diff --git a/ansible/filter_plugins/tenks.py b/ansible/filter_plugins/tenks.py
index a03b90b..c7fb921 100644
--- a/ansible/filter_plugins/tenks.py
+++ b/ansible/filter_plugins/tenks.py
@@ -70,9 +70,12 @@ def set_libvirt_interfaces(context, node):
     """
     node['interfaces'] = []
     for physnet in node.get('physical_networks', []):
+        # Use macvtap 'passthrough' mode, since this does not filter packets
+        # based on MAC address of the interface.
         node['interfaces'].append(
             {'type': 'direct',
-             'source': {'dev': source_link_name(context, node, physnet)}}
+             'source': {'dev': source_link_name(context, node, physnet),
+                        'mode': 'passthrough'}}
         )
     return node
 
diff --git a/releasenotes/notes/macvtap-passthrough-adfecbce7dcd8474.yaml b/releasenotes/notes/macvtap-passthrough-adfecbce7dcd8474.yaml
new file mode 100644
index 0000000..2e71add
--- /dev/null
+++ b/releasenotes/notes/macvtap-passthrough-adfecbce7dcd8474.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fixes an issue where deployed VMs can't be reached on a different MAC
+    address than the one originally assigned. See `story 2004906
+    <https://storyboard.openstack.org/#!/story/2004906>`__ for details.