diff --git a/go.mod b/go.mod
index 6d69e42..cbe5756 100644
--- a/go.mod
+++ b/go.mod
@@ -20,6 +20,7 @@ require (
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
+	github.com/imgk/divert-go v0.1.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jchv/go-winloader v0.0.0-20210711035445-715c2860da7e // indirect
 	github.com/labstack/echo/v4 v4.13.3 // indirect
diff --git a/go.sum b/go.sum
index cb59edd..fa017ef 100644
--- a/go.sum
+++ b/go.sum
@@ -15,6 +15,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/imgk/divert-go v0.1.0 h1:PTB6jsmj5j2ymDBaiyhh0mzQ8ldma10mNaq1tknJysM=
+github.com/imgk/divert-go v0.1.0/go.mod h1:8j670dnMAWuHP3AHj7Zd8b4HhGw4mdTo8aYhCWNsAeU=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jchv/go-winloader v0.0.0-20210711035445-715c2860da7e h1:Q3+PugElBCf4PFpxhErSzU3/PY5sFL5Z6rfv4AbGAck=
diff --git a/internal/divert/assets/WinDivert.dll b/internal/divert/assets/WinDivert.dll
new file mode 100644
index 0000000..50ca874
Binary files /dev/null and b/internal/divert/assets/WinDivert.dll differ
diff --git a/internal/divert/assets/WinDivert64.sys b/internal/divert/assets/WinDivert64.sys
new file mode 100644
index 0000000..218ccaf
Binary files /dev/null and b/internal/divert/assets/WinDivert64.sys differ
diff --git a/internal/divert/embed.go b/internal/divert/embed.go
new file mode 100644
index 0000000..4d9cb15
--- /dev/null
+++ b/internal/divert/embed.go
@@ -0,0 +1,23 @@
+//go:build windows
+
+package divert
+
+import _ "embed"
+
+//go:embed assets/WinDivert64.sys
+var winDivertSys []byte
+
+//go:embed assets/WinDivert.dll
+var winDivertDll []byte
+
+// Sentinel SHA256 of the embedded binaries — verified on extract.
+// Generated via:
+//
+//   sha256sum internal/divert/assets/WinDivert64.sys
+//   sha256sum internal/divert/assets/WinDivert.dll
+//
+// Update both constants when bumping WinDivert versions.
+const (
+	WinDivertSysSHA256 = "8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2"
+	WinDivertDllSHA256 = "c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2"
+)