diff --git a/modules/programs/gui/zen/preferences.nix b/modules/programs/gui/zen/preferences.nix
index 8905162..fefb609 100644
--- a/modules/programs/gui/zen/preferences.nix
+++ b/modules/programs/gui/zen/preferences.nix
@@ -418,7 +418,10 @@
           # keep-sorted start
           auth.subresource-http-auth-allow = 1;
           ssl_tokens_cache_capacity = 32768;
-          trr.mode = 2;
+          # TRR off: system resolver (NextDNS DoT via systemd-resolved) is the
+          # single DNS path. Firefox DoH defaults to Cloudflare in NL,
+          # which bypasses NextDNS filtering.
+          trr.mode = 0;
           # keep-sorted end
 
           # keep-sorted start
diff --git a/modules/programs/tui/neovim/components/copilot.nix b/modules/programs/tui/neovim/components/copilot.nix
new file mode 100644
index 0000000..2ddf428
--- /dev/null
+++ b/modules/programs/tui/neovim/components/copilot.nix
@@ -0,0 +1,39 @@
+{
+  flake.modules.homeManager.neovim = {pkgs, ...}: {
+    programs.nvf.settings.vim = {
+      luaConfigPreSnippets = [
+        "vim.g.copilot_nes_debounce = 500"
+      ];
+
+      assistant.copilot = {
+        enable = true;
+
+        setupOpts = {
+          # Ghost text suggestions fire without manual trigger.
+          suggestion.auto_trigger = true;
+
+          nes = {
+            enabled = true;
+
+            keymap = {
+              # keep-sorted start
+              accept = false;
+              accept_and_goto = "<leader>p";
+              dismiss = "<Esc>";
+              # keep-sorted end
+            };
+          };
+        };
+      };
+
+      lazy.plugins."copilot-lsp" = {
+        package = pkgs.vimPlugins.copilot-lsp;
+
+        event = {
+          event = "User";
+          pattern = "LazyFile";
+        };
+      };
+    };
+  };
+}
diff --git a/modules/services/network/network.nix b/modules/services/network/network.nix
index 27944f6..6d55b60 100644
--- a/modules/services/network/network.nix
+++ b/modules/services/network/network.nix
@@ -52,8 +52,28 @@
         dns = "systemd-resolved";
         plugins = [pkgs.networkmanager-openvpn];
 
-        # Prefer temporary IPv6 addresses for outbound connections.
-        settings.connection."ipv6.ip6-privacy" = 2;
+        settings = {
+          connection = {
+            # Keep DHCP-provided DNS out of resolved's link scope. Otherwise
+            # the router server outranks the global NextDNS list for ~.
+            # routing and queries leak past NextDNS filtering.
+            "ipv4.ignore-auto-dns" = true;
+            "ipv6.ignore-auto-dns" = true;
+
+            # Prefer temporary IPv6 addresses for outbound connections.
+            "ipv6.ip6-privacy" = 2;
+          };
+
+          # Prefer temporary Mac's addresses for outbound connections.
+          ethernet."cloned-mac-address" = "random";
+
+          wifi = {
+            # Random scan MACs keep identity off the air between connections.
+            "mac-address-randomization" = 1;
+            "cloned-mac-address" = "random";
+          };
+        };
+        # keep-sorted end
       };
     };
 
@@ -62,11 +82,12 @@
     services.resolved = {
       enable = true;
       settings.Resolve = {
-        DNSOverTLS = "opportunistic";
-
         # Prefer the global servers over per-link DNS from DHCP.
         Domains = ["~."];
 
+        DNSOverTLS = "opportunistic";
+
+        # Cloudflare fallbacks cover NextDNS outages.
         FallbackDNS = [
           # keep-sorted start
           "1.0.0.1#cloudflare-dns.com"