During a security posture review of an access-layer switch, an analyst finds that attackers on the guest VLAN have been intercepting traffic by responding to ARP requests with spoofed MAC-to-IP mappings, enabling man-in-the-middle attacks. The switch already has port security enabled. Which additional Layer 2 network control should the analyst recommend to specifically mitigate this ARP spoofing technique?