diff --git a/modules/clan/gw-router/default.nix b/modules/clan/gw-router/default.nix
index c652e63..beeaca3 100644
--- a/modules/clan/gw-router/default.nix
+++ b/modules/clan/gw-router/default.nix
@@ -7,7 +7,7 @@
   manifest.categories = [ "System" ];
 
   roles.default = {
-    description = "A default role for the router node";
+    description = "Site gateway router role";
 
     interface =
       { lib, config, ... }:
@@ -28,6 +28,24 @@
                 VLANs — this tag exists only on the WAN port.
               '';
             };
+
+            macAddress = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              example = "aa:bb:cc:dd:ee:ff";
+              description = ''
+                Spoofed MAC for the WAN port, e.g. to keep the MAC the ISP has
+                pinned (cloned from the old router). null keeps the hardware MAC.
+              '';
+            };
+
+            pppInterface = lib.mkOption {
+              type = lib.types.str;
+              internal = true;
+              readOnly = true;
+              default = if config.wan.vlanId == null then config.wan.interface else "wan-vlan";
+              description = "Interface pppd dials on (the WAN port or its ISP VLAN).";
+            };
           };
         };
       };