diff --git a/packages/orchestrator/pkg/sandbox/network/network.go b/packages/orchestrator/pkg/sandbox/network/network.go
index 9c6929237d..5163624462 100644
--- a/packages/orchestrator/pkg/sandbox/network/network.go
+++ b/packages/orchestrator/pkg/sandbox/network/network.go
@@ -214,6 +214,13 @@ func (s *Slot) CreateNetwork(ctx context.Context) (retErr error) {
 		return fmt.Errorf("error creating tap device: %w", err)
 	}
 
+	// Keep resumed guests' cached gateway ARP entries valid. Tap devices are
+	// isolated in per-sandbox network namespaces, so sharing this MAC is safe.
+	err = netlink.LinkSetHardwareAddr(tap, tapHostHardwareAddr)
+	if err != nil {
+		return fmt.Errorf("error setting tap device hardware address: %w", err)
+	}
+
 	err = netlink.LinkSetUp(tap)
 	if err != nil {
 		return fmt.Errorf("error setting tap device up: %w", err)
diff --git a/packages/orchestrator/pkg/sandbox/network/slot.go b/packages/orchestrator/pkg/sandbox/network/slot.go
index 35c90ea165..29e523e622 100644
--- a/packages/orchestrator/pkg/sandbox/network/slot.go
+++ b/packages/orchestrator/pkg/sandbox/network/slot.go
@@ -35,12 +35,14 @@ const (
 	tapInterfaceName = "tap0"
 	tapIp            = "169.254.0.22"
 	tapMAC           = "02:FC:00:00:00:05"
+	tapHostMAC       = "02:FC:00:00:00:06"
 )
 
 var (
-	hostNetworkCIDR = getHostNetworkCIDR()
-	vrtNetworkCIDR  = getVrtNetworkCIDR()
-	vrtSlotsSize    = GetVrtSlotsSize()
+	hostNetworkCIDR     = getHostNetworkCIDR()
+	vrtNetworkCIDR      = getVrtNetworkCIDR()
+	vrtSlotsSize        = GetVrtSlotsSize()
+	tapHostHardwareAddr = getTapHostHardwareAddr()
 )
 
 // Slot network allocation
@@ -390,6 +392,18 @@ func getHostNetworkCIDR() *net.IPNet {
 	return subnet
 }
 
+// getTapHostHardwareAddr parses the fixed tapHostMAC constant once at package
+// init, so CreateNetwork doesn't reparse a value that can never change or
+// fail at runtime.
+func getTapHostHardwareAddr() net.HardwareAddr {
+	addr, err := net.ParseMAC(tapHostMAC)
+	if err != nil {
+		log.Fatalf("Failed to parse tap host MAC address %s: %v", tapHostMAC, err)
+	}
+
+	return addr
+}
+
 func getVrtNetworkCIDR() *net.IPNet {
 	cidr := env.GetEnv("SANDBOXES_VRT_NETWORK_CIDR", defaultVrtNetworkCIDR)