diff --git a/docs/logging-access-denied.md b/docs/logging-access-denied.md
index 16b2765b8..b70017139 100644
--- a/docs/logging-access-denied.md
+++ b/docs/logging-access-denied.md
@@ -238,7 +238,7 @@ sandbox policy:
 Feature-enabled Windows builds can add WFP decisions to the managed Learning
 Mode ETL through the manifested
 `Microsoft-Windows-LearningMode-NetworkDecision` provider
-(`{71237669-21C3-4101-BD2F-FF38945D725A}`). MXC accepts event ID `1`,
+(`{301EC03D-2951-5EFB-6D99-59C64628BBFC}`). MXC accepts event ID `1`,
 `NetworkDecisionV1`, with schema version `1`. The OS Learning Mode broker owns
 the WFP subscription, runtime-filter lookup, subject scoping, event
 normalization, queue draining, and ETW flush before the trace is sealed.
@@ -421,7 +421,7 @@ to the redaction, timestamp omission, and bounds described below.
     {
       "signature": {
         "provider": "learningModeNetworkDecision",
-        "providerGuid": "{71237669-21C3-4101-BD2F-FF38945D725A}",
+        "providerGuid": "{301EC03D-2951-5EFB-6D99-59C64628BBFC}",
         "eventId": 1,
         "eventName": "NetworkDecisionV1",
         "reason": "actionable",
diff --git a/src/mxc-sdk/src/backends/process_container/common/capture_output.rs b/src/mxc-sdk/src/backends/process_container/common/capture_output.rs
index f12e1df23..bba1e55fa 100644
--- a/src/mxc-sdk/src/backends/process_container/common/capture_output.rs
+++ b/src/mxc-sdk/src/backends/process_container/common/capture_output.rs
@@ -372,7 +372,7 @@ mod tests {
         network_verbose_logging.record_with_byte_budget(
             CaptureVerboseLoggingSignature {
                 provider: CaptureVerboseLoggingProvider::LearningModeNetworkDecision,
-                provider_guid: "{71237669-21C3-4101-BD2F-FF38945D725A}".to_string(),
+                provider_guid: "{301EC03D-2951-5EFB-6D99-59C64628BBFC}".to_string(),
                 event_id: 1,
                 event_name: Some("NetworkDecisionV1".to_string()),
                 reason: CaptureVerboseLoggingOutcomeReason::Actionable,
diff --git a/src/mxc-sdk/src/core/learning_mode_core/capture_diagnostics.rs b/src/mxc-sdk/src/core/learning_mode_core/capture_diagnostics.rs
index e907679f6..3a2de1882 100644
--- a/src/mxc-sdk/src/core/learning_mode_core/capture_diagnostics.rs
+++ b/src/mxc-sdk/src/core/learning_mode_core/capture_diagnostics.rs
@@ -838,7 +838,7 @@ mod tests {
     ) -> CaptureVerboseLoggingSignature {
         CaptureVerboseLoggingSignature {
             provider: CaptureVerboseLoggingProvider::LearningModeNetworkDecision,
-            provider_guid: "{71237669-21C3-4101-BD2F-FF38945D725A}".to_string(),
+            provider_guid: "{301EC03D-2951-5EFB-6D99-59C64628BBFC}".to_string(),
             event_id: 1,
             event_name: Some("NetworkDecisionV1".to_string()),
             reason,
@@ -982,7 +982,7 @@ mod tests {
             "signatures": [{
                 "signature": {
                     "provider": "learningModeNetworkDecision",
-                    "providerGuid": "{71237669-21C3-4101-BD2F-FF38945D725A}",
+                    "providerGuid": "{301EC03D-2951-5EFB-6D99-59C64628BBFC}",
                     "eventId": 1,
                     "eventName": "NetworkDecisionV1",
                     "reason": "schemaUnavailable",
diff --git a/src/mxc-sdk/src/core/learning_mode_windows/etl_decode.rs b/src/mxc-sdk/src/core/learning_mode_windows/etl_decode.rs
index 33ef9add8..62b552278 100644
--- a/src/mxc-sdk/src/core/learning_mode_windows/etl_decode.rs
+++ b/src/mxc-sdk/src/core/learning_mode_windows/etl_decode.rs
@@ -480,7 +480,7 @@ impl<'visitor> Accumulator<'visitor> {
         let (access_type, resource_type) = analysis.classification;
         self.record_capture_signature(CaptureVerboseLoggingSignature {
             provider: CaptureVerboseLoggingProvider::LearningModeNetworkDecision,
-            provider_guid: "{71237669-21C3-4101-BD2F-FF38945D725A}".to_string(),
+            provider_guid: "{301EC03D-2951-5EFB-6D99-59C64628BBFC}".to_string(),
             event_id,
             event_name,
             reason: analysis.reason,
@@ -1417,7 +1417,7 @@ mod tests {
 
     #[test]
     fn network_decision_is_retained_only_in_unscoped_native_analysis() {
-        let provider = windows::core::GUID::from_u128(0x71237669_21c3_4101_bd2f_ff38945d725a);
+        let provider = windows::core::GUID::from_u128(0x301ec03d_2951_5efb_6d99_59c64628bbfc);
         assert!(is_learning_mode_event(provider, 1));
         for event_id in [0, 2, 14, 28] {
             assert!(!is_learning_mode_event(provider, event_id));
@@ -1448,7 +1448,7 @@ mod tests {
         );
         assert_eq!(
             signature.provider_guid,
-            "{71237669-21C3-4101-BD2F-FF38945D725A}"
+            "{301EC03D-2951-5EFB-6D99-59C64628BBFC}"
         );
         assert_eq!(signature.pid, 0);
         assert_eq!(
@@ -1509,7 +1509,7 @@ mod tests {
     fn network_decode_failure_does_not_attribute_the_broker_pid() {
         let mut accumulator = Accumulator::analyze();
         accumulator.record_event_decode_error(
-            windows::core::GUID::from_u128(0x71237669_21c3_4101_bd2f_ff38945d725a),
+            windows::core::GUID::from_u128(0x301ec03d_2951_5efb_6d99_59c64628bbfc),
             1,
             SCOPED_PID,
             tdh_decode::DecodeError::event(
diff --git a/src/mxc-sdk/src/core/learning_mode_windows/extractors.rs b/src/mxc-sdk/src/core/learning_mode_windows/extractors.rs
index c36be16ef..8e4f3aaea 100644
--- a/src/mxc-sdk/src/core/learning_mode_windows/extractors.rs
+++ b/src/mxc-sdk/src/core/learning_mode_windows/extractors.rs
@@ -71,7 +71,7 @@ pub(crate) const PRIVACY_LEARNING_MODE_PROVIDER: GUID = GUID {
 };
 
 pub(crate) const NETWORK_DECISION_PROVIDER: GUID =
-    GUID::from_u128(0x71237669_21c3_4101_bd2f_ff38945d725a);
+    GUID::from_u128(0x301ec03d_2951_5efb_6d99_59c64628bbfc);
 pub(crate) const NETWORK_DECISION_EVENT_ID: u16 = 1;
 
 pub(crate) const ACCESS_CHECK_EVENT_ID: u16 = 14;
diff --git a/src/mxc-sdk/src/core/learning_mode_windows/network_extractors.rs b/src/mxc-sdk/src/core/learning_mode_windows/network_extractors.rs
index d15ff32da..9bb3709e9 100644
--- a/src/mxc-sdk/src/core/learning_mode_windows/network_extractors.rs
+++ b/src/mxc-sdk/src/core/learning_mode_windows/network_extractors.rs
@@ -16,10 +16,10 @@ use windows::core::GUID;
 use super::extractors::{sanitize_properties, DecodedEventParts, RawDenial};
 
 pub(crate) const NETWORK_DECISION_PROVIDER: GUID = GUID {
-    data1: 0x7123_7669,
-    data2: 0x21c3,
-    data3: 0x4101,
-    data4: [0xbd, 0x2f, 0xff, 0x38, 0x94, 0x5d, 0x72, 0x5a],
+    data1: 0x301e_c03d,
+    data2: 0x2951,
+    data3: 0x5efb,
+    data4: [0x6d, 0x99, 0x59, 0xc6, 0x46, 0x28, 0xbb, 0xfc],
 };
 pub(crate) const NETWORK_DECISION_EVENT_ID: u16 = 1;
 
diff --git a/src/mxc-sdk/src/core/mxc_engine/verbose_telemetry.rs b/src/mxc-sdk/src/core/mxc_engine/verbose_telemetry.rs
index f20bfcf61..246dda63b 100644
--- a/src/mxc-sdk/src/core/mxc_engine/verbose_telemetry.rs
+++ b/src/mxc-sdk/src/core/mxc_engine/verbose_telemetry.rs
@@ -177,7 +177,7 @@ fn canonical_provider_guid(provider: CaptureVerboseLoggingProvider) -> &'static
             "{811A1DDB-2E69-5F25-ADC0-4B186170E760}"
         }
         CaptureVerboseLoggingProvider::LearningModeNetworkDecision => {
-            "{71237669-21C3-4101-BD2F-FF38945D725A}"
+            "{301EC03D-2951-5EFB-6D99-59C64628BBFC}"
         }
     }
 }
@@ -475,7 +475,7 @@ mod tests {
     fn network_provider_uses_the_canonical_guid() {
         assert_eq!(
             canonical_provider_guid(CaptureVerboseLoggingProvider::LearningModeNetworkDecision),
-            "{71237669-21C3-4101-BD2F-FF38945D725A}"
+            "{301EC03D-2951-5EFB-6D99-59C64628BBFC}"
         );
     }
 }