diff --git a/CHANGELOG.md b/CHANGELOG.md
index c68172e..16f296d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,7 @@ All Nullnet releases with the relative changes are documented in this file.
 - Install BPF linker as a prebuilt binary rather than compiling it from source ([#158](https://github.com/NullNet-ai/nullnet/pull/158))
 ### Removed
 ### Fixed
+- Set both same-host veth MAC addresses at creation to prevent udev races from breaking encrypted connections ([#185](https://github.com/NullNet-ai/nullnet/pull/185))
 - Stop a teardown from corrupting a chain that is still being set up ([#167](https://github.com/NullNet-ai/nullnet/pull/167) — fixes [#166](https://github.com/NullNet-ai/nullnet/issues/166))
 - Reject a service name claimed by more than one stack, instead of resolving it to an arbitrary stack ([#165](https://github.com/NullNet-ai/nullnet/pull/165) — fixes [#129](https://github.com/NullNet-ai/nullnet/issues/129))
 - Show the date alongside the time for timestamps from before today, instead of `hh:mm:ss` only, in the topology panels, Sessions, and Events pages ([#159](https://github.com/NullNet-ai/nullnet/pull/159) — fixes [#135](https://github.com/NullNet-ai/nullnet/issues/135))
diff --git a/members/nullnet-client/src/commands/vxlan.rs b/members/nullnet-client/src/commands/vxlan.rs
index f8f1050..87671e9 100644
--- a/members/nullnet-client/src/commands/vxlan.rs
+++ b/members/nullnet-client/src/commands/vxlan.rs
@@ -17,7 +17,7 @@ use super::netlink::{delete_link, get_link_by_name, set_link_mtu_up};
 use futures::StreamExt;
 use ipnetwork::Ipv4Network;
 use nullnet_liberror::{Error, ErrorHandler, Location, location};
-use rtnetlink::packet_route::link::LinkMessage;
+use rtnetlink::packet_route::link::{InfoData, InfoVeth, LinkMessage};
 use rtnetlink::{Handle, LinkBridge, LinkUnspec, LinkVeth, LinkVxlan};
 use std::collections::HashMap;
 use std::fs::File;
@@ -231,6 +231,13 @@ async fn setup_same_host(
         .add(
             LinkVeth::new(&veth_s, &veth_c)
                 .address(mac_s.clone())
+                // Set both MACs at creation so udev never sees a random peer
+                // address and races us with MACAddressPolicy=persistent.
+                .set_info_data(InfoData::Veth(InfoVeth::Peer(
+                    LinkUnspec::new_with_name(&veth_c)
+                        .address(mac_c.clone())
+                        .build(),
+                )))
                 .build(),
         )
         .execute()
@@ -242,17 +249,6 @@ async fn setup_same_host(
     }
     let link_s = get_link_by_name(handle, &veth_s).await?;
     let link_c = get_link_by_name(handle, &veth_c).await?;
-    handle
-        .link()
-        .set(
-            LinkUnspec::new_with_index(link_c.header.index)
-                .address(mac_c.clone())
-                .build(),
-        )
-        .execute()
-        .await
-        .handle_err(location!())?;
-
     let (local_link, local_veth, peer_mac, macsec_suffix) = if params.br_name.ends_with("_s") {
         (link_s, veth_s.as_str(), mac_c, "s")
     } else {