diff --git a/internal/machine/docker/manager_linux.go b/internal/machine/docker/manager_linux.go
index cbd7b067..8c38bca4 100644
--- a/internal/machine/docker/manager_linux.go
+++ b/internal/machine/docker/manager_linux.go
@@ -13,6 +13,7 @@ import (
 	"github.com/psviderski/uncloud/internal/machine/dns"
 	"github.com/psviderski/uncloud/internal/machine/firewall"
 	"github.com/psviderski/uncloud/internal/machine/network"
+	"github.com/psviderski/uncloud/pkg/api"
 )
 
 // EnsureUncloudNetwork creates the Docker bridge network NetworkName with the provided machine subnet
@@ -52,6 +53,14 @@ func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix,
 						},
 					},
 				},
+				Labels: map[string]string{
+					api.LabelManaged: "",
+				},
+				Options: map[string]string{
+					// Starting with Docker 28.2.0 (https://github.com/moby/moby/pull/49832), we have to explicitly
+					// allow direct routing from the WireGuard interface to the bridge network.
+					"com.docker.network.bridge.trusted_host_interfaces": network.WireGuardInterfaceName,
+				},
 			},
 		); err != nil {
 			return fmt.Errorf("create Docker network '%s': %w", NetworkName, err)