diff --git a/internal/dhcp4d/dhcp4d.go b/internal/dhcp4d/dhcp4d.go
index a261c3e..feb2f8a 100644
--- a/internal/dhcp4d/dhcp4d.go
+++ b/internal/dhcp4d/dhcp4d.go
@@ -210,7 +210,7 @@ func (h *Handler) leaseHW(hwAddr string) (*Lease, bool) {
 		return nil, false
 	}
 	l, ok := h.leasesIP[num]
-	return l, ok
+	return l, ok && l.HardwareAddr == hwAddr
 }
 
 // TODO: is ServeDHCP always run from the same goroutine, or do we need locking?
diff --git a/internal/dhcp4d/dhcp4d_test.go b/internal/dhcp4d/dhcp4d_test.go
index 28098e1..517b72d 100644
--- a/internal/dhcp4d/dhcp4d_test.go
+++ b/internal/dhcp4d/dhcp4d_test.go
@@ -403,6 +403,14 @@ func TestRequestExpired(t *testing.T) {
 			t.Errorf("DHCPREQUEST resulted in unexpected message type: got %v, want %v", got, want)
 		}
 	})
+
+	t.Run("mbp requests any", func(t *testing.T) {
+		p := request(addr, hardwareAddr["mbp"])
+		resp := handler.serveDHCP(p, dhcp4.Discover, p.ParseOptions())
+		if got, want := resp.YIAddr().To4(), addr.To4(); bytes.Equal(got, want) {
+			t.Errorf("DHCPOFFER for wrong IP: got offered %v (in use!)", got)
+		}
+	})
 }
 
 func TestServerID(t *testing.T) {