diff --git a/src/core/nm-config-data.c b/src/core/nm-config-data.c
index ff44bc46b3..62949ccbfb 100644
--- a/src/core/nm-config-data.c
+++ b/src/core/nm-config-data.c
@@ -1488,21 +1488,23 @@ global_dns_equal(NMGlobalDnsConfig *old, NMGlobalDnsConfig *new)
 /*****************************************************************************/
 
 static const MatchSectionInfo *
-_match_section_infos_lookup(const MatchSectionInfo *match_section_infos,
-                            GKeyFile               *keyfile,
-                            const char             *property,
-                            NMDevice               *device,
-                            const NMPlatformLink   *pllink,
-                            const char             *match_device_type,
-                            const char            **out_value)
+_match_section_infos_lookup(const MatchSectionInfo      *match_section_infos,
+                            GKeyFile                    *keyfile,
+                            const char                  *property,
+                            const NMMatchSpecDeviceData *match_data,
+                            NMDevice                    *device,
+                            const char                 **out_value)
 {
-    const char *match_dhcp_plugin;
+    NMMatchSpecDeviceData match_data_local;
+
+    /* Caller must either provide a "match_data" or a "device" (actually,
+     * neither is also fine, albeit unusual). */
+    nm_assert(!match_data || !device);
+    nm_assert(!device || NM_IS_DEVICE(device));
 
     if (!match_section_infos)
         goto out;
 
-    match_dhcp_plugin = nm_dhcp_manager_get_config(nm_dhcp_manager_get());
-
     for (; match_section_infos->group_name; match_section_infos++) {
         const char *value;
         gboolean    match;
@@ -1519,16 +1521,17 @@ _match_section_infos_lookup(const MatchSectionInfo *match_section_infos,
             continue;
 
         if (match_section_infos->match_device.has) {
-            if (device)
-                match = nm_device_spec_match_list(device, match_section_infos->match_device.spec);
-            else if (pllink)
-                match = nm_match_spec_device_by_pllink(pllink,
-                                                       match_device_type,
-                                                       match_dhcp_plugin,
-                                                       match_section_infos->match_device.spec,
-                                                       FALSE);
-            else
-                match = FALSE;
+            NMMatchSpecMatchType m;
+
+            if (G_UNLIKELY(!match_data)) {
+                /* In most cases, we don't actually have any matches. So we "optimize"
+                 * here by allowing the user to specify a NMDEvice directly, and only
+                 * initialize the match-data when needed. */
+                match_data = nm_match_spec_device_data_init_from_device(&match_data_local, device);
+            }
+
+            m     = nm_match_spec_device(match_section_infos->match_device.spec, match_data);
+            match = nm_match_spec_match_type_to_bool(m, FALSE);
         } else
             match = TRUE;
 
@@ -1563,9 +1566,8 @@ nm_config_data_get_device_config(const NMConfigData *self,
     connection_info = _match_section_infos_lookup(&priv->device_infos[0],
                                                   priv->keyfile,
                                                   property,
+                                                  NULL,
                                                   device,
-                                                  NULL,
-                                                  NULL,
                                                   &value);
     NM_SET_OUT(has_match, !!connection_info);
     return value;
@@ -1581,18 +1583,23 @@ nm_config_data_get_device_config_by_pllink(const NMConfigData   *self,
     const NMConfigDataPrivate *priv;
     const MatchSectionInfo    *connection_info;
     const char                *value;
+    NMMatchSpecDeviceData      match_data;
 
     g_return_val_if_fail(self, NULL);
     g_return_val_if_fail(property && *property, NULL);
 
     priv = NM_CONFIG_DATA_GET_PRIVATE(self);
 
+    nm_match_spec_device_data_init_from_platform(&match_data,
+                                                 pllink,
+                                                 match_device_type,
+                                                 nm_dhcp_manager_get_config(nm_dhcp_manager_get()));
+
     connection_info = _match_section_infos_lookup(&priv->device_infos[0],
                                                   priv->keyfile,
                                                   property,
+                                                  &match_data,
                                                   NULL,
-                                                  pllink,
-                                                  match_device_type,
                                                   &value);
     NM_SET_OUT(has_match, !!connection_info);
     return value;
@@ -1651,9 +1658,8 @@ nm_config_data_get_device_allowed_connections_specs(const NMConfigData *self,
     connection_info = _match_section_infos_lookup(&priv->device_infos[0],
                                                   priv->keyfile,
                                                   NM_CONFIG_KEYFILE_KEY_DEVICE_ALLOWED_CONNECTIONS,
+                                                  NULL,
                                                   device,
-                                                  NULL,
-                                                  NULL,
                                                   NULL);
 
     if (connection_info) {
@@ -1696,9 +1702,8 @@ nm_config_data_get_connection_default(const NMConfigData *self,
     _match_section_infos_lookup(&priv->connection_infos[0],
                                 priv->keyfile,
                                 property,
+                                NULL,
                                 device,
-                                NULL,
-                                NULL,
                                 &value);
     return value;
 }