diff --git a/opentofu/vr1-dc0-substrate/main.tf b/opentofu/vr1-dc0-substrate/main.tf
index 4868b35..4413a53 100644
--- a/opentofu/vr1-dc0-substrate/main.tf
+++ b/opentofu/vr1-dc0-substrate/main.tf
@@ -193,7 +193,16 @@
     # enlistment. The region needs egress for image sync, and carving metal-admin ALONE is
     # exactly the under-carve that cost three bootstrap attempts on the controller VM the
     # same day -- it has no default route and cannot reach the internet.
-    "vr1-dc0-maas-01" = { vcpu = 4, mem = 8192, disk_gib = 150, macs = [] }
+    # MACs PINNED 2026-07-30 from measurement (`virsh domiflist vr1-dc0-maas-01` on
+    # vvr1-dc0) in the SAME session as the first apply, before enlistment -- the boundary
+    # modules/node-vm warns about. Order = vr1_dc0_node_nics order (metal-admin,
+    # provider-public, metal-internal, data-tenant, storage, replication).
+    # Libvirt-generated `52:54:00:` values, as expected from the deliberate `macs = []`
+    # at first apply -- NOT dc1's schematic scheme. These are identity values, not
+    # tunables: change one and MAAS no longer knows the node.
+    "vr1-dc0-maas-01" = { vcpu = 4, mem = 8192, disk_gib = 150, macs = [
+      "52:54:00:dc:5c:0b", "52:54:00:81:15:a7", "52:54:00:a9:0b:d6",
+    "52:54:00:a6:8a:94", "52:54:00:db:7f:65", "52:54:00:0c:22:a3"] }
 
   }
 }