diff --git a/qbittorrent/CHANGELOG.md b/qbittorrent/CHANGELOG.md
index c844f683d..a2747da07 100644
--- a/qbittorrent/CHANGELOG.md
+++ b/qbittorrent/CHANGELOG.md
@@ -1,4 +1,7 @@
 
+## 5.1.4-1 (21-12-2025)
+- Fix WireGuard sysctl wrapper paths to resolve #2289.
+
 ## 5.1.4 (29-11-2025)
 - Update to latest version from linuxserver/docker-qbittorrent (changelog : https://github.com/linuxserver/docker-qbittorrent/releases)
 ## 5.1.2-22 (24-11-2025)
diff --git a/qbittorrent/config.yaml b/qbittorrent/config.yaml
index 45c6079ac..83d54243f 100644
--- a/qbittorrent/config.yaml
+++ b/qbittorrent/config.yaml
@@ -145,4 +145,4 @@ schema:
 slug: qbittorrent
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "5.1.4"
+version: "5.1.4-1"
diff --git a/qbittorrent/rootfs/sbin/sysctl b/qbittorrent/rootfs/sbin/sysctl
new file mode 120000
index 000000000..bc5cd6a43
--- /dev/null
+++ b/qbittorrent/rootfs/sbin/sysctl
@@ -0,0 +1 @@
+../usr/local/sbin/sysctl
\ No newline at end of file
diff --git a/qbittorrent/rootfs/usr/local/sbin/sysctl b/qbittorrent/rootfs/usr/local/sbin/sysctl
index b76c18c88..d09843062 100644
--- a/qbittorrent/rootfs/usr/local/sbin/sysctl
+++ b/qbittorrent/rootfs/usr/local/sbin/sysctl
@@ -1,17 +1,40 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-REAL_SYSCTL="/sbin/sysctl"
-if [[ ! -x "${REAL_SYSCTL}" ]]; then
-    REAL_SYSCTL="/usr/sbin/sysctl"
+SCRIPT_PATH="$(readlink -f "$0")"
+REAL_SYSCTL_CMD=()
+
+_maybe_set_backend() {
+    local candidate="$1"
+    if [[ -x "${candidate}" && "$(readlink -f "${candidate}")" != "${SCRIPT_PATH}" ]]; then
+        REAL_SYSCTL_CMD=("${candidate}")
+        return 0
+    fi
+    return 1
+}
+
+# Prefer system binaries that are not the wrapper itself
+_maybe_set_backend "/sbin/sysctl" \
+    || _maybe_set_backend "/usr/sbin/sysctl" \
+    || _maybe_set_backend "/bin/sysctl" \
+    || _maybe_set_backend "/usr/bin/sysctl"
+
+# Fallback to the busybox applet if no dedicated binary was found
+if [[ ${#REAL_SYSCTL_CMD[@]} -eq 0 ]] && command -v busybox >/dev/null 2>&1; then
+    REAL_SYSCTL_CMD=("$(command -v busybox)" sysctl)
+fi
+
+if [[ ${#REAL_SYSCTL_CMD[@]} -eq 0 ]]; then
+    echo "sysctl wrapper: no backend sysctl binary found" >&2
+    exit 1
 fi
 
 if [[ "$#" -ge 2 && "$1" == "-q" && "$2" == "net.ipv4.conf.all.src_valid_mark=1" ]]; then
-    if "${REAL_SYSCTL}" "$@" >/dev/null 2>&1; then
+    if "${REAL_SYSCTL_CMD[@]}" "$@" >/dev/null 2>&1; then
         exit 0
     fi
     # Suppress failure for this specific key to keep wg-quick from aborting in unprivileged environments.
     exit 0
 fi
 
-exec "${REAL_SYSCTL}" "$@"
+exec "${REAL_SYSCTL_CMD[@]}" "$@"
diff --git a/qbittorrent/rootfs/usr/sbin/sysctl b/qbittorrent/rootfs/usr/sbin/sysctl
new file mode 120000
index 000000000..feed5f1c0
--- /dev/null
+++ b/qbittorrent/rootfs/usr/sbin/sysctl
@@ -0,0 +1 @@
+../local/sbin/sysctl
\ No newline at end of file