diff --git a/scripts/build-usb.sh b/scripts/build-usb.sh
index 7835783..b69b627 100755
--- a/scripts/build-usb.sh
+++ b/scripts/build-usb.sh
@@ -30,6 +30,8 @@
 #   --skip-bios         do not copy bios-staging/
 #   --skip-drivers      do not copy drivers-staging/
 #   --skip-boot-tools   do not copy boot-tools/
+#   --site-vars FILE    put FILE on CIDATA as playbook/site-vars.yml (the
+#                       per-site NIC MACs; see playbook/site-vars.example.yml)
 #   --yes               do not ask for confirmation (device mode still asks
 #                       YES for a non-removable device)
 #
@@ -46,7 +48,7 @@ usage() {
     echo "Usage: sudo $0 [options] /dev/sdX /path/to/ubuntu-24.04.iso [/path/to/winpe-images]"
     echo "       $0 [options] --image out.img SIZE|auto /path/to/ubuntu-24.04.iso [/path/to/winpe-images]"
     echo ""
-    echo "  Options: --payload-root DIR, --skip-enrollment, --skip-bios,"
+    echo "  Options: --payload-root DIR, --site-vars FILE, --skip-enrollment, --skip-bios,"
     echo "           --skip-drivers, --skip-boot-tools, --yes"
     echo ""
     echo "  The optional last argument is the path to WinPE deployment content"
@@ -67,6 +69,7 @@ SKIP_BIOS=0
 SKIP_DRIVERS=0
 SKIP_BOOT_TOOLS=0
 ASSUME_YES=0
+SITE_VARS=""
 POSITIONAL=()
 while [ $# -gt 0 ]; do
     case "$1" in
@@ -76,6 +79,9 @@ while [ $# -gt 0 ]; do
         --payload-root)
             [ $# -ge 2 ] || { usage; exit 1; }
             PAYLOAD_ROOT="$(cd "$2" && pwd)"; shift 2 ;;
+        --site-vars)
+            [ $# -ge 2 ] || { usage; exit 1; }
+            SITE_VARS="$2"; shift 2 ;;
         --skip-enrollment) SKIP_ENROLLMENT=1; shift ;;
         --skip-bios) SKIP_BIOS=1; shift ;;
         --skip-drivers) SKIP_DRIVERS=1; shift ;;
@@ -164,6 +170,11 @@ else
     fi
 fi
 
+if [ -n "$SITE_VARS" ] && [ ! -f "$SITE_VARS" ]; then
+    echo "ERROR: --site-vars file not found: $SITE_VARS"
+    exit 1
+fi
+
 # Verify required source files exist
 for f in "$AUTOINSTALL_DIR/user-data" "$AUTOINSTALL_DIR/meta-data" "$PLAYBOOK_DIR/pxe_server_setup.yml"; do
     if [ ! -f "$f" ]; then
@@ -490,6 +501,16 @@ echo "    Copied $DEB_COUNT .deb packages to packages/"
 # Copy playbook directory
 t_cp "" "$PLAYBOOK_DIR"
 echo "    Copied playbook/"
+if [ -n "$SITE_VARS" ]; then
+    mkdir -p "$WORK/sv"
+    cp "$SITE_VARS" "$WORK/sv/site-vars.yml"
+    t_cp playbook "$WORK/sv/site-vars.yml"
+    rm -rf "$WORK/sv"
+    echo "    Copied $SITE_VARS as playbook/site-vars.yml"
+elif [ ! -f "$PLAYBOOK_DIR/site-vars.yml" ]; then
+    echo "    WARNING: no playbook/site-vars.yml (and no --site-vars): the playbook"
+    echo "             stops until pxe_nic_mac / corp_nic_mac are set on the server."
+fi
 
 # Copy the whole webapp tree (app.py imports config, services/, views/;
 # the Blancco evidence timer runs blancco_evidence_monthly.py), minus caches.
diff --git a/tests/vm/README.md b/tests/vm/README.md
index e1bed7c..787f902 100644
--- a/tests/vm/README.md
+++ b/tests/vm/README.md
@@ -16,10 +16,16 @@ NIC MACs (fixed):
 
 | VM     | NIC     | MAC                 | Network           | Playbook var      |
 |--------|---------|---------------------|-------------------|-------------------|
-| server | GE      | `52:54:00:9e:10:01` | `default` NAT     | `pxe_ge_mac` / corp_nic_mac |
-| server | imaging | `52:54:00:9e:10:02` | `pxetest-imaging` | `pxe_imaging_mac` / pxe_nic_mac |
+| server | GE      | `52:54:00:9e:10:01` | `default` NAT     | `corp_nic_mac`    |
+| server | imaging | `52:54:00:9e:10:02` | `pxetest-imaging` | `pxe_nic_mac`     |
 | client | -       | `52:54:00:9e:10:03` | `pxetest-imaging` | -                 |
 
+`build-image.sh` writes `$PXETEST_CACHE/site-vars.yml` with these two
+MACs (`pxe_nic_mac`, `corp_nic_mac`) and passes it to `build-usb.sh
+--site-vars`, so it lands on CIDATA as `playbook/site-vars.yml`. The
+installer brings both NICs up with DHCP; the playbook renames them to
+pxe0 / corp0 and pins pxe0 to 172.16.9.1.
+
 The disk boots before the USB on purpose: a blank disk falls through to
 the installer, and after the install the server boots its disk instead of
 re-running autoinstall. CIDATA stays attached for the first-boot playbook.
diff --git a/tests/vm/build-image.sh b/tests/vm/build-image.sh
index 10bc5a8..f4a0384 100755
--- a/tests/vm/build-image.sh
+++ b/tests/vm/build-image.sh
@@ -41,7 +41,18 @@ if [ -e "$USB_IMAGE" ] && [ ! -f "$USB_IMAGE" ]; then
     die "$USB_IMAGE is not a regular file"
 fi
 
+# Site vars for the VM "site": pin the NICs by the fixed MACs from common.sh.
+SITE_VARS="$PXETEST_CACHE/site-vars.yml"
+cat >"$SITE_VARS" <<YML
+---
+# Generated by tests/vm/build-image.sh for the pxetest VMs.
+pxe_nic_mac: "$SERVER_IMAGING_MAC"    # pxetest-imaging (isolated)
+corp_nic_mac: "$SERVER_GE_MAC"   # libvirt default NAT ("GE/corp")
+YML
+log "site vars: pxe_nic_mac=$SERVER_IMAGING_MAC corp_nic_mac=$SERVER_GE_MAC"
+
 "$REPO_ROOT/scripts/build-usb.sh" --yes --payload-root "$PXETEST_PAYLOAD_ROOT" \
+    --site-vars "$SITE_VARS" \
     "${ARGS[@]}" --image "$USB_IMAGE" "$SIZE" "$UBUNTU_ISO"
 
 BYTES=$(stat -c%s "$USB_IMAGE")
diff --git a/tests/vm/create.sh b/tests/vm/create.sh
index 991a069..9742528 100755
--- a/tests/vm/create.sh
+++ b/tests/vm/create.sh
@@ -168,5 +168,5 @@ for vm in "$SERVER_VM" "$CLIENT_VM"; do
     done < <(virsh domiflist "$vm" | tail -n +3 | grep -v '^$')
 done
 log "ready. Playbook NIC pins for this site:"
-log "    pxe_imaging_mac: \"$SERVER_IMAGING_MAC\"   (pxe_nic_mac)"
-log "    pxe_ge_mac:      \"$SERVER_GE_MAC\"   (corp_nic_mac)"
+log "    pxe_nic_mac:  \"$SERVER_IMAGING_MAC\""
+log "    corp_nic_mac: \"$SERVER_GE_MAC\""