diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 60fb14c9ae..9eba717e60 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -133,9 +133,6 @@ (define-public p11-kit
 living in the same process.")
     (license license:bsd-3)))
 
-
-;; TODO Add net-tools-for-tests to #:disallowed-references when we can afford
-;; rebuild GnuTLS (i.e. core-updates).
 (define-public gnutls
   (package
     (name "gnutls")
@@ -156,7 +153,8 @@ (define-public gnutls
                "15ihq6p0hnnhs8cnjrkj40dmlcaa1jjg8xg0g2ydbnlqs454ixbr"))))
     (build-system gnu-build-system)
     (arguments
-     '(#:configure-flags
+     '(#:disallowed-references ,(net-tools-for-tests)
+       #:configure-flags
        (list
              ;; GnuTLS doesn't consult any environment variables to specify
              ;; the location of the system-wide trust store.  Instead it has a