diff --git a/Cargo.lock b/Cargo.lock
index f8fad969414..abd8637100a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1585,6 +1585,71 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "netlink-packet-core"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72724faf704479d67b388da142b186f916188505e7e0b26719019c525882eda4"
+dependencies = [
+ "anyhow",
+ "byteorder",
+ "netlink-packet-utils",
+]
+
+[[package]]
+name = "netlink-packet-route"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6de2fe935f44cbdfcab77dce2150d68eda75be715cd42d4d6f52b0bd4dcc5b1"
+dependencies = [
+ "anyhow",
+ "bitflags 1.3.2",
+ "byteorder",
+ "libc",
+ "netlink-packet-core",
+ "netlink-packet-utils",
+]
+
+[[package]]
+name = "netlink-packet-utils"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ede8a08c71ad5a95cdd0e4e52facd37190977039a4704eb82a283f713747d34"
+dependencies = [
+ "anyhow",
+ "byteorder",
+ "paste",
+ "thiserror",
+]
+
+[[package]]
+name = "netlink-proto"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "842c6770fc4bb33dd902f41829c61ef872b8e38de1405aa0b938b27b8fba12c3"
+dependencies = [
+ "bytes",
+ "futures",
+ "log",
+ "netlink-packet-core",
+ "netlink-sys",
+ "thiserror",
+ "tokio",
+]
+
+[[package]]
+name = "netlink-sys"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6471bf08e7ac0135876a9581bf3217ef0333c191c128d34878079f42ee150411"
+dependencies = [
+ "bytes",
+ "futures",
+ "libc",
+ "log",
+ "tokio",
+]
+
 [[package]]
 name = "nix"
 version = "0.22.3"
@@ -1821,6 +1886,7 @@ dependencies = [
  "nix 0.26.2",
  "oak_grpc_utils",
  "prost",
+ "rtnetlink",
  "tar",
  "tokio",
  "tonic",
@@ -2837,6 +2903,24 @@ dependencies = [
  "log",
 ]
 
+[[package]]
+name = "rtnetlink"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6333af2adba73478936174a0ef3edf05fbfa058539c21d567344a53bb6d75cfd"
+dependencies = [
+ "futures",
+ "log",
+ "netlink-packet-core",
+ "netlink-packet-route",
+ "netlink-packet-utils",
+ "netlink-proto",
+ "netlink-sys",
+ "nix 0.26.2",
+ "thiserror",
+ "tokio",
+]
+
 [[package]]
 name = "rust-hypervisor-firmware-virtio"
 version = "0.1.0"
diff --git a/oak_containers_stage1/Cargo.toml b/oak_containers_stage1/Cargo.toml
index b3ad619ae89..efbb2cb8fa4 100644
--- a/oak_containers_stage1/Cargo.toml
+++ b/oak_containers_stage1/Cargo.toml
@@ -14,6 +14,7 @@ clap = { version = "*", features = ["derive"] }
 futures-util = "*"
 nix = "*"
 prost = { workspace = true }
+rtnetlink = "*"
 tar = "*"
 tokio = { version = "*", features = [
   "rt-multi-thread",
diff --git a/oak_containers_stage1/src/main.rs b/oak_containers_stage1/src/main.rs
index b47d6ff65fd..3eabdc801bb 100644
--- a/oak_containers_stage1/src/main.rs
+++ b/oak_containers_stage1/src/main.rs
@@ -22,6 +22,7 @@ mod image;
 use anyhow::Context;
 use clap::Parser;
 use client::LauncherClient;
+use futures_util::TryStreamExt;
 use nix::{
     mount::{mount, umount2, MntFlags, MsFlags},
     unistd::chroot,
@@ -101,5 +102,29 @@ async fn main() -> Result<(), Box<dyn Error>> {
     if !Path::new("/etc/machine-id").exists() {
         fs::write("/etc/machine-id", []).context("error writing placeholder /etc/machine-id")?;
     }
+
+    // Configure eth0 down, as systemd will want to manage it itself and gets confused if it already
+    // has an IP address.
+    {
+        let (connection, handle, _) =
+            rtnetlink::new_connection().context("error opening netlink connection")?;
+        tokio::spawn(connection);
+
+        // `ip link show eth0`
+        let mut links = handle.link().get().match_name("eth0".to_string()).execute();
+
+        if let Some(link) = links.try_next().await? {
+            // `ip link set dev $INDEX down`
+            handle
+                .link()
+                .set(link.header.index)
+                .down()
+                .execute()
+                .await?;
+        } else {
+            println!("warning: eth0 not found");
+        }
+    }
+
     image::switch(&args.init).context("error switching to the system image")?
 }