diff --git a/database/migrations/2026_08_21_000001_add_is_randomized_to_portal_sessions.php b/database/migrations/2026_08_21_000001_add_is_randomized_to_portal_sessions.php
new file mode 100644
index 0000000..40efd6d
--- /dev/null
+++ b/database/migrations/2026_08_21_000001_add_is_randomized_to_portal_sessions.php
@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Whether the device presented a private (randomized) address.
+ *
+ * Nullable, because rows written before this existed genuinely do not know —
+ * defaulting them to false would assert something untrue about every historical
+ * session.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('unifi_portal_sessions', function (Blueprint $table) {
+            $table->boolean('is_randomized')->nullable()->after('mac_address');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('unifi_portal_sessions', function (Blueprint $table) {
+            $table->dropColumn('is_randomized');
+        });
+    }
+};
diff --git a/src/Http/Controllers/PortalController.php b/src/Http/Controllers/PortalController.php
index e4d2c84..ebc798a 100644
--- a/src/Http/Controllers/PortalController.php
+++ b/src/Http/Controllers/PortalController.php
@@ -208,6 +208,7 @@ class PortalController extends Controller
                 'is_active'       => true,
                 'authorized_at'   => now(),
                 'expires_at'      => now()->addMinutes($minutes),
+                'is_randomized'   => $isRandomized,
             ]
         );
 
diff --git a/src/Models/PortalSession.php b/src/Models/PortalSession.php
index 7f6c477..6459acc 100644
--- a/src/Models/PortalSession.php
+++ b/src/Models/PortalSession.php
@@ -11,11 +11,13 @@ class PortalSession extends Model
     protected $fillable = [
         'user_id', 'mac_address', 'device_hostname', 'device_os', 'device_type',
         'ssid', 'vlan_id', 'ap_mac', 'is_active', 'authorized_at', 'expires_at',
+        'is_randomized',
     ];
     protected $casts = [
         'is_active'     => 'boolean',
         'authorized_at' => 'datetime',
         'expires_at'    => 'datetime',
+        'is_randomized' => 'boolean',
     ];
 
     public function user(): BelongsTo