diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c
index e361ff5d3a..a39aec16fb 100644
--- a/src/core/devices/nm-device.c
+++ b/src/core/devices/nm-device.c
@@ -191,6 +191,7 @@ typedef enum {
 
 G_STATIC_ASSERT(NM_L3CFG_CONFIG_PRIORITY_IPV4LL == L3_CONFIG_DATA_TYPE_LL_4);
 G_STATIC_ASSERT(NM_L3CFG_CONFIG_PRIORITY_IPV6LL == L3_CONFIG_DATA_TYPE_LL_6);
+G_STATIC_ASSERT(NM_L3CFG_CONFIG_PRIORITY_VPN == L3_CONFIG_DATA_TYPE_DEVIP_6);
 
 typedef enum {
     HW_ADDR_TYPE_UNSET = 0,
diff --git a/src/core/nm-l3cfg.h b/src/core/nm-l3cfg.h
index cbc974efaa..6fd8f9de80 100644
--- a/src/core/nm-l3cfg.h
+++ b/src/core/nm-l3cfg.h
@@ -8,6 +8,7 @@
 
 #define NM_L3CFG_CONFIG_PRIORITY_IPV4LL 0
 #define NM_L3CFG_CONFIG_PRIORITY_IPV6LL 1
+#define NM_L3CFG_CONFIG_PRIORITY_VPN    9
 #define NM_ACD_TIMEOUT_RFC5227_MSEC     9000u
 
 #define NM_TYPE_L3CFG            (nm_l3cfg_get_type())
diff --git a/src/core/vpn/nm-vpn-connection.c b/src/core/vpn/nm-vpn-connection.c
index 14ef1c4cac..bbb7355016 100644
--- a/src/core/vpn/nm-vpn-connection.c
+++ b/src/core/vpn/nm-vpn-connection.c
@@ -716,7 +716,6 @@ _l3cfg_l3cd_update(NMVpnConnection *self, L3CDType l3cd_type)
 {
     NMVpnConnectionPrivate      *priv = NM_VPN_CONNECTION_GET_PRIVATE(self);
     NML3Cfg                     *l3cfg;
-    int                          priority;
     const NML3ConfigData *const *p_l3cd;
 
     if (NM_IN_SET(l3cd_type, L3CD_TYPE_IP_4, L3CD_TYPE_IP_6, L3CD_TYPE_GENERIC, L3CD_TYPE_STATIC)) {
@@ -743,13 +742,11 @@ _l3cfg_l3cd_update(NMVpnConnection *self, L3CDType l3cd_type)
         goto handle_changed;
     }
 
-    priority = 0;
-
     if (!nm_l3cfg_add_config(l3cfg,
                              p_l3cd,
                              TRUE,
                              *p_l3cd,
-                             priority,
+                             NM_L3CFG_CONFIG_PRIORITY_VPN,
                              get_route_table(self, AF_INET, TRUE),
                              get_route_table(self, AF_INET6, TRUE),
                              nm_vpn_connection_get_ip_route_metric(self, AF_INET),