diff --git a/net_alerter/net_alerter.py b/net_alerter/net_alerter.py
index 5938c3d..fe107b6 100644
--- a/net_alerter/net_alerter.py
+++ b/net_alerter/net_alerter.py
@@ -1684,7 +1684,7 @@ def parse_frame(data: bytes) -> None:
             # labeled personal devices where we trust the frame regardless, because
             # iPhones with privacy MACs often only emit opcode=2 after initial association.
             with personal_lock:
-                is_labeled = src_mac in device_labels
+                is_labeled = _normalize_mac(src_mac) in device_labels
             if opcode == 1 or (opcode == 2 and is_labeled):
                 _update_last_seen(src_mac)
                 # Personal devices first seen via ARP get no DHCP/Netlink event.