diff --git a/tests/test_app.py b/tests/test_app.py
index ca301e3..a122369 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -87,7 +87,7 @@ def test_build_archinstall_config_includes_post_install_bootstrap(monkeypatch, t
         }
     )
 
-    for pkg in ("caddy", "avahi", "nss-mdns"):
+    for pkg in ("caddy", "avahi", "nss-mdns", "wireguard-tools"):
         assert pkg in cfg["packages"]
     # Packaged units go in `services` (enabled before custom_commands runs);
     # our own units don't exist at that point, so they must be enabled from
diff --git a/webinstaller/app.py b/webinstaller/app.py
index 08236a3..28bef61 100644
--- a/webinstaller/app.py
+++ b/webinstaller/app.py
@@ -469,6 +469,9 @@ def build_archinstall_config(s):
             "caddy",
             "avahi",
             "nss-mdns",
+            # furtka-gateway tunnel — furtka/wireguard.py drives
+            # wg-quick@furtka-gw.service, which ships in this package.
+            "wireguard-tools",
             # Resource manager runtime — pure-stdlib Python, no pip needed
             # because we expose the package via PYTHONPATH in /usr/local/bin/furtka.
             "python",