diff --git a/docs/changelog-20260806-step34-g3-probe.md b/docs/changelog-20260806-step34-g3-probe.md
index 950bf02..41958f1 100644
--- a/docs/changelog-20260806-step34-g3-probe.md
+++ b/docs/changelog-20260806-step34-g3-probe.md
@@ -133,3 +133,16 @@
 provider-public legs -> install tailscale. Then the Headscale-side join (deferred, access).
 REVERT: remove the "vr1-dc{0,1}-tailscale-01" map entries (for_each keyed -> plans 1 destroy
 each if already applied; a pure map removal if not yet applied).
+
+## Item 8 -- dc0 tailscale VM APPLIED + MACs pinned (gated)
+
+WHAT: operator-approved (scope choice "dc0 full + dc1 full") gated apply of the dc0 substrate:
+`tofu apply` (saved plan) on voffice1 (inner root, D-128) -> "Apply complete! Resources: 2
+added, 0 changed, 0 destroyed" -- vr1-dc0-tailscale-01 (domain + disk) created, powered off
+(autostart=false, D-127). MACs then captured via `virsh domiflist vr1-dc0-tailscale-01` (qemu+ssh
+provider URI, 172.31.0.2) and PINNED in the map (metal-admin 52:54:00:54:d5:5e ... replication
+52:54:00:99:2f:ba, in vr1_dc0_node_nics order) before the VM is ever started/enlisted -- the
+MAC-regen trap. Verify: post-pin `tofu plan` must show No changes.
+STILL OWED (dc0): start the VM -> MAAS enlist/commission/deploy Ubuntu -> carve .7 metal-admin
+(10.12.8.7) + provider-public (10.12.4.7 gw) -> install tailscale -> (Headscale join, deferred).
+REVERT: macs->[] restores the pre-pin map; `tofu destroy -target module.vr1_dc0_node["vr1-dc0-tailscale-01"]` removes the VM.
diff --git a/opentofu/vr1-dc0-substrate/main.tf b/opentofu/vr1-dc0-substrate/main.tf
index 096cf3e..e26dac6 100644
--- a/opentofu/vr1-dc0-substrate/main.tf
+++ b/opentofu/vr1-dc0-substrate/main.tf
@@ -235,7 +235,14 @@
     # carved and only metal-admin is advertised (SNAT on, ruling d) -- the other four legs stay
     # uncarved (the isolated metal-internal/data/storage/replication planes are neither carved nor
     # routed by this node).
-    "vr1-dc0-tailscale-01" = { vcpu = 2, mem = 2048, disk_gib = 25, macs = [] }
+    # MACs PINNED 2026-08-07 from measurement (`virsh domiflist vr1-dc0-tailscale-01` via the
+    # qemu+ssh provider URI) immediately after the first apply, before enlistment. Order =
+    # vr1_dc0_node_nics (metal-admin, provider-public, metal-internal, data-tenant, storage,
+    # replication). Libvirt-generated 52:54:00: values, as expected from `macs = []` at first
+    # apply. Identity values, not tunables -- change one and MAAS no longer knows the node.
+    "vr1-dc0-tailscale-01" = { vcpu = 2, mem = 2048, disk_gib = 25, macs = [
+      "52:54:00:54:d5:5e", "52:54:00:a1:c1:46", "52:54:00:a0:f1:26",
+    "52:54:00:5e:cb:9c", "52:54:00:ee:1d:61", "52:54:00:99:2f:ba"] }
 
   }
 }