diff --git a/setup/archbaseos-guided-install.sh b/setup/archbaseos-guided-install.sh
index 521759d..e4c1d39 100755
--- a/setup/archbaseos-guided-install.sh
+++ b/setup/archbaseos-guided-install.sh
@@ -127,8 +127,10 @@ get_mac_suffix() {
     local mac
     mac=$(ip link show 2>/dev/null \
         | awk '/^[0-9]+: [^l][^o]/{iface=1} iface && /link\/ether/{print $2; iface=0; exit}')
-    # Remove colons via bash parameter substitution: ${var//pattern/replacement}.
-    printf '%s' "${mac//:/}"
+    # Strip any separator (colon/dot/dash) so the suffix is a bare hex string,
+    # e.g. "aa:bb:cc:dd:ee:ff" -> "aabbccddeeff". The character class [:.-] matches
+    # all three common MAC delimiters regardless of how the kernel formats them.
+    printf '%s' "${mac//[:.-]/}"
 }
 
 if $AF_MODE; then
@@ -183,12 +185,17 @@ KEYMAPS=(
 if $AF_MODE; then
     KERNEL=$(af_get '.kernel' 'linux')
     RAW_HOSTNAME=$(af_get '.hostname' '')
-    # Append MAC suffix to make the hostname unique across machines when the same
-    # answerfile is deployed to a fleet (lab rollout, reinstall, etc.).
-    if [[ -n "$RAW_HOSTNAME" ]]; then
-        HOSTNAME="${RAW_HOSTNAME}-$(get_mac_suffix)"
+    # Always append the machine's MAC (no separators) to the base name so every
+    # node provisioned from the same answerfile gets a unique hostname, e.g.
+    # "arch-aabbccddeeff". Falls back to "arch" when the answerfile omits a name.
+    # The dash is only added when a MAC was actually found, so a NIC-less machine
+    # never ends up with a trailing "-".
+    BASE_HOSTNAME="${RAW_HOSTNAME:-arch}"
+    MAC_SUFFIX=$(get_mac_suffix)
+    if [[ -n "$MAC_SUFFIX" ]]; then
+        HOSTNAME="${BASE_HOSTNAME}-${MAC_SUFFIX}"
     else
-        HOSTNAME="arch"
+        HOSTNAME="$BASE_HOSTNAME"
     fi
     USERNAME=$(af_get '.username' '')
     ENCRYPT_DISK=$(af_bool '.encrypt')