diff --git a/.buildkite/hooks/post-command b/.buildkite/hooks/post-command
index 1ea4870569..948de9fcb1 100644
--- a/.buildkite/hooks/post-command
+++ b/.buildkite/hooks/post-command
@@ -40,6 +40,15 @@ make -s testlogs 2>/dev/null | grep // | sort | uniq | (
   done
 )
 
+if test "${BUILDKITE_COMMAND_EXIT_STATUS}" -ne "0"; then
+  if test -d bazel-testlogs; then
+    # Use -L to follow the bazel-testlogs symlink
+    find -L bazel-testlogs -type f \( -name "*.log" -o -name "*.txt" \) | while read file; do
+      buildkite-agent artifact upload "${file}"
+    done
+  fi
+fi
+
 # Upload all profiles, and include in an annotation.
 declare profile_output=$(mktemp --tmpdir)
 for file in $(find /tmp/profile -name \*.pprof -print 2>/dev/null | sort); do
diff --git a/pkg/tcpip/network/ipv4/ipv4.go b/pkg/tcpip/network/ipv4/ipv4.go
index bc650855f3..36c69be8ad 100644
--- a/pkg/tcpip/network/ipv4/ipv4.go
+++ b/pkg/tcpip/network/ipv4/ipv4.go
@@ -593,8 +593,8 @@ func (e *endpoint) writePacketPostRouting(r *stack.Route, pkt *stack.PacketBuffe
 	}
 
 	if nft := stk.NFTables(); nft != nil && stk.IsNFTablesConfigured() {
-		ipCheck := nft.CheckOutput(pkt, stack.IP)
-		inetCheck := nft.CheckOutput(pkt, stack.Inet)
+		ipCheck := nft.CheckPostrouting(pkt, stack.IP)
+		inetCheck := nft.CheckPostrouting(pkt, stack.Inet)
 		if !ipCheck || !inetCheck {
 			// nftables is telling us to drop the packet.
 			return nil
diff --git a/pkg/tcpip/nftables/nft_metaload.go b/pkg/tcpip/nftables/nft_metaload.go
index b332ac5bfd..0f9beba5f3 100644
--- a/pkg/tcpip/nftables/nft_metaload.go
+++ b/pkg/tcpip/nftables/nft_metaload.go
@@ -80,8 +80,15 @@ func (op metaLoad) evaluate(regs *registerSet, pkt *stack.PacketBuffer, rule *Ru
 
 	// Netfilter (Family) Protocol (8-bit, single byte).
 	case linux.NFT_META_NFPROTO:
-		family := rule.chain.GetAddressFamily()
-		target = []byte{AfProtocol(family)}
+		switch pkt.NetworkProtocolNumber {
+		// Cannot rely on chain's address family as it can be inet, and inet can mean either IPv4 or IPv6.
+		case header.IPv4ProtocolNumber:
+			target = []byte{linux.NFPROTO_IPV4}
+		case header.IPv6ProtocolNumber:
+			target = []byte{linux.NFPROTO_IPV6}
+		default:
+			target = []byte{AfProtocol(rule.chain.GetAddressFamily())}
+		}
 
 	// L4 Transport Layer Protocol (8-bit, single byte).
 	case linux.NFT_META_L4PROTO:
diff --git a/pkg/tcpip/nftables/nftables_test.go b/pkg/tcpip/nftables/nftables_test.go
index 132e2a1ca3..e5b58b9cd3 100644
--- a/pkg/tcpip/nftables/nftables_test.go
+++ b/pkg/tcpip/nftables/nftables_test.go
@@ -2854,7 +2854,7 @@ func TestEvaluateMetaLoad(t *testing.T) {
 			pkt:   pkt,
 			op1:   mustCreateMetaLoad(t, linux.NFT_META_NFPROTO, linux.NFT_REG_4),
 			op2: mustCreateComparison(t, linux.NFT_REG_4, linux.NFT_CMP_EQ,
-				[]byte{AfProtocol(stack.Inet), 0, 0, 0}),
+				[]byte{linux.NFPROTO_IPV6, 0, 0, 0}),
 		},
 		{ // cmd: add rule ip6 tab ch meta l4proto 0x6
 			tname: "meta load l4proto test",