diff --git a/roles/network/tasks/sysd-netd-debian.yml b/roles/network/tasks/sysd-netd-debian.yml
index d536ef859..77b3243b1 100644
--- a/roles/network/tasks/sysd-netd-debian.yml
+++ b/roles/network/tasks/sysd-netd-debian.yml
@@ -33,12 +33,16 @@
   when: wan_ip != "dhcp"
   register: CIDR
 
+# ICO will always set gui_static_wan_ip away from the default of 'unset' while
+# gui_static_wan turns dhcp on/off through wan_ip in computed_network and
+# overrides gui_static_wan_ip that is present. Changing wan_ip in local_vars
+# is a oneway street to static.
 - name: Supply static template
   template:
     dest:  /etc/netplan/50-cloud-init.yaml
     src: network/cloud-init.j2
-    backup: yes
-  when: wan_ip != "dhcp"
+    backup: no
+  when: wan_ip != "dhcp" or gui_static_wan_ip == "undefined"
 
 - name: Reload systemd
   systemd:
diff --git a/roles/network/templates/network/cloud-init.j2 b/roles/network/templates/network/cloud-init.j2
index c0c95e48c..6032871e1 100644
--- a/roles/network/templates/network/cloud-init.j2
+++ b/roles/network/templates/network/cloud-init.j2
@@ -1,3 +1,4 @@
+{% if wan_ip != "dhcp" %}
 network:
     ethernets:
         {{ iiab_wan_iface }}:
@@ -9,3 +10,12 @@ network:
                addresses: [{{ wan_nameserver }}]
             optional: true
     version: 2
+{% else %}
+network:
+    ethernets:
+        {{ iiab_wan_iface }}:
+            addresses: []
+            dhcp4: true
+            optional: true
+    version: 2
+{% endif %}