diff --git a/scripts/carve-host-interfaces.sh b/scripts/carve-host-interfaces.sh
index b0db8fc..0f232bc 100644
--- a/scripts/carve-host-interfaces.sh
+++ b/scripts/carve-host-interfaces.sh
@@ -170,14 +170,22 @@
 # bridge br-enp1s0 that captured enp1s0 and starved OVS br-ex, darkening the floating-IP
 # plane.) Idempotent.
 build_ovs_brex() {
-  local nic="$1" cidr="$2" ip="$3" id lid brid
+  local nic="$1" cidr="$2" ip="$3" id lid brid pvlan
   id="$(ifid_of "$nic")"; [ -n "$id" ] || { fail "$nic not found on $HN"; return 1; }
+  pvlan="$(vlanid_of "$cidr")"; [ -n "$pvlan" ] || { fail "no VLAN for provider $cidr"; return 1; }
   # 1) clear the commissioning link(s) so the host L3 lands on br-ex, not the member NIC
   for lid in $(maas_q interfaces read "$SID" | jq -r --arg n "$nic" '.[]|select(.name==$n)|.links[]?|select(.subnet!=null)|.id'); do
     emit "unlink $nic(id=$id) commissioning link id=$lid (L3 moves to br-ex)" interface unlink-subnet "$SID" "$id" id="$lid"
   done
-  # 2) create the OVS bridge br-ex on the provider uplink (skip if it already exists)
+  # 2) create the OVS bridge br-ex on the provider uplink (skip if it already exists).
+  #    Commissioning leaves the uplink on an auto-fabric, NOT the provider VLAN; a MAAS
+  #    bridge inherits its parent's VLAN at create, so move the uplink onto the provider
+  #    VLAN first or the br-ex static below lands on the wrong plane. Mirrors carve_raw's
+  #    vlan-first placement (restores the move the pre-D-060 Pattern B helper performed).
+  #    Done inside this guard so a re-run (br-ex already a bridge member) never attempts
+  #    a VLAN update on an enslaved NIC.
   if [ -z "$(ifid_of br-ex)" ]; then
+    emit "$nic(id=$id) -> VLAN $pvlan ($cidr)" interface update "$SID" "$id" vlan="$pvlan"
     emit "create br-ex (OVS) parent=$nic(id=$id)" interfaces create-bridge "$SID" name=br-ex bridge_type=ovs parent="$id"
   else note "br-ex exists -- SKIP create"; fi
   [ "$MODE" = apply ] && brid="$(ifid_of br-ex)" || brid="<br-ex-id>"