diff --git a/doc/source/command-objects/port.rst b/doc/source/command-objects/port.rst
index 5080addb6..98642b9a3 100644
--- a/doc/source/command-objects/port.rst
+++ b/doc/source/command-objects/port.rst
@@ -219,6 +219,7 @@ Set port properties
         [--host <host-id>]
         [--enable | --disable]
         [--name <name>]
+        [--mac-address <mac-address>]
         [--security-group <security-group>]
         [--no-security-group]
         [--enable-port-security | --disable-port-security]
@@ -285,6 +286,10 @@ Set port properties
 
     Set port name
 
+.. option:: --mac-address
+
+    Set port's MAC address (admin only)
+
 .. option:: --security-group <security-group>
 
     Security group to associate with this port (name or ID)
diff --git a/openstackclient/network/v2/port.py b/openstackclient/network/v2/port.py
index 6117175e9..eced93cee 100644
--- a/openstackclient/network/v2/port.py
+++ b/openstackclient/network/v2/port.py
@@ -130,6 +130,8 @@ def _get_attrs(client_manager, parsed_args):
         attrs['binding:vnic_type'] = parsed_args.vnic_type
     if parsed_args.host:
         attrs['binding:host_id'] = parsed_args.host
+    if parsed_args.mac_address is not None:
+        attrs['mac_address'] = parsed_args.mac_address
 
     if parsed_args.dns_name is not None:
         attrs['dns_name'] = parsed_args.dns_name
@@ -138,8 +140,6 @@ def _get_attrs(client_manager, parsed_args):
         attrs['name'] = str(parsed_args.name)
     # The remaining options do not support 'port set' command, so they require
     # additional check
-    if 'mac_address' in parsed_args and parsed_args.mac_address is not None:
-        attrs['mac_address'] = parsed_args.mac_address
     if 'network' in parsed_args and parsed_args.network is not None:
         attrs['network_id'] = parsed_args.network
     if 'project' in parsed_args and parsed_args.project is not None:
@@ -234,6 +234,11 @@ def _add_updatable_args(parser):
         metavar='<device-id>',
         help=argparse.SUPPRESS,
     )
+    parser.add_argument(
+        '--mac-address',
+        metavar='<mac-address>',
+        help=_("MAC address of this port (admin only)")
+    )
     parser.add_argument(
         '--device-owner',
         metavar='<device-owner>',
@@ -324,11 +329,6 @@ class CreatePort(command.ShowOne):
             action='store_true',
             help=_("Disable port")
         )
-        parser.add_argument(
-            '--mac-address',
-            metavar='<mac-address>',
-            help=_("MAC address of this port")
-        )
         parser.add_argument(
             '--project',
             metavar='<project>',
diff --git a/openstackclient/tests/functional/network/v2/test_port.py b/openstackclient/tests/functional/network/v2/test_port.py
index 78c572730..bd5eefa5b 100644
--- a/openstackclient/tests/functional/network/v2/test_port.py
+++ b/openstackclient/tests/functional/network/v2/test_port.py
@@ -147,3 +147,22 @@ class PortTests(base.TestCase):
             'port show -f json ' + self.NAME
         ))
         self.assertEqual('', json_output.get('security_group_ids'))
+
+    def test_port_admin_set(self):
+        """Test create, set (as admin), show, delete"""
+        json_output = json.loads(self.openstack(
+            'port create -f json ' +
+            '--network ' + self.NETWORK_NAME + ' ' + self.NAME
+        ))
+        id_ = json_output.get('id')
+        self.addCleanup(self.openstack, 'port delete ' + id_)
+
+        raw_output = self.openstack(
+            '--os-username admin '
+            + 'port set --mac-address 11:22:33:44:55:66 '
+            + self.NAME)
+        self.assertOutput('', raw_output)
+        json_output = json.loads(self.openstack(
+            'port show -f json ' + self.NAME
+        ))
+        self.assertEqual(json_output.get('mac_address'), '11:22:33:44:55:66')
diff --git a/openstackclient/tests/unit/network/v2/test_port.py b/openstackclient/tests/unit/network/v2/test_port.py
index 80eba3a87..d2df5841f 100644
--- a/openstackclient/tests/unit/network/v2/test_port.py
+++ b/openstackclient/tests/unit/network/v2/test_port.py
@@ -987,6 +987,25 @@ class TestSetPort(TestPort):
         self.network.update_port.assert_called_once_with(_testport, **attrs)
         self.assertIsNone(result)
 
+    def test_overwrite_mac_address(self):
+        _testport = network_fakes.FakePort.create_one_port(
+            {'mac_address': '11:22:33:44:55:66'})
+        self.network.find_port = mock.Mock(return_value=_testport)
+        arglist = [
+            '--mac-address', '66:55:44:33:22:11',
+            _testport.name,
+        ]
+        verifylist = [
+            ('mac_address', '66:55:44:33:22:11'),
+        ]
+        parsed_args = self.check_parser(self.cmd, arglist, verifylist)
+        result = self.cmd.take_action(parsed_args)
+        attrs = {
+            'mac_address': '66:55:44:33:22:11',
+        }
+        self.network.update_port.assert_called_once_with(_testport, **attrs)
+        self.assertIsNone(result)
+
     def test_set_this(self):
         arglist = [
             '--disable',
diff --git a/releasenotes/notes/bug-1670707-c4799fbed39ef75b.yaml b/releasenotes/notes/bug-1670707-c4799fbed39ef75b.yaml
new file mode 100644
index 000000000..3509ca205
--- /dev/null
+++ b/releasenotes/notes/bug-1670707-c4799fbed39ef75b.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Add ``--mac-address`` option to ``port set`` command.
+    [Bug `1670707 <https://launchpad.net/bugs/1670707>`_]