diff --git a/userspace/eval/rootfs-export.sh b/userspace/eval/rootfs-export.sh
index cab16e7..4a2a16c 100755
--- a/userspace/eval/rootfs-export.sh
+++ b/userspace/eval/rootfs-export.sh
@@ -46,4 +46,4 @@ echo "Modified files: $(wc -l < "$EXPORT_DIR/modified-files.txt")"
 echo "New files:      $(wc -l < "$EXPORT_DIR/new-files.txt")"
 echo ""
 echo "Retrieve with:"
-echo "  scp -r comma@192.168.7.1:$EXPORT_DIR ."
+echo "  scp -r comma@comma-<serial>.local:$EXPORT_DIR ."
diff --git a/userspace/eval/rootfs-pull.sh b/userspace/eval/rootfs-pull.sh
index 53e3d3c..2076fe8 100755
--- a/userspace/eval/rootfs-pull.sh
+++ b/userspace/eval/rootfs-pull.sh
@@ -2,9 +2,15 @@
 # Pull rootfs changes from device to host
 set -e
 
-DEVICE="${1:-192.168.7.1}"
+DEVICE="${1:-}"
 USER="${2:-comma}"
 
+if [ -z "$DEVICE" ]; then
+    echo "Usage: $0 <device-host-or-ip> [user]"
+    echo "Example: $0 comma-<serial>.local"
+    exit 1
+fi
+
 echo "Connecting to $USER@$DEVICE..."
 
 # Find most recent export
diff --git a/userspace/root/etc/NetworkManager/conf.d/10-globally-managed-devices.conf b/userspace/root/etc/NetworkManager/conf.d/10-globally-managed-devices.conf
index 970ba08..dac29c5 100644
--- a/userspace/root/etc/NetworkManager/conf.d/10-globally-managed-devices.conf
+++ b/userspace/root/etc/NetworkManager/conf.d/10-globally-managed-devices.conf
@@ -1,2 +1,2 @@
 [keyfile]
-unmanaged-devices=none
+unmanaged-devices=interface-name:usb0
diff --git a/userspace/root/etc/dnsmasq.d/usb0.conf b/userspace/root/etc/dnsmasq.d/usb0.conf
deleted file mode 100644
index abc2b4d..0000000
--- a/userspace/root/etc/dnsmasq.d/usb0.conf
+++ /dev/null
@@ -1,9 +0,0 @@
-interface=usb0
-bind-interfaces
-dhcp-range=192.168.42.10,192.168.42.50,255.255.255.0,12h
-# Don't advertise a default gateway — prevents the host from routing
-# all traffic over USB and losing internet connectivity
-dhcp-option=3
-# Don't advertise DNS servers — prevents the host from sending DNS
-# queries over USB instead of its existing network
-dhcp-option=6
diff --git a/userspace/root/etc/sv/dnsmasq/run b/userspace/root/etc/sv/dnsmasq/run
index 8c96752..7a27e95 100755
--- a/userspace/root/etc/sv/dnsmasq/run
+++ b/userspace/root/etc/sv/dnsmasq/run
@@ -1,4 +1,12 @@
 #!/bin/sh
 exec 2>&1
+
+CONFIG="/run/dnsmasq-usb0.conf"
+
 mkdir -p /var/lib/misc
-exec dnsmasq --keep-in-foreground --conf-dir=/etc/dnsmasq.d
+
+while [ ! -f "$CONFIG" ]; do
+  sleep 1
+done
+
+exec dnsmasq --keep-in-foreground --conf-file="$CONFIG"
diff --git a/userspace/root/usr/comma/set_ncm.sh b/userspace/root/usr/comma/set_ncm.sh
index e82fdbc..c0c3afb 100755
--- a/userspace/root/usr/comma/set_ncm.sh
+++ b/userspace/root/usr/comma/set_ncm.sh
@@ -4,9 +4,13 @@
 
 GADGET=/config/usb_gadget/g1
 USB_IF="usb0"
-USB_ADDR="192.168.42.2/24"
+USB_DNSMASQ_CONF="/run/dnsmasq-usb0.conf"
 UDC_NAME="a600000.usb"
 NCM_PARAM="/data/params/d/UsbNcmEnabled"
+USB_SERIAL=""
+USB_SUBNET=""
+USB_DEVICE_ADDR=""
+USB_HOST_ADDR=""
 
 ensure_configfs() {
   if ! mountpoint -q /config; then
@@ -29,7 +33,7 @@ ensure_gadget_base() {
   echo 250 > configs/c.1/MaxPower
 
   local serial model
-  serial="$(sed -n 's/.*androidboot.serialno=\([^ ]*\).*/\1/p' /proc/cmdline)"
+  serial="$(get_usb_serial)"
   model="$(tr -d '\0' < /sys/firmware/devicetree/base/model 2>/dev/null || true)"
 
   echo "$serial" > strings/0x409/serialnumber
@@ -38,6 +42,37 @@ ensure_gadget_base() {
   echo "NCM" > configs/c.1/strings/0x409/configuration
 }
 
+get_usb_serial() {
+  if [ -n "$USB_SERIAL" ]; then
+    echo "$USB_SERIAL"
+    return 0
+  fi
+
+  USB_SERIAL="$(sed -n 's/.*androidboot.serialno=\([^ ]*\).*/\1/p' /proc/cmdline)"
+  if [ -z "$USB_SERIAL" ]; then
+    USB_SERIAL="$(hostname)"
+  fi
+
+  echo "$USB_SERIAL"
+}
+
+derive_usb_network() {
+  if [ -n "$USB_SUBNET" ] && [ -n "$USB_DEVICE_ADDR" ] && [ -n "$USB_HOST_ADDR" ]; then
+    return 0
+  fi
+
+  local serial hash subnet_id octet2 octet3
+  serial="$(get_usb_serial)"
+  hash="$(printf '%s' "$serial" | cksum | awk '{print $1}')"
+  subnet_id=$((hash % 4096))
+  octet2=$((16 + (subnet_id / 256)))
+  octet3=$((subnet_id % 256))
+
+  USB_SUBNET="172.${octet2}.${octet3}"
+  USB_DEVICE_ADDR="${USB_SUBNET}.1/24"
+  USB_HOST_ADDR="${USB_SUBNET}.2"
+}
+
 unbind_gadget() {
   cd "$GADGET" || return 1
   echo "" > UDC 2>/dev/null || true
@@ -56,15 +91,36 @@ wait_for_usb_if() {
   return 1
 }
 
+reset_usb_if() {
+  dhcpcd -x "$USB_IF" >/dev/null 2>&1 || true
+  ip -4 addr flush dev "$USB_IF" 2>/dev/null || true
+}
+
+write_dnsmasq_conf() {
+  derive_usb_network
+  mkdir -p /run
+
+  cat > "$USB_DNSMASQ_CONF" <<EOF
+port=0
+interface=${USB_IF}
+bind-interfaces
+dhcp-authoritative
+dhcp-range=${USB_HOST_ADDR},${USB_HOST_ADDR},255.255.255.0,12h
+# Don't advertise a default gateway or DNS server over USB.
+dhcp-option=3
+dhcp-option=6
+EOF
+}
+
 configure_usb_if() {
+  derive_usb_network
   ip link set "$USB_IF" up
-
-  if ! ip addr show dev "$USB_IF" | grep -q "$USB_ADDR"; then
-    ip addr show dev "$USB_IF" | awk '/192\.168\.42\./ {print $2}' | while read -r cidr; do
-      ip addr del "$cidr" dev "$USB_IF" 2>/dev/null || true
-    done
-    ip addr add "$USB_ADDR" dev "$USB_IF"
-  fi
+  reset_usb_if
+  ip addr add "$USB_DEVICE_ADDR" dev "$USB_IF"
+  write_dnsmasq_conf
+  sv down dnsmasq 2>/dev/null || true
+  sv up dnsmasq
+  echo "Configured ${USB_IF}: device=${USB_DEVICE_ADDR%/*} host=${USB_HOST_ADDR} subnet=${USB_SUBNET}.0/24"
 }
 
 enable_ncm() {
@@ -84,21 +140,22 @@ enable_ncm() {
     echo "WARNING: $USB_IF not present yet."
   fi
 
-  sv up dnsmasq
 }
 
 disable_ncm() {
   ensure_gadget_base
   cd "$GADGET" || exit 1
 
-  sv down dnsmasq
-
-  unbind_gadget
-  rm -f configs/c.1/f1 2>/dev/null || true
+  sv down dnsmasq 2>/dev/null || true
+  rm -f "$USB_DNSMASQ_CONF"
 
   if ip link show "$USB_IF" >/dev/null 2>&1; then
+    reset_usb_if
     ip link set "$USB_IF" down 2>/dev/null || true
   fi
+
+  unbind_gadget
+  rm -f configs/c.1/f1 2>/dev/null || true
 }
 
 if [ -f "$NCM_PARAM" ] && [ "$(< "$NCM_PARAM")" = "1" ]; then