diff --git a/test/111_fastdp_encryption_2_test.sh b/test/111_fastdp_encryption_2_test.sh
index 0845282b..7059d065 100755
--- a/test/111_fastdp_encryption_2_test.sh
+++ b/test/111_fastdp_encryption_2_test.sh
@@ -39,8 +39,8 @@ C2=10.2.1.7
 
 start_suite "Ping over encrypted cross-host weave network (fastdp)"
 
-WEAVE_MTU=1300 weave_on $HOST1 launch --password wfvAwt7sj
-WEAVE_MTU=1300 weave_on $HOST2 launch --password wfvAwt7sj $HOST1
+weave_on $HOST1 launch --password wfvAwt7sj
+weave_on $HOST2 launch --password wfvAwt7sj $HOST1
 
 assert_raises "weave_on $HOST1 status connections | grep -P 'encrypted *fastdp'"
 assert_raises "weave_on $HOST2 status connections | grep -P 'encrypted *fastdp'"
diff --git a/weave b/weave
index 3493ca4a..133daca9 100755
--- a/weave
+++ b/weave
@@ -704,8 +704,9 @@ init_fastdp() {
     # a local network, at 1460 bytes.  To get the overlay MTU from that we
     # subtract 20 bytes for the outer IPv4 header, 8 bytes for the outer
     # UDP header, 8 bytes for the vxlan header, and 14 bytes for the inner
-    # ethernet header.
-    MTU=${WEAVE_MTU:-1410}
+    # ethernet header. In addition, we subtract 34 bytes for the ESP overhead
+    # which is needed for the vxlan encryption.
+    MTU=${WEAVE_MTU:-1376}
 
     # create_bridge already created the datapath netdev
     ip link set dev $DATAPATH mtu $MTU