diff --git a/network/filter/iptables/files/gentoo/iptables-1.8.9-format-security.patch b/network/filter/iptables/files/gentoo/iptables-1.8.9-format-security.patch
new file mode 100644
index 0000000000..a95c436009
--- /dev/null
+++ b/network/filter/iptables/files/gentoo/iptables-1.8.9-format-security.patch
@@ -0,0 +1,26 @@
+https://git.netfilter.org/iptables/commit/?id=ed4082a7405a5838c205a34c1559e289949200cc
+
+From ed4082a7405a5838c205a34c1559e289949200cc Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 12 Jan 2023 14:38:44 +0100
+Subject: extensions: NAT: Fix for -Werror=format-security
+
+Have to pass either a string literal or format string to xt_xlate_add().
+
+Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+--- a/extensions/libxt_NAT.c
++++ b/extensions/libxt_NAT.c
+@@ -424,7 +424,7 @@ __NAT_xlate(struct xt_xlate *xl, const struct nf_nat_range2 *r,
+ 	if (r->flags & NF_NAT_RANGE_PROTO_OFFSET)
+ 		return 0;
+ 
+-	xt_xlate_add(xl, tgt);
++	xt_xlate_add(xl, "%s", tgt);
+ 	if (strlen(range_str))
+ 		xt_xlate_add(xl, " to %s", range_str);
+ 	if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) {
+-- 
+cgit v1.2.3
+
+
diff --git a/network/filter/iptables/pspec.xml b/network/filter/iptables/pspec.xml
index b4a7232b78..399e1f5378 100644
--- a/network/filter/iptables/pspec.xml
+++ b/network/filter/iptables/pspec.xml
@@ -12,7 +12,7 @@
         <IsA>app:console</IsA>
         <Summary>Firewall, NAT and packet mangling tools</Summary>
         <Description>Contains iptables firewall, NAT and packet mangling tools.</Description>
-        <Archive sha1sum="98783621a5e58ff55f83b1350523f3de41af621d" type="tarbz2">https://www.netfilter.org/projects/iptables/files/iptables-1.8.8.tar.bz2</Archive>
+        <Archive sha1sum="f47bc1026858d7078c8d0544bbb9bea5c08fd9ad" type="tarxz">https://www.netfilter.org/projects/iptables/files/iptables-1.8.9.tar.xz</Archive>
         <BuildDependencies>
             <Dependency>libmnl-devel</Dependency>
             <Dependency>libpcap-devel</Dependency>
@@ -24,8 +24,7 @@
             <Patch>iptables-1.4.2-as-needed.patch</Patch>
             <Patch>iptables-1.4.2-no-ldconfig.patch</Patch>
             -->
-            <Patch>iptables-1.8.2-link.patch</Patch>
-            <Patch>0001-xshared-Fix-build-for-Werror-format-security.patch</Patch>
+            <Patch>gentoo/iptables-1.8.9-format-security.patch</Patch>
         </Patches>
     </Source>
 
@@ -68,6 +67,13 @@
     </Package>
 
     <History>
+        <Update release="9">
+            <Date>2023-01-13</Date>
+            <Version>1.8.9</Version>
+            <Comment>Version bump.</Comment>
+            <Name>Mustafa Cinasal</Name>
+            <Email>muscnsl@gmail.com</Email>
+        </Update>
         <Update release="8">
             <Date>2022-08-03</Date>
             <Version>1.8.8</Version>