diff --git a/Makefile b/Makefile
index f43e6b655..7f38372f6 100644
--- a/Makefile
+++ b/Makefile
@@ -5,6 +5,8 @@
 # at your option. This file may not be copied, modified, or distributed except
 # according to those terms.
 
+include Nat.mk
+
 LINK_PCRE := 0
 FORMAT_MSG := "\\x1B[95mFormatting:\\x1B[39m"
 BUILD_MSG := "\\x1B[92mBuilding:\\x1B[39m"
@@ -68,6 +70,7 @@ $(NIMBLEDEPS_STAMP): | waku.nims
 	nimble setup --localdeps
 	nimble install --depsOnly
 	$(MAKE) build-nph
+	$(MAKE) rebuild-nat-libs-nimbledeps
 	touch $@
 
 update:
@@ -489,7 +492,7 @@ ifneq ($(findstring /nix/store,$(LIBRLN_FILE)),)
 else
 	./scripts/build_rln_android.sh $(CURDIR)/build $(LIBRLN_BUILDDIR) $(LIBRLN_VERSION) $(CROSS_TARGET) $(ABIDIR)
 endif
-	$(MAKE) rebuild-nat-libs CC=$(ANDROID_TOOLCHAIN_DIR)/bin/$(ANDROID_COMPILER)
+	$(MAKE) rebuild-nat-libs-nimbledeps CC=$(ANDROID_TOOLCHAIN_DIR)/bin/$(ANDROID_COMPILER)
 
 libwaku-android-arm64: ANDROID_ARCH=aarch64-linux-android
 libwaku-android-arm64: CPU=arm64
diff --git a/Nat.mk b/Nat.mk
new file mode 100644
index 000000000..31ad4e018
--- /dev/null
+++ b/Nat.mk
@@ -0,0 +1,54 @@
+# Copyright (c) 2022 Status Research & Development GmbH. Licensed under
+# either of:
+# - Apache License, version 2.0
+# - MIT license
+# at your option. This file may not be copied, modified, or distributed except
+# according to those terms.
+
+###########################
+## nat-libs (nimbledeps) ##
+###########################
+# Builds miniupnpc and libnatpmp from the package installed by nimble under
+# nimbledeps/pkgs2/. Used by `make update` / $(NIMBLEDEPS_STAMP).
+#
+# NAT_TRAVERSAL_NIMBLEDEPS_DIR is evaluated at parse time, so targets that
+# depend on it must be invoked via a recursive $(MAKE) call so the sub-make
+# re-evaluates the variable after nimble setup has populated nimbledeps/.
+#
+# `ls -dt` (sort by modification time, newest first) is used to pick the
+# latest installed version and is portable across Linux, macOS, and
+# Windows (MSYS/MinGW).
+
+NAT_TRAVERSAL_NIMBLEDEPS_DIR := $(shell ls -dt $(CURDIR)/nimbledeps/pkgs2/nat_traversal-* 2>/dev/null | head -1)
+
+.PHONY: clean-cross-nimbledeps rebuild-nat-libs-nimbledeps
+
+clean-cross-nimbledeps:
+ifeq ($(NAT_TRAVERSAL_NIMBLEDEPS_DIR),)
+	$(error No nat_traversal package found under nimbledeps/pkgs2/ — run 'make update' first)
+endif
+	+ [ -e "$(NAT_TRAVERSAL_NIMBLEDEPS_DIR)/vendor/miniupnp/miniupnpc" ] && \
+		"$(MAKE)" -C "$(NAT_TRAVERSAL_NIMBLEDEPS_DIR)/vendor/miniupnp/miniupnpc" CC=$(CC) clean $(HANDLE_OUTPUT) || true
+	+ [ -e "$(NAT_TRAVERSAL_NIMBLEDEPS_DIR)/vendor/libnatpmp-upstream" ] && \
+		"$(MAKE)" -C "$(NAT_TRAVERSAL_NIMBLEDEPS_DIR)/vendor/libnatpmp-upstream" CC=$(CC) clean $(HANDLE_OUTPUT) || true
+
+rebuild-nat-libs-nimbledeps: | clean-cross-nimbledeps
+ifeq ($(NAT_TRAVERSAL_NIMBLEDEPS_DIR),)
+	$(error No nat_traversal package found under nimbledeps/pkgs2/ — run 'make update' first)
+endif
+	@echo "Rebuilding nat-libs from $(NAT_TRAVERSAL_NIMBLEDEPS_DIR)"
+ifeq ($(OS), Windows_NT)
+	+ [ -e "$(NAT_TRAVERSAL_NIMBLEDEPS_DIR)/vendor/miniupnp/miniupnpc/libminiupnpc.a" ] || \
+		PATH=".;$${PATH}" "$(MAKE)" -C "$(NAT_TRAVERSAL_NIMBLEDEPS_DIR)/vendor/miniupnp/miniupnpc" \
+		-f Makefile.mingw CC=$(CC) CFLAGS="-Os -fPIC" libminiupnpc.a $(HANDLE_OUTPUT)
+	+ "$(MAKE)" -C "$(NAT_TRAVERSAL_NIMBLEDEPS_DIR)/vendor/libnatpmp-upstream" \
+		OS=mingw CC=$(CC) \
+		CFLAGS="-Wall -Wno-cpp -Os -fPIC -DWIN32 -DNATPMP_STATICLIB -DENABLE_STRNATPMPERR -DNATPMP_MAX_RETRIES=4 $(CFLAGS)" \
+		libnatpmp.a $(HANDLE_OUTPUT)
+else
+	+ "$(MAKE)" -C "$(NAT_TRAVERSAL_NIMBLEDEPS_DIR)/vendor/miniupnp/miniupnpc" \
+		CC=$(CC) CFLAGS="-Os -fPIC" build/libminiupnpc.a $(HANDLE_OUTPUT)
+	+ "$(MAKE)" CFLAGS="-Wall -Wno-cpp -Os -fPIC -DENABLE_STRNATPMPERR -DNATPMP_MAX_RETRIES=4 $(CFLAGS)" \
+		-C "$(NAT_TRAVERSAL_NIMBLEDEPS_DIR)/vendor/libnatpmp-upstream" \
+		CC=$(CC) libnatpmp.a $(HANDLE_OUTPUT)
+endif