diff --git a/doc/ChangeLog.md b/doc/ChangeLog.md
index cc454850..cf7d3e36 100644
--- a/doc/ChangeLog.md
+++ b/doc/ChangeLog.md
@@ -4,7 +4,7 @@ Change Log
 All notable changes to the project are documented in this file.
 
 
-[v24.03.0][UNRELEASED]
+[v24.04.0][UNRELEASED]
 -------------------------
 
 Please note, as of this release the Infix Classic variant has been
@@ -63,6 +63,10 @@ separate project.  Going forward Infix' focus is entirely on NETCONF.
 - Fix #328: when setting up a VLAN filtering bridge, the PVID for bridge
   ports defaulted to 1, making it impossible to set up "tagged-only"
   ports which drop ingressing untagged traffic
+- Fix #357: EUI-64 based IPv6 autoconf address on bridges seem to be
+  randomized.  Problem caused by kernel setting a random MAC before any
+  bridge port is added.  Fixed by using the device's base MAC address on
+  bridge interfaces.  Possible to override using `phys-address` option
 - Fix #358: MAC address no longer shown for bridge interfaces in CLI
   `show interfaces` command
 - Fix #366: static routes from container host interfaces do not work.
@@ -774,6 +778,7 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 
 [buildroot]:  https://buildroot.org/
 [UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.02.0...HEAD
+[v24.04.0]:   https://github.com/kernelkit/infix/compare/v24.02.0...v24.04.0
 [v24.02.0]:   https://github.com/kernelkit/infix/compare/v23.11.0...v24.02.0
 [v23.11.0]:   https://github.com/kernelkit/infix/compare/v23.10.0...v23.11.0
 [v23.10.0]:   https://github.com/kernelkit/infix/compare/v23.09.0...v23.10.0
diff --git a/src/confd/src/core.c b/src/confd/src/core.c
index 3fade65f..b3513c92 100644
--- a/src/confd/src/core.c
+++ b/src/confd/src/core.c
@@ -5,7 +5,7 @@
 
 #include "core.h"
 
-static struct confd confd;
+struct confd confd;
 
 uint32_t core_hook_prio(void)
 {
diff --git a/src/confd/src/core.h b/src/confd/src/core.h
index 888f8090..448b98bb 100644
--- a/src/confd/src/core.h
+++ b/src/confd/src/core.h
@@ -33,6 +33,9 @@
 #define CB_PRIO_PRIMARY   65535
 #define CB_PRIO_PASSIVE   65000
 
+extern struct confd confd;
+
+
 static inline void print_val(sr_val_t *val)
 {
 	char *str;
diff --git a/src/confd/src/ietf-interfaces.c b/src/confd/src/ietf-interfaces.c
index aa8aaace..435717bf 100644
--- a/src/confd/src/ietf-interfaces.c
+++ b/src/confd/src/ietf-interfaces.c
@@ -1235,15 +1235,37 @@ static int netdag_gen_bridge(sr_session_ctx_t *session, struct dagger *net, stru
 	vlan_filtering = bridge_vlan_settings(cif, &proto, &vlan_mcast);
 	fwd_mask = bridge_fwd_mask(cif);
 
+	fprintf(ip, "link %s dev %s", op, brname);
+	/*
+	 * Must set base mac on add to prevent kernel from seeding ipv6
+	 * addrgenmode eui64 with random mac, issue #357.
+	 */
+	if (add) {
+		const char *mac;
+
+		mac = lydx_get_cattr(cif, "phys-address");
+		if (!mac) {
+			struct json_t *j;
+
+			j = json_object_get(confd.root, "mac-address");
+			if (j)
+				mac = json_string_value(j);
+		}
+		if (mac)
+			fprintf(ip, " address %s", mac);
+
+		/* on failure, fall back to kernel's random mac */
+	}
+
 	/*
 	 * Issue #198: we require explicit VLAN assignment for ports
 	 *             when VLAN filtering is enabled.  We strongly
 	 *             believe this is the only sane way of doing it.
 	 * Issue #310: malplaced 'vlan_default_pvid 0'
 	 */
-	fprintf(ip, "link %s dev %s type bridge group_fwd_mask %d mcast_flood_always 1"
+	fprintf(ip, " type bridge group_fwd_mask %d mcast_flood_always 1"
 		" vlan_filtering %d vlan_default_pvid 0",
-		op, brname, fwd_mask, vlan_filtering ? 1 : 0);
+		fwd_mask, vlan_filtering ? 1 : 0);
 
 	if ((err = bridge_mcast_settings(ip, brname, cif, vlan_mcast)))
 		goto out;