diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index e8fbf5ca..8ec52bb6 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -137,6 +137,14 @@ jobs:
       run: |
           docker run --rm --security-opt seccomp=unconfined --security-opt apparmor=unconfined --device /dev/net/tun \
           rootlesskit:test-integration ./benchmark-iperf3-port-udp.sh slirp4netns --detach-netns
+    - name: "Benchmark: UDP Ports (network driver=pasta, port driver=implicit)"
+      run: |
+          docker run --rm --security-opt seccomp=unconfined --security-opt apparmor=unconfined --device /dev/net/tun \
+          rootlesskit:test-integration ./benchmark-iperf3-port-udp.sh implicit --net=pasta
+    - name: "Benchmark: UDP Ports (network driver=pasta, port driver=implicit) with detach-netns"
+      run: |
+          docker run --rm --security-opt seccomp=unconfined --security-opt apparmor=unconfined --device /dev/net/tun \
+          rootlesskit:test-integration ./benchmark-iperf3-port-udp.sh implicit --net=pasta --detach-netns
     - name: "Benchmark: UDP Ports (port driver=builtin)"
       run: |
           docker run --rm --security-opt seccomp=unconfined --security-opt apparmor=unconfined --device /dev/net/tun \
@@ -145,7 +153,7 @@ jobs:
       run: |
           docker run --rm --security-opt seccomp=unconfined --security-opt apparmor=unconfined --device /dev/net/tun \
           rootlesskit:test-integration ./benchmark-iperf3-port-udp.sh builtin --detach-netns
-# pasta+builtin does not work with UDP yet
+
   test-integration-docker:
     name: "Integration test (Docker)"
     runs-on: ubuntu-latest
diff --git a/Dockerfile b/Dockerfile
index 6ccdf617..1a4de050 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@ ARG UBUNTU_VERSION=22.04
 ARG SHADOW_VERSION=4.13
 ARG SLIRP4NETNS_VERSION=v1.2.0
 ARG VPNKIT_VERSION=0.5.0
-ARG PASST_VERSION=2023_06_27.289301b
+ARG PASST_VERSION=2023_11_19.4f1709d
 ARG DOCKER_VERSION=24.0.2
 ARG DOCKER_CHANNEL=stable
 
diff --git a/docs/network.md b/docs/network.md
index 616ffcc2..079937fc 100644
--- a/docs/network.md
+++ b/docs/network.md
@@ -146,6 +146,7 @@ If `--disable-host-loopback` is not specified, ports listening on 127.0.0.1 in t
 
 > **Note**
 > `--net=pasta` needs [pasta (passt)](https://passt.top/passt/) `2023_06_25.32660ce` or later.
+> Using `2023_11_19.4f1709d` or later is highly recommended.
 >
 > Depending on the version of pasta and the host operating system,
 > running `sudo apparmor_parser -R /etc/apparmor.d/usr.bin.passt` might be needed too.
@@ -157,7 +158,7 @@ Pros:
 * TCP port forwarding (`--port-driver=implicit`) can retain source IP addresses
 
 Cons:
-* UDP port forwarding is not supported yet
+* Lacks API for explicit port forwarding (`rootlessctl (list-ports|add-ports|remove-ports)`)
 
 The network configuration for pasta is similar to slirp4netns.
 As in `--net=slirp4netns`, specifying `--copy-up=/etc` and `--disable-host-loopback` is highly recommended.