diff --git a/NEWS b/NEWS
index 77b7463b1f..35336019c5 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,11 @@ This is a new stable release of NetworkManager.  Notable changes include:
 
 * Fix emission of NM-style PropertiesChanged signals and deprecate them
     for PropertiesChanged on "org.freedesktop.DBus.Properties" interface.
+* Change the meaning of unset "cloned-mac-address" settings from "permanent" to
+    "preserve". This changes the default value and affects existing connections
+    during upgrade that did not explicitly configure cloned-mac-address. This
+    has the effect that externally configured MAC addresses are preserved
+    by default instead of setting the permanent address (bgo#770611).
 
 ============================================
 NetworkManager-1.4
diff --git a/libnm-core/nm-setting-wired.c b/libnm-core/nm-setting-wired.c
index 131bbbb7bf..d2eea05411 100644
--- a/libnm-core/nm-setting-wired.c
+++ b/libnm-core/nm-setting-wired.c
@@ -1095,8 +1095,8 @@ nm_setting_wired_class_init (NMSettingWiredClass *setting_wired_class)
 	/**
 	 * NMSettingWired:cloned-mac-address:
 	 *
-	 * If specified, request that the device use this MAC address instead of its
-	 * permanent MAC address.  This is known as MAC cloning or spoofing.
+	 * If specified, request that the device use this MAC address instead.
+	 * This is known as MAC cloning or spoofing.
 	 *
 	 * Beside explicitly specifing a MAC address, the special values "preserve", "permanent",
 	 * "random" and "stable" are supported.
@@ -1107,7 +1107,8 @@ nm_setting_wired_class_init (NMSettingWiredClass *setting_wired_class)
 	 * the connection's UUID) and a machine dependent key.
 	 *
 	 * If unspecified, the value can be overwritten via global defaults, see manual
-	 * of NetworkManager.conf. If still unspecified, it defaults to "permanent".
+	 * of NetworkManager.conf. If still unspecified, it defaults to "preserve"
+	 * (older versions of NetworkManager may use a different default value).
 	 *
 	 * On D-Bus, this field is expressed as "assigned-mac-address" or the deprecated
 	 * "cloned-mac-address".
diff --git a/libnm-core/nm-setting-wireless.c b/libnm-core/nm-setting-wireless.c
index 06d18008af..a31f7586d2 100644
--- a/libnm-core/nm-setting-wireless.c
+++ b/libnm-core/nm-setting-wireless.c
@@ -1337,8 +1337,8 @@ nm_setting_wireless_class_init (NMSettingWirelessClass *setting_wireless_class)
 	/**
 	 * NMSettingWireless:cloned-mac-address:
 	 *
-	 * If specified, request that the device use this MAC address instead of its
-	 * permanent MAC address.  This is known as MAC cloning or spoofing.
+	 * If specified, request that the device use this MAC address instead.
+	 * This is known as MAC cloning or spoofing.
 	 *
 	 * Beside explicitly specifing a MAC address, the special values "preserve", "permanent",
 	 * "random" and "stable" are supported.
@@ -1349,7 +1349,8 @@ nm_setting_wireless_class_init (NMSettingWirelessClass *setting_wireless_class)
 	 * the connection's UUID) and a machine dependent key.
 	 *
 	 * If unspecified, the value can be overwritten via global defaults, see manual
-	 * of NetworkManager.conf. If still unspecified, it defaults to "permanent".
+	 * of NetworkManager.conf. If still unspecified, it defaults to "preserve"
+	 * (older versions of NetworkManager may use a different default value).
 	 *
 	 * On D-Bus, this field is expressed as "assigned-mac-address" or the deprecated
 	 * "cloned-mac-address".
diff --git a/man/NetworkManager.conf.xml b/man/NetworkManager.conf.xml
index 7d68fb343c..32ce5b477c 100644
--- a/man/NetworkManager.conf.xml
+++ b/man/NetworkManager.conf.xml
@@ -571,7 +571,7 @@ ipv6.ip6-privacy=0
         </varlistentry>
         <varlistentry>
           <term><varname>ethernet.cloned-mac-address</varname></term>
-          <listitem><para>If left unspecified, it defaults to "permanent".</para></listitem>
+          <listitem><para>If left unspecified, it defaults to "preserve".</para></listitem>
         </varlistentry>
         <varlistentry>
           <term><varname>ethernet.generate-mac-address-mask</varname></term>
@@ -605,7 +605,7 @@ ipv6.ip6-privacy=0
         </varlistentry>
         <varlistentry>
           <term><varname>wifi.cloned-mac-address</varname></term>
-          <listitem><para>If left unspecified, it defaults to "permanent".</para></listitem>
+          <listitem><para>If left unspecified, it defaults to "preserve".</para></listitem>
         </varlistentry>
         <varlistentry>
           <term><varname>wifi.generate-mac-address-mask</varname></term>
diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
index 7fc61509c0..b3f1fa85fc 100644
--- a/src/devices/nm-device.c
+++ b/src/devices/nm-device.c
@@ -11737,8 +11737,8 @@ _get_cloned_mac_address_setting (NMDevice *self, NMConnection *connection, gbool
 		a = nm_config_data_get_connection_default (NM_CONFIG_GET_DATA,
 		                                           is_wifi ? "wifi.cloned-mac-address" : "ethernet.cloned-mac-address",
 		                                           self);
-		/* default is permanent. */
-		addr = NM_CLONED_MAC_PERMANENT;
+
+		addr = NM_CLONED_MAC_PRESERVE;
 
 		if (!a) {
 			if (is_wifi) {