diff --git a/src/PVE/Network/SDN/Ipams/PVEPlugin.pm b/src/PVE/Network/SDN/Ipams/PVEPlugin.pm
index f274b02..efc1841 100644
--- a/src/PVE/Network/SDN/Ipams/PVEPlugin.pm
+++ b/src/PVE/Network/SDN/Ipams/PVEPlugin.pm
@@ -14,12 +14,36 @@ use Digest::SHA;
 use base('PVE::Network::SDN::Ipams::Plugin');
 
 
-my $ipamdb_file = "priv/ipam.db";
+my $ipamdb_file = "sdn/pve-ipam-state.json";
+my $ipamdb_file_legacy = "priv/ipam.db";
 
 PVE::Cluster::cfs_register_file(
     $ipamdb_file,
+    sub {
+	my ($filename, $data) = @_;
+	if (defined($data)) {
+	    return PVE::Network::SDN::Ipams::PVEPlugin->parse_config($filename, $data);
+	} else {
+	    # TODO: remove legacy state file handling with PVE 9+ after ensuring all call sites got
+	    # switched over.
+	    return cfs_read_file($ipamdb_file_legacy);
+	}
+    },
+    sub {
+	my ($filename, $data) = @_;
+	# TODO: remove below with PVE 9+, add a pve8to9 check to allow doing so.
+	if (-e $ipamdb_file_legacy && $ipamdb_file) {
+	    # only clean-up if we succeeded to write the new path at least once
+	    unlink $ipamdb_file_legacy or $!{ENOENT} or warn "failed to unlink legacy IPAM DB - $!\n";
+	}
+	return PVE::Network::SDN::Ipams::PVEPlugin->write_config($filename, $data);
+    },
+);
+
+PVE::Cluster::cfs_register_file(
+    $ipamdb_file_legacy,
     sub { PVE::Network::SDN::Ipams::PVEPlugin->parse_config(@_); },
-    sub { PVE::Network::SDN::Ipams::PVEPlugin->write_config(@_); },
+    undef, # no writer for legacy file, all must go to the new file.
 );
 
 sub type {