diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index 67ba3558..c0907bcd 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -4275,16 +4275,16 @@ sub vmconfig_update_net {
 	    die "internal error" if $opt !~ m/net(\d+)/;
 	    my $iface = "tap${vmid}i$1";
 
-	    if (&$safe_num_ne($oldnet->{rate}, $newnet->{rate})) {
-		PVE::Network::tap_rate_limit($iface, $newnet->{rate});
-	    }
-
 	    if (&$safe_string_ne($oldnet->{bridge}, $newnet->{bridge}) ||
 		&$safe_num_ne($oldnet->{tag}, $newnet->{tag}) ||
 		&$safe_string_ne($oldnet->{trunks}, $newnet->{trunks}) ||
 		&$safe_num_ne($oldnet->{firewall}, $newnet->{firewall})) {
 		PVE::Network::tap_unplug($iface);
-		PVE::Network::tap_plug($iface, $newnet->{bridge}, $newnet->{tag}, $newnet->{firewall}, $newnet->{trunks});
+		PVE::Network::tap_plug($iface, $newnet->{bridge}, $newnet->{tag}, $newnet->{firewall}, $newnet->{trunks}, $newnet->{rate});
+	    } elsif (&$safe_num_ne($oldnet->{rate}, $newnet->{rate})) {
+		# Rate can be applied on its own but any change above needs to
+		# include the rate in tap_plug since OVS resets everything.
+		PVE::Network::tap_rate_limit($iface, $newnet->{rate});
 	    }
 
 	    if (&$safe_string_ne($oldnet->{link_down}, $newnet->{link_down})) {
diff --git a/pve-bridge b/pve-bridge
index b1d40f8d..64490b0a 100755
--- a/pve-bridge
+++ b/pve-bridge
@@ -38,10 +38,6 @@ die "unable to parse network config '$netid'\n" if !$net;
 
 PVE::Network::tap_create($iface, $net->{bridge});
 
-# if ovs is under this bridge all traffic control settings will be flushed.
-# so we need to call tap_rate_limit after tap_plug
-PVE::Network::tap_plug($iface, $net->{bridge}, $net->{tag}, $net->{firewall}, $net->{trunks});
-
-PVE::Network::tap_rate_limit($iface, $net->{rate}) if $net->{rate};
+PVE::Network::tap_plug($iface, $net->{bridge}, $net->{tag}, $net->{firewall}, $net->{trunks}, $net->{rate});
 
 exit 0;