diff --git a/lb/egress_datapath.go b/lb/egress_datapath.go
index 49fd8e88..baf6f92d 100644
--- a/lb/egress_datapath.go
+++ b/lb/egress_datapath.go
@@ -288,10 +288,11 @@ func moveLocalRule() error {
 	var at0, atLocal bool
 	for _, r := range rules {
 		if r.Table == unix.RT_TABLE_LOCAL && r.Src == nil && r.Dst == nil && r.Mark <= 0 {
-			switch r.Priority {
-			case 0:
+			switch {
+			case r.Priority <= 0:
+				// the kernel leaves out the priority attribute when it is 0: listed as unset (-1)
 				at0 = true
-			case LocalRulePriority:
+			case r.Priority == LocalRulePriority:
 				atLocal = true
 			}
 		}
@@ -357,5 +358,30 @@ func ensureTunnel(want bool, local Local) error {
 			return fmt.Errorf("sysctl %s on %s: %v", k, Tunnel, err)
 		}
 	}
+	// reverse-path filtering rejects what arrives on a device with no IPv4 address unless the reverse route
+	// leaves by that very device (replies on a member's node, members' packets on the holder do not): the
+	// tunnel carries this node's bridge address (it never appears on the wire from here: the tunnel sets the
+	// outer source itself, and what crosses it is forwarded)
+	addr := &netlink.Addr{IPNet: &net.IPNet{IP: local.WeaveIP, Mask: net.CIDRMask(32, 32)}, Scope: unix.RT_SCOPE_LINK}
+	addrs, err := netlink.AddrList(link, unix.AF_INET)
+	if err != nil {
+		return err
+	}
+	has := false
+	for _, a := range addrs {
+		if a.IP.Equal(local.WeaveIP) {
+			has = true
+			continue
+		}
+		a := a
+		if err := netlink.AddrDel(link, &a); err != nil {
+			return fmt.Errorf("removing stale address %s from %s: %v", a.IPNet, Tunnel, err)
+		}
+	}
+	if !has {
+		if err := netlink.AddrAdd(link, addr); err != nil {
+			return fmt.Errorf("address on %s: %v", Tunnel, err)
+		}
+	}
 	return netlink.LinkSetUp(link)
 }
diff --git a/reweave/test/egress/egress-test.yaml b/reweave/test/egress/egress-test.yaml
index cbaa63a3..096c83aa 100644
--- a/reweave/test/egress/egress-test.yaml
+++ b/reweave/test/egress/egress-test.yaml
@@ -53,7 +53,7 @@ items:
       containers: [{name: c, image: "registry.k8s.io/e2e-test-images/jessie-dnsutils:1.7", command: ["sleep", "3600"]}]
   - apiVersion: v1
     kind: Pod
-    metadata: {name: plain, namespace: egtest, labels: {egress: no}}
+    metadata: {name: plain, namespace: egtest, labels: {egress: "none"}}
     spec:
       nodeName: REMOTE
       containers: [{name: c, image: "curlimages/curl:8.10.1", command: ["sleep", "3600"]}]
diff --git a/weave b/weave
index ee134620..eb73dcef 100755
--- a/weave
+++ b/weave
@@ -725,8 +725,11 @@ peer_args() {
 
 install_cni_plugin() {
     mkdir -p $1 || return 1
-    if [ ! -f "$1/$CNI_PLUGIN_NAME" ]; then
-        cp /usr/bin/weaveutil "$1/$CNI_PLUGIN_NAME"
+    # (re)install whenever the image's plugin differs from the installed one: the name
+    # (weave-plugin-$IMAGE_VERSION) stays the same across builds of one version ("latest")
+    if [ ! -f "$1/$CNI_PLUGIN_NAME" ] || \
+       [ "$(sha256sum < /usr/bin/weaveutil)" != "$(sha256sum < "$1/$CNI_PLUGIN_NAME")" ]; then
+        cp /usr/bin/weaveutil "$1/$CNI_PLUGIN_NAME.tmp" && mv -f "$1/$CNI_PLUGIN_NAME.tmp" "$1/$CNI_PLUGIN_NAME"
     fi
 }