wgbackend.NetstackNet) (*pqTransport, error) {
 	if !overlayIP.IsValid() {
 		return nil, fmt.Errorf("invalid overlay IP for pqkem transport")
 	}
diff --git a/client/internal/pqkem_transport_test.go b/client/internal/pqkem_transport_test.go
index ffaec7014..0a963f6d6 100644
--- a/client/internal/pqkem_transport_test.go
+++ b/client/internal/pqkem_transport_test.go
@@ -7,7 +7,8 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/tun/netstack"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type pqInbound struct {
@@ -68,7 +69,7 @@ func TestPQTransport_HostRoundTrip(t *testing.T) {
 // starting); the transport must open its socket on the netstack instead.
 func TestPQTransport_NetstackRoundTrip(t *testing.T) {
 	overlay := netip.MustParseAddr("192.0.2.1")
-	dev, ns, err := netstack.CreateNetTUN([]netip.Addr{overlay}, nil, 1280)
+	dev, ns, err := wgbackend.CreateNetTUN([]netip.Addr{overlay}, nil, 1280)
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = dev.Close() })