diff --git a/modules/services/server/podman.nix b/modules/services/server/podman.nix
index 56e536d..67fe19a 100644
--- a/modules/services/server/podman.nix
+++ b/modules/services/server/podman.nix
@@ -1,17 +1,20 @@
 {
   flake.modules.nixos.podman = {
     # keep-sorted start
+    lib,
     pkgs,
     vars,
     # keep-sorted end
     ...
   }: let
+    inherit (lib) getExe';
     inherit (vars) username;
+    resolvedAddress = "169.254.0.53";
   in {
     virtualisation = {
       podman = {
         enable = true;
-        defaultNetwork.settings.dns_enabled = true;
+        defaultNetwork.settings.dns_enabled = false;
         dockerSocket.enable = true;
         dockerCompat = true;
       };
@@ -23,11 +26,32 @@
     # Forward container queries through the host's resolved stub.
     environment.etc."containers/containers.conf.d/00-dns.conf".text = ''
       [containers]
-      dns_servers = ["127.0.0.53"]
+      dns_servers = ["${resolvedAddress}"]
     '';
 
     environment.systemPackages = [pkgs.podman-compose];
 
+    services.resolved.settings.Resolve.DNSStubListenerExtra = resolvedAddress;
+
+    systemd.services = {
+      podman-dns-address = {
+        description = "Configure the container DNS listener address";
+        before = ["systemd-resolved.service"];
+        unitConfig.DefaultDependencies = false;
+
+        serviceConfig = {
+          ExecStart = "${getExe' pkgs.iproute2 "ip"} address replace ${resolvedAddress}/32 dev lo";
+          RemainAfterExit = true;
+          Type = "oneshot";
+        };
+      };
+
+      systemd-resolved = {
+        after = ["podman-dns-address.service"];
+        requires = ["podman-dns-address.service"];
+      };
+    };
+
     networking.firewall.extraInputRules = ''
       iifname "podman*" udp dport 53 accept
       iifname "podman*" tcp dport 53 accept