diff --git a/coreos-base/oem-gce/files/units/oem-gce.service b/coreos-base/oem-gce/files/units/oem-gce.service
index ef008182c2..646b04ac1d 100644
--- a/coreos-base/oem-gce/files/units/oem-gce.service
+++ b/coreos-base/oem-gce/files/units/oem-gce.service
@@ -22,7 +22,7 @@ ExecStartPre=/usr/bin/mount /var/lib/flatcar-oem-gce.img /var/lib/flatcar-oem-gc
 ExecStartPre=/usr/bin/tar --directory=/var/lib/flatcar-oem-gce --extract --file=/usr/share/oem/flatcar-oem-gce.aci --strip-components=1 rootfs
 ExecStartPre=/usr/bin/umount /var/lib/flatcar-oem-gce.img
 ExecStart=/usr/bin/systemd-nspawn --keep-unit --register=no --link-journal=no \
-    --machine=oem-gce --bind=/dev/log --bind=/run/systemd --tmpfs=/run/lock --bind=/etc --bind=/home --bind-ro=/usr/share/google-oslogin/nsswitch.conf \
+    --machine=oem-gce --capability=CAP_NET_ADMIN --bind=/dev/log --bind=/run/systemd --tmpfs=/run/lock --bind=/etc --bind=/home --bind-ro=/usr/share/google-oslogin/nsswitch.conf \
     --read-only --volatile=overlay --image=/var/lib/flatcar-oem-gce.img /init.sh
 
 [Install]