A customer running a traceroute across your MPLS L3VPN backbone reports that the provider's P routers are visible as hops in the output, exposing internal core topology. The service provider policy requires that the MPLS core appear as a single hop to CE devices while normal traceroute still works within customer sites. Which configuration on the PE routers achieves this?