diff --git a/cloudconfig/cloudinit/cloudinit.go b/cloudconfig/cloudinit/cloudinit.go
index e67ffa256002..9b9d8a68da4e 100644
--- a/cloudconfig/cloudinit/cloudinit.go
+++ b/cloudconfig/cloudinit/cloudinit.go
@@ -82,15 +82,15 @@ type cloudConfig struct {
 	// update_hostname
 	attrs map[string]interface{}
 
-	// omitNetplanHWAddrMatch if true, causes Netplan to be rendered without
+	// useNetplanHWAddrMatch if false, causes Netplan to be rendered without
 	// a stanza that matches by MAC address in order to apply configuration to
 	// a device.
-	// This will be recruited for LXD, where we have observed 22.04 containers
-	// being assigned a different MAC to the one configured.
+	// This will be disabled for LXD containers, where we have observed 22.04
+	// containers being assigned a different MAC to the one configured.
 	// For these cases we fall back to the default match by ID (name).
 	// MAC address matching is still required by KVM where devices are assigned
 	// different names by the kernel to those we configured.
-	omitNetplanHWAddrMatch bool
+	useNetplanHWAddrMatch bool
 }
 
 // getPackagingConfigurer is defined on the AdvancedPackagingConfig interface.
diff --git a/cloudconfig/cloudinit/interface.go b/cloudconfig/cloudinit/interface.go
index 32f5aae6f6a9..ca81665b8cb4 100644
--- a/cloudconfig/cloudinit/interface.go
+++ b/cloudconfig/cloudinit/interface.go
@@ -408,8 +408,13 @@ type NetworkingConfig interface {
 	AddNetworkConfig(interfaces corenetwork.InterfaceInfos) error
 }
 
-func WithDisableNetplanMACMatch(cfg *cloudConfig) {
-	cfg.omitNetplanHWAddrMatch = true
+// WithNetplanMACMatch returns a cloud config option for telling Netplan
+// whether to match by MAC address (true) or the interface name (false) when
+// configuring NICs.
+func WithNetplanMACMatch(enabled bool) func(*cloudConfig) {
+	return func(cfg *cloudConfig) {
+		cfg.useNetplanHWAddrMatch = enabled
+	}
 }
 
 // New returns a new Config with no options set.
diff --git a/cloudconfig/cloudinit/interface_test.go b/cloudconfig/cloudinit/interface_test.go
index 3981dd0342fe..2b5a6b45c887 100644
--- a/cloudconfig/cloudinit/interface_test.go
+++ b/cloudconfig/cloudinit/interface_test.go
@@ -17,7 +17,7 @@ type InterfaceSuite struct{}
 var _ = gc.Suite(InterfaceSuite{})
 
 func (HelperSuite) TestNewCloudConfigWithoutMACMatch(c *gc.C) {
-	cfg, err := New("ubuntu", WithDisableNetplanMACMatch)
+	cfg, err := New("ubuntu", WithNetplanMACMatch(true))
 	c.Assert(err, jc.ErrorIsNil)
-	c.Check(cfg.(*ubuntuCloudConfig).omitNetplanHWAddrMatch, jc.IsTrue)
+	c.Check(cfg.(*ubuntuCloudConfig).useNetplanHWAddrMatch, jc.IsTrue)
 }
diff --git a/cloudconfig/cloudinit/network_ubuntu.go b/cloudconfig/cloudinit/network_ubuntu.go
index 3f5a423be211..6dbbd6ff6203 100644
--- a/cloudconfig/cloudinit/network_ubuntu.go
+++ b/cloudconfig/cloudinit/network_ubuntu.go
@@ -204,6 +204,7 @@ func GenerateNetplan(interfaces corenetwork.InterfaceInfos, matchHWAddr bool) (s
 	if err != nil {
 		return "", errors.Trace(err)
 	}
+
 	return string(out), nil
 }
 
@@ -320,7 +321,7 @@ func (cfg *ubuntuCloudConfig) AddNetworkConfig(interfaces corenetwork.InterfaceI
 		if err != nil {
 			return errors.Trace(err)
 		}
-		netPlan, err := GenerateNetplan(interfaces, !cfg.omitNetplanHWAddrMatch)
+		netPlan, err := GenerateNetplan(interfaces, cfg.useNetplanHWAddrMatch)
 		if err != nil {
 			return errors.Trace(err)
 		}
diff --git a/cloudconfig/cloudinit/network_ubuntu_test.go b/cloudconfig/cloudinit/network_ubuntu_test.go
index 37c352834c90..116f46b91a4d 100644
--- a/cloudconfig/cloudinit/network_ubuntu_test.go
+++ b/cloudconfig/cloudinit/network_ubuntu_test.go
@@ -409,7 +409,7 @@ network:
 
 func (s *NetworkUbuntuSuite) TestAddNetworkConfigSampleConfig(c *gc.C) {
 	netConfig := container.BridgeNetworkConfig(0, s.fakeInterfaces)
-	cloudConf, err := cloudinit.New("ubuntu")
+	cloudConf, err := cloudinit.New("ubuntu", cloudinit.WithNetplanMACMatch(true))
 	c.Assert(err, jc.ErrorIsNil)
 	c.Assert(cloudConf, gc.NotNil)
 	err = cloudConf.AddNetworkConfig(netConfig.Interfaces)
diff --git a/container/kvm/kvm.go b/container/kvm/kvm.go
index 8435ec42613a..8352a8827c46 100644
--- a/container/kvm/kvm.go
+++ b/container/kvm/kvm.go
@@ -186,7 +186,8 @@ func (manager *containerManager) CreateContainer(
 	hc = &instance.HardwareCharacteristics{AvailabilityZone: &manager.availabilityZone}
 
 	// Create the cloud-init.
-	cloudConfig, err := cloudinit.New(instanceConfig.Base.OS)
+	// Netplan configures NICs by matching MAC addresses.
+	cloudConfig, err := cloudinit.New(instanceConfig.Base.OS, cloudinit.WithNetplanMACMatch(true))
 	if err != nil {
 		return nil, nil, errors.Trace(err)
 	}
diff --git a/container/lxd/manager.go b/container/lxd/manager.go
index 560757d8e0a9..6eaa92273427 100644
--- a/container/lxd/manager.go
+++ b/container/lxd/manager.go
@@ -271,7 +271,9 @@ func (m *containerManager) getContainerSpec(
 		networkConfig.Interfaces = interfaces
 	}
 
-	cloudConfig, err := cloudinit.New(instanceConfig.Base.OS, cloudinit.WithDisableNetplanMACMatch)
+	// We tell Netplan to match by interface name for containers; by MAC for VMs.
+	cloudConfig, err := cloudinit.New(
+		instanceConfig.Base.OS, cloudinit.WithNetplanMACMatch(virtType == api.InstanceTypeVM))
 	if err != nil {
 		return ContainerSpec{}, errors.Trace(err)
 	}