diff --git a/libnm-core/nm-setting-bridge.c b/libnm-core/nm-setting-bridge.c
index c9cd01389..f168b5097 100644
--- a/libnm-core/nm-setting-bridge.c
+++ b/libnm-core/nm-setting-bridge.c
@@ -392,8 +392,13 @@ nm_setting_bridge_class_init (NMSettingBridgeClass *setting_class)
 	 * NMSettingBridge:mac-address:
 	 *
 	 * If specified, the MAC address of bridge. When creating a new bridge, this
-	 * MAC address will be set. When matching an existing (outside
-	 * NetworkManager created) bridge, this MAC address must match.
+	 * MAC address will be set.
+	 *
+	 * If this field is left unspecified, the "ethernet.cloned-mac-address" is
+	 * referred instead to generate the initial MAC address. Note that setting
+	 * "ethernet.cloned-mac-address" anyway overwrites the MAC address of
+	 * the bridge later while activating the bridge. Hence, this property
+	 * is deprecated.
 	 **/
 	/* ---keyfile---
 	 * property: mac-address
diff --git a/src/devices/nm-device-bridge.c b/src/devices/nm-device-bridge.c
index 90950fdfc..cdbc9e4bf 100644
--- a/src/devices/nm-device-bridge.c
+++ b/src/devices/nm-device-bridge.c
@@ -433,20 +433,32 @@ create_and_realize (NMDevice *device,
 	NMSettingBridge *s_bridge;
 	const char *iface = nm_device_get_iface (device);
 	const char *hwaddr;
+	gs_free char *hwaddr_cloned = NULL;
 	guint8 mac_address[NM_UTILS_HWADDR_LEN_MAX];
 	NMPlatformError plerr;
 
-	g_assert (iface);
+	nm_assert (iface);
 
 	s_bridge = nm_connection_get_setting_bridge (connection);
-	g_assert (s_bridge);
+	nm_assert (s_bridge);
+
 	hwaddr = nm_setting_bridge_get_mac_address (s_bridge);
+	if (   !hwaddr
+	    && nm_device_hw_addr_get_cloned (device, connection, FALSE,
+	                                     &hwaddr_cloned, NULL, NULL)) {
+		/* The cloned MAC address might by dynamic, for example with stable-id="${RANDOM}".
+		 * It's a bit odd that we first create the device with one dynamic address,
+		 * and later on may reset it to another. That is, because we don't cache
+		 * the dynamic address in @device, like we do during nm_device_hw_addr_set_cloned(). */
+		hwaddr = hwaddr_cloned;
+	}
+
 	if (hwaddr) {
 		if (!nm_utils_hwaddr_aton (hwaddr, mac_address, ETH_ALEN)) {
 			g_set_error (error, NM_DEVICE_ERROR, NM_DEVICE_ERROR_FAILED,
 			             "Invalid hardware address '%s'",
 			             hwaddr);
-			return FALSE;
+			g_return_val_if_reached (FALSE);
 		}
 	}