diff --git a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-pub-addr.sh.in b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-pub-addr.sh.in
index e033fd2..949f04f 100644
--- a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-pub-addr.sh.in
+++ b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-pub-addr.sh.in
@@ -23,35 +23,37 @@
   printf 'gBMC Bridge Pub Addr from NCSI: %s\n' \
     "${gbmc_ncsi_br_pub_addr_lastip:-(deleted)}" >&2
 
-  local pfx=
+  local pfx_bytes=()
   if [ -n "$gbmc_ncsi_br_pub_addr_lastip" ]; then
-    # Pad the address out to a /64 and ensure that it doesn't have extra bits
-    pfx="${gbmc_ncsi_br_pub_addr_lastip%::}"
-    while true; do
-      # Count `:` in `pfx` by removing them and diffing their lengths
-      local nos="${pfx//:/}"
-      (( ${#pfx} - ${#nos} >= 3 )) && break
-      pfx+=":0"
+    ip_to_bytes pfx_bytes "$gbmc_ncsi_br_pub_addr_lastip"
+    # Ensure we don't have more than a /64 address
+    local i
+    for (( i = 8; i < 16; ++i )); do
+      if (( pfx_bytes[$i] != 0 )); then
+        pfx_bytes=()
+        break
+      fi
     done
-    # Addresses that have more than 64bits of prefix (more than 3 separators)
-    # do not work with this scheme. Ignore them.
-    (( ${#pfx} - ${#nos} == 3 )) || pfx=
   fi
 
   local contents='[Network]'$'\n'
-  if [ -n "$pfx" ]; then
+  if (( ${#pfx_bytes[@]} != 0 )); then
+    pfx_bytes[8]=0xfd
+    local stateless_pfx="$(ip_bytes_to_str pfx_bytes)"
+    pfx_bytes[9]=0x01
+    local ncsi_pfx="$(ip_bytes_to_str pfx_bytes)"
     local here=
     read -r -d '' here <<EOF
-Address=${pfx}:fd01::/128
+Address=$ncsi_pfx/128
 IPv6PrefixDelegation=yes
 [IPv6PrefixDelegation]
 RouterLifetimeSec=60
 [IPv6Prefix]
-Prefix=${pfx}:fd00::/80
+Prefix=$stateless_pfx/80
 PreferredLifetimeSec=60
 ValidLifetimeSec=60
 [IPv6RoutePrefix]
-Route=${pfx}:fd01::/80
+Route=$ncsi_pfx/80
 LifetimeSec=60
 EOF
     contents+="$here"$'\n'
diff --git a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-nft.sh.in b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-nft.sh.in
index 34ca4e5..727c8b6 100644
--- a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-nft.sh.in
+++ b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-nft.sh.in
@@ -38,22 +38,23 @@
   if [ -n "$ip6" ]; then
     contents+="        ip6 daddr $ip6/128 goto ncsi_legacy_input"$'\n'
 
-    # Pad out to 4 hextets with no trailing semicolons
-    local pfx=
-    pfx="${ip6%::}"
-    while true; do
-      # Count `:` in `pfx` by removing them and diffing their lengths
-      local nos="${pfx//:/}"
-      (( ${#pfx} - ${#nos} >= 3 )) && break
-      pfx+=":0"
-    done
-
+    local ip_bytes=()
+    ip_to_bytes ip_bytes "$ip6"
     # If our address has enough spare bits for appending the BMC suffix
     # then we add a rule that allows the BMC subnet. That is, we need a /64
     # as input.
-    if (( ${#pfx} - ${#nos} == 3 )); then
-      contents+="        ip6 saddr != ${pfx}:fd00::/72 ip6 daddr"
-      contents+=" ${pfx}:fd00::/72 goto ncsi_gbmc_br_pub_input"$'\n'
+    local i
+    for (( i = 8; i < 16; i++ )); do
+      if (( ip_bytes[$i] != 0 )); then
+        ip_bytes=()
+        break
+      fi
+    done
+    if (( ${#ip_bytes[@]} != 0 )); then
+      ip_bytes[8]=0xfd
+      local pfx="$(ip_bytes_to_str ip_bytes)"
+      contents+="        ip6 saddr != $pfx/72 ip6 daddr"
+      contents+=" $pfx/72 goto ncsi_gbmc_br_pub_input"$'\n'
     fi
   fi