diff --git a/debian/changelog b/debian/changelog
index e9e6cce43..1eb32efa3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -9,6 +9,10 @@ linux (4.10.7-1~exp1) UNRELEASED; urgency=medium
     https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.6
     https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.7
 
+  [ Ben Hutchings ]
+  * netfilter: Enable NF_SOCKET_IPV4, NF_SOCKET_IPV6 as modules
+    (Closes: #858897)
+
  -- Ben Hutchings <ben@decadent.org.uk>  Thu, 30 Mar 2017 13:56:41 +0100
 
 linux (4.10-1~exp1) experimental; urgency=medium
diff --git a/debian/config/config b/debian/config/config
index aea056bcb..e4ae71cb4 100644
--- a/debian/config/config
+++ b/debian/config/config
@@ -6228,6 +6228,7 @@ CONFIG_TCP_MD5SIG=y
 ## file: net/ipv4/netfilter/Kconfig
 ##
 CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_SOCKET_IPV4=m
 CONFIG_NF_TABLES_IPV4=m
 CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
@@ -6292,6 +6293,7 @@ CONFIG_IPV6_PIMSM_V2=y
 ## file: net/ipv6/netfilter/Kconfig
 ##
 CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_SOCKET_IPV6=m
 CONFIG_NF_TABLES_IPV6=m
 CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m