diff --git a/src/networking_vyos/verify.py b/src/networking_vyos/verify.py
index c760d2c..7b111a9 100644
--- a/src/networking_vyos/verify.py
+++ b/src/networking_vyos/verify.py
@@ -14,10 +14,16 @@
     ("set interfaces bridge br70 address", "10.10.70.1/24"),
     ("set interfaces ethernet eth1 vif 10",),
     ("set interfaces ethernet eth1 vif 40",),
-    ("set interfaces ethernet eth2 vif 10",),
-    ("set interfaces ethernet eth2 vif 70",),
+    ("set interfaces ethernet eth3 vif 10",),
+    ("set interfaces ethernet eth3 vif 70",),
+    ("set interfaces bridge br10 member interface eth3.10",),
+    ("set interfaces bridge br40 member interface eth2",),
+    ("set interfaces bridge br70 member interface eth3.70",),
     ("set protocols static route", "0.0.0.0/0", "10.0.0.1"),
     ("set service dhcp-server",),
+    ("set service dhcp-server listen-interface", "br10"),
+    ("set service dhcp-server listen-interface", "br40"),
+    ("set service dhcp-server listen-interface", "br70"),
     ("set container name tailscale environment TS_ROUTES value", "10.10.0.0/16"),
     ("set container name tailscale",),
     ("set container name coredns-glab-lol",),
diff --git a/tests/conftest.py b/tests/conftest.py
index 0a779a6..07740bb 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -16,7 +16,7 @@
         vif 40 {
         }
     }
-    ethernet eth2 {
+    ethernet eth3 {
         vif 10 {
         }
         vif 70 {
@@ -26,12 +26,24 @@
 interfaces {
     bridge br10 {
         address 10.10.10.1/24
+        member {
+            interface eth3.10 {
+            }
+        }
     }
     bridge br40 {
         address 10.10.40.1/24
+        member {
+            interface eth2 {
+            }
+        }
     }
     bridge br70 {
         address 10.10.70.1/24
+        member {
+            interface eth3.70 {
+            }
+        }
     }
 }
 protocols {
@@ -44,6 +56,9 @@
 }
 service {
     dhcp-server {
+        listen-interface br10
+        listen-interface br40
+        listen-interface br70
     }
 }
 container {
diff --git a/tests/test_sync_order.py b/tests/test_sync_order.py
index 2974850..0906ac7 100644
--- a/tests/test_sync_order.py
+++ b/tests/test_sync_order.py
@@ -84,10 +84,16 @@ def test_verify_commands_require_accepted_state_and_reject_retired() -> None:
         "set interfaces bridge br70 address '10.10.70.1/24'",
         "set interfaces ethernet eth1 vif 10",
         "set interfaces ethernet eth1 vif 40",
-        "set interfaces ethernet eth2 vif 10",
-        "set interfaces ethernet eth2 vif 70",
+        "set interfaces ethernet eth3 vif 10",
+        "set interfaces ethernet eth3 vif 70",
+        "set interfaces bridge br10 member interface eth3.10",
+        "set interfaces bridge br40 member interface eth2",
+        "set interfaces bridge br70 member interface eth3.70",
         "set protocols static route 0.0.0.0/0 next-hop 10.0.0.1",
         "set service dhcp-server shared-network-name LAB_MGMT",
+        "set service dhcp-server listen-interface br10",
+        "set service dhcp-server listen-interface br40",
+        "set service dhcp-server listen-interface br70",
         "set container name tailscale environment TS_ROUTES value '10.10.0.0/16'",
         "set container name tailscale image docker.io/tailscale/tailscale:v1.96.5",
         "set container name coredns-glab-lol",
diff --git a/vyos/gw01/config.boot.tmpl b/vyos/gw01/config.boot.tmpl
index 6e0a487..5de0684 100644
--- a/vyos/gw01/config.boot.tmpl
+++ b/vyos/gw01/config.boot.tmpl
@@ -6,15 +6,15 @@
  * Interface mapping:
  *   eth0  SFP+ 1  routed transit 10.0.0.2/30 to rtr01
  *   eth1  SFP+ 2  802.1Q trunk VLANs 10,40 to sw-core01
- *   eth2  Port 2  802.1Q trunk VLANs 10,70 to sw-mgmt01
- *   eth3  Port 1  untagged VLAN 40 to sandbox01
+ *   eth2  Port 2  untagged VLAN 40 to sandbox01
+ *   eth3  Port 1  802.1Q trunk VLANs 10,70 to sw-mgmt01
  *   eth4  Port 3  untagged VLAN 70 to pikvm01
  *   eth5  Port 4  untagged VLAN 70 to kvm01
  *
  * Bridges carry each client VLAN across every port that shares it:
- *   br10 = eth1.10 + eth2.10
- *   br40 = eth1.40 + eth3
- *   br70 = eth2.70 + eth4 + eth5
+ *   br10 = eth1.10 + eth3.10
+ *   br40 = eth1.40 + eth2
+ *   br70 = eth3.70 + eth4 + eth5
  *
  * The renderer replaces the SSH public-key sentinel in memory and appends
  * component metadata captured from the live /config/config.boot. The
@@ -565,7 +565,7 @@ interfaces {
         member {
             interface eth1.10 {
             }
-            interface eth2.10 {
+            interface eth3.10 {
             }
         }
     }
@@ -575,7 +575,7 @@ interfaces {
         member {
             interface eth1.40 {
             }
-            interface eth3 {
+            interface eth2 {
             }
         }
     }
@@ -583,7 +583,7 @@ interfaces {
         address 10.10.70.1/24
         description "LAB_OOB - OOB"
         member {
-            interface eth2.70 {
+            interface eth3.70 {
             }
             interface eth4 {
             }
@@ -617,28 +617,28 @@ interfaces {
         }
     }
     ethernet eth2 {
-        description "TRUNK - sw-mgmt01 VLANs 10,70"
+        description "LAN - sandbox01 untagged VLAN 40"
         offload {
             gro
             gso
             sg
             tso
         }
-        vif 10 {
-            description "LAB_MGMT - Bridge member (br10)"
-        }
-        vif 70 {
-            description "LAB_OOB - Bridge member (br70)"
-        }
     }
     ethernet eth3 {
-        description "LAN - sandbox01 untagged VLAN 40"
+        description "TRUNK - sw-mgmt01 VLANs 10,70"
         offload {
             gro
             gso
             sg
             tso
         }
+        vif 10 {
+            description "LAB_MGMT - Bridge member (br10)"
+        }
+        vif 70 {
+            description "LAB_OOB - Bridge member (br70)"
+        }
     }
     ethernet eth4 {
         description "LAN - pikvm01 untagged VLAN 70"
@@ -695,9 +695,9 @@ protocols {
 }
 service {
     dhcp-server {
-        listen-address 10.10.10.1
-        listen-address 10.10.40.1
-        listen-address 10.10.70.1
+        listen-interface br10
+        listen-interface br40
+        listen-interface br70
         shared-network-name LAB_MGMT {
             subnet 10.10.10.0/24 {
                 lease 86400