diff --git a/nix/lib/config/legacy.nix b/nix/lib/config/legacy.nix
index 1b12a8d..479c7dc 100644
--- a/nix/lib/config/legacy.nix
+++ b/nix/lib/config/legacy.nix
@@ -10,6 +10,12 @@ let
       then result // { "${to}" = attrset.${name}; }
       else result // { "${name}" = attrset.${name}; }
     ) {} (builtins.attrNames attrset);
+
+  # HACK: `type = "phys"` works but once an LXC container is stopped
+  # the VLAN interface is not moved back.
+  forceVeth = interface: interface // {
+    type = "veth";
+  };
 in
 {
   options.salt-pillar = lib.mkOption {};
@@ -50,8 +56,9 @@ in
         role = "container";
         location = mainServer;
         interfaces =
-          builtins.mapAttrs (_:
+          builtins.mapAttrs (_: interface:
             renameAttr "gw" "gw4"
+              (forceVeth interface)
           ) container.interfaces;
         ospf =
           let