diff --git a/CHANGELOG.md b/CHANGELOG.md
index 700f49c1..6e2b4c0a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - OpenVPN: Parse IPv6 endpoints properly. [tunnelkit#294](https://github.com/passepartoutvpn/tunnelkit/issues/294)
 - Restore "Reconnect" action in profiles. [#232](https://github.com/passepartoutvpn/passepartout-apple/pull/232)
 - Systematic uninstallation of VPN profile if any IAP was refunded. [#238](https://github.com/passepartoutvpn/passepartout-apple/issues/238)
+- Use .includeAllNetworks for best-effort kill switch. [#181](https://github.com/passepartoutvpn/passepartout-apple/issues/181), [tunnelkit#300](https://github.com/passepartoutvpn/tunnelkit/pull/300)
 
 ## 2.0.1 (2022-10-17)
 
diff --git a/Passepartout.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved b/Passepartout.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
index ca6bdda0..703726bd 100644
--- a/Passepartout.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
+++ b/Passepartout.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved
@@ -51,7 +51,7 @@
         "repositoryURL": "https://github.com/passepartoutvpn/tunnelkit",
         "state": {
           "branch": null,
-          "revision": "cae371bb400ad3de9bc59f96c18a091fb577ac44",
+          "revision": "0d21731e12ac316274f8c200e39f4fb48097f3dd",
           "version": null
         }
       },
diff --git a/PassepartoutLibrary/Package.swift b/PassepartoutLibrary/Package.swift
index 72bd268a..704cc56b 100644
--- a/PassepartoutLibrary/Package.swift
+++ b/PassepartoutLibrary/Package.swift
@@ -24,7 +24,7 @@ let package = Package(
         // Dependencies declare other packages that this package depends on.
         // .package(url: /* package url */, from: "1.0.0"),
 //        .package(name: "TunnelKit", url: "https://github.com/passepartoutvpn/tunnelkit", from: "5.0.0"),
-        .package(name: "TunnelKit", url: "https://github.com/passepartoutvpn/tunnelkit", .revision("cae371bb400ad3de9bc59f96c18a091fb577ac44")),
+        .package(name: "TunnelKit", url: "https://github.com/passepartoutvpn/tunnelkit", .revision("0d21731e12ac316274f8c200e39f4fb48097f3dd")),
 //        .package(name: "TunnelKit", path: "../../tunnelkit"),
         .package(url: "https://github.com/zoul/generic-json-swift", from: "2.0.0"),
         .package(url: "https://github.com/SwiftyBeaver/SwiftyBeaver", from: "1.9.0")
diff --git a/PassepartoutLibrary/Sources/PassepartoutVPN/Extensions/OpenVPNSettings+VPNConfiguration.swift b/PassepartoutLibrary/Sources/PassepartoutVPN/Extensions/OpenVPNSettings+VPNConfiguration.swift
index 2ade683f..4a3633e5 100644
--- a/PassepartoutLibrary/Sources/PassepartoutVPN/Extensions/OpenVPNSettings+VPNConfiguration.swift
+++ b/PassepartoutLibrary/Sources/PassepartoutVPN/Extensions/OpenVPNSettings+VPNConfiguration.swift
@@ -56,11 +56,12 @@ extension Profile.OpenVPNSettings: VPNConfigurationProviding {
             appGroup: parameters.appGroup,
             configuration: customConfiguration
         )
+        cfg.username = parameters.username
+        cfg.killSwitch = true
         cfg.shouldDebug = true
         cfg.debugLogPath = parameters.preferences.tunnelLogPath
         cfg.debugLogFormat = parameters.preferences.tunnelLogFormat
         cfg.masksPrivateData = parameters.preferences.masksPrivateData
-        cfg.username = parameters.username
         
         var extra = NetworkExtensionExtra()
         extra.passwordReference = parameters.passwordReference
diff --git a/PassepartoutLibrary/Sources/PassepartoutVPN/Extensions/WireGuardSettings+VPNConfiguration.swift b/PassepartoutLibrary/Sources/PassepartoutVPN/Extensions/WireGuardSettings+VPNConfiguration.swift
index aebdcc67..b65a48e0 100644
--- a/PassepartoutLibrary/Sources/PassepartoutVPN/Extensions/WireGuardSettings+VPNConfiguration.swift
+++ b/PassepartoutLibrary/Sources/PassepartoutVPN/Extensions/WireGuardSettings+VPNConfiguration.swift
@@ -47,6 +47,7 @@ extension Profile.WireGuardSettings: VPNConfigurationProviding {
             appGroup: parameters.appGroup,
             configuration: customConfiguration
         )
+        cfg.killSwitch = true
         cfg.shouldDebug = true
         cfg.debugLogPath = parameters.preferences.tunnelLogPath
         cfg.debugLogFormat = parameters.preferences.tunnelLogFormat