__u8    nd_tll[ETH_ALEN];
 };
 
-#define OVS_CT_LABELS_LEN      16
+#define OVS_CT_LABELS_LEN_32   4
+#define OVS_CT_LABELS_LEN      (OVS_CT_LABELS_LEN_32 * sizeof(__u32))
 struct ovs_key_ct_labels {
-       __u8    ct_labels[OVS_CT_LABELS_LEN];
+       union {
+               __u8    ct_labels[OVS_CT_LABELS_LEN];
+               __u32   ct_labels_32[OVS_CT_LABELS_LEN_32];
+       };
 };
 
 /* OVS_KEY_ATTR_CT_STATE flags */
 
                /* Triggers a change event, which makes sense only for
                 * confirmed connections.
                 */
-               int err = nf_connlabels_replace(ct, (u32 *)labels, (u32 *)mask,
-                                               OVS_CT_LABELS_LEN / sizeof(u32));
+               int err = nf_connlabels_replace(ct, labels->ct_labels_32,
+                                               mask->ct_labels_32,
+                                               OVS_CT_LABELS_LEN_32);
                if (err)
                        return err;
        } else {
                u32 *dst = (u32 *)cl->bits;
-               const u32 *msk = (const u32 *)mask->ct_labels;
-               const u32 *lbl = (const u32 *)labels->ct_labels;
+               const u32 *msk = mask->ct_labels_32;
+               const u32 *lbl = labels->ct_labels_32;
                int i;
 
                /* No-one else has access to the non-confirmed entry, copy
                 * labels over, keeping any bits we are not explicitly setting.
                 */
-               for (i = 0; i < OVS_CT_LABELS_LEN / sizeof(u32); i++)
+               for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
                        dst[i] = (dst[i] & ~msk[i]) | (lbl[i] & msk[i]);
        }
 
 {
        size_t i;
 
-       for (i = 0; i < sizeof(*labels); i++)
-               if (labels->ct_labels[i])
+       for (i = 0; i < OVS_CT_LABELS_LEN_32; i++)
+               if (labels->ct_labels_32[i])
                        return true;
 
        return false;