diff --git a/bundles/wireguard/metadata.py b/bundles/wireguard/metadata.py
index 8b90c72..3a85bf1 100644
--- a/bundles/wireguard/metadata.py
+++ b/bundles/wireguard/metadata.py
@@ -90,10 +90,10 @@ def systemd_networkd_netdevs(metadata):
                 'Endpoint': config['endpoint'],
                 'PublicKey': config['pubkey'],
                 'PresharedKey': config['psk'],
-                'AllowedIPs': ', '.join([
+                'AllowedIPs': ', '.join(sorted([
                     str(ip_interface(repo.get_node(peer).metadata.get(f'wireguard/my_ip')).ip),
                     *config.get('route', []),
-                ]), # FIXME
+                ])), # FIXME
                 'PersistentKeepalive': 30,
             }
         })
diff --git a/libs/systemd.py b/libs/systemd.py
index 60a742b..410b7c0 100644
--- a/libs/systemd.py
+++ b/libs/systemd.py
@@ -9,7 +9,7 @@ template = '''
 [${segment.split('#')[0]}]
 %     for option, value in sorted(options.items()):
 %         if isinstance(value, dict):
-%             for k, v in value.items():
+%             for k, v in sorted(value.items()):
 ${option}=${k}=${v}
 %             endfor
 %         elif isinstance(value, (list, set, tuple)):