diff --git a/nixos/modules/services/system/bpftune.nix b/nixos/modules/services/system/bpftune.nix
index c69a53b6d554..6b91e9efab79 100644
--- a/nixos/modules/services/system/bpftune.nix
+++ b/nixos/modules/services/system/bpftune.nix
@@ -22,6 +22,9 @@ in
 
   config = lib.mkIf cfg.enable {
     systemd.packages = [ cfg.package ];
-    systemd.services.bpftune.wantedBy = [ "multi-user.target" ];
+    systemd.services.bpftune = {
+      wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.kmod ]; # bpftune calls modprobe
+    };
   };
 }
diff --git a/pkgs/by-name/bp/bpftune/package.nix b/pkgs/by-name/bp/bpftune/package.nix
index 14ac6330b4a2..f1ffcc8f6c74 100644
--- a/pkgs/by-name/bp/bpftune/package.nix
+++ b/pkgs/by-name/bp/bpftune/package.nix
@@ -9,29 +9,27 @@
   libcap,
   libnl,
   nixosTests,
-  unstableGitUpdater,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bpftune";
-  version = "0-unstable-2025-03-20";
+  version = "0.4-2";
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = "bpftune";
-    rev = "8c6a3ffc09265bd44ed89b75c400ef97959d1aff";
-    hash = "sha256-TQ8WaGvMcvyeZC4B9gSjJ2k5NOxpTaV4n7Qi36aA78Q=";
+    tag = finalAttrs.version;
+    hash = "sha256-clfR2nZKB9ztfUEw+znr9/Rdefv4K+mTeRCSBLIBmVY=";
   };
 
   postPatch = ''
     # otherwise shrink rpath would drop $out/lib from rpath
     substituteInPlace src/Makefile \
-      --replace-fail /sbin    /bin \
+      --replace-fail /sbin /bin \
       --replace-fail ldconfig true
     substituteInPlace src/bpftune.service \
       --replace-fail /usr/sbin/bpftune "$out/bin/bpftune"
-    substituteInPlace src/libbpftune.c \
-      --replace-fail /lib/modules /run/booted-system/kernel-modules/lib/modules
   '';
 
   nativeBuildInputs = [
@@ -56,7 +54,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   hardeningDisable = [
-    "stackprotector"
     "zerocallusedregs"
   ];
 
@@ -64,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
     tests = {
       inherit (nixosTests) bpftune;
     };
-    updateScript = unstableGitUpdater { };
+    updateScript = nix-update-script { };
   };
 
   enableParallelBuilding = true;