diff --git a/PVE/QemuMigrate.pm b/PVE/QemuMigrate.pm
index b7e3d309..9759aa29 100644
--- a/PVE/QemuMigrate.pm
+++ b/PVE/QemuMigrate.pm
@@ -1181,6 +1181,9 @@ sub phase3_cleanup {
 	    }
 	}
 
+	# deletes local FDB entries if learning is disabled, they'll be re-added on target on resume
+	PVE::QemuServer::del_nets_bridge_fdb($conf, $vmid);
+
 	if (!$self->{vm_was_paused}) {
 	    # config moved and nbd server stopped - now we can resume vm on target
 	    if ($tunnel && $tunnel->{version} && $tunnel->{version} >= 1) {
diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index 548c9b7e..303a5dd1 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -8338,4 +8338,22 @@ sub add_nets_bridge_fdb {
     }
 }
 
+sub del_nets_bridge_fdb {
+    my ($conf, $vmid) = @_;
+
+    for my $opt (keys %$conf) {
+	next if $opt !~ m/^net(\d+)$/;
+	my $iface = "tap${vmid}i$1";
+
+	my $net = parse_net($conf->{$opt}) or next;
+	my $mac = $net->{macaddr} or next;
+
+	if ($have_sdn) {
+	    PVE::Network::SDN::Zones::del_bridge_fdb($iface, $mac, $net->{bridge}, $net->{firewall});
+	} else {
+	    PVE::Network::del_bridge_fdb($iface, $mac, $net->{firewall});
+	}
+    }
+}
+
 1;
diff --git a/test/MigrationTest/QemuMigrateMock.pm b/test/MigrationTest/QemuMigrateMock.pm
index f2c02819..2c96eff6 100644
--- a/test/MigrationTest/QemuMigrateMock.pm
+++ b/test/MigrationTest/QemuMigrateMock.pm
@@ -158,6 +158,7 @@ $MigrationTest::Shared::qemu_server_module->mock(
 	$vm_stop_executed = 1;
 	delete $expected_calls->{'vm_stop'};
     },
+    del_nets_bridge_fdb => sub { return; },
 );
 
 my $qemu_server_cpuconfig_module = Test::MockModule->new("PVE::QemuServer::CPUConfig");