diff --git a/src/udev/net/link-config.c b/src/udev/net/link-config.c
index 4d7293fd7d..75c2aec491 100644
--- a/src/udev/net/link-config.c
+++ b/src/udev/net/link-config.c
@@ -328,7 +328,11 @@ static int get_mac(sd_device *device, MACAddressPolicy policy, struct ether_addr
 
         if (want_random) {
                 log_device_debug(device, "Using random bytes to generate MAC");
-                random_bytes(mac->ether_addr_octet, ETH_ALEN);
+
+                /* We require genuine randomness here, since we want to make sure we won't collide with other
+                 * systems booting up at the very same time. We do allow RDRAND however, since this is not
+                 * cryptographic key material. */
+                genuine_random_bytes(mac->ether_addr_octet, ETH_ALEN, RANDOM_ALLOW_RDRAND);
         } else {
                 uint64_t result;