diff --git a/kubernetes/ansible/playbooks/site.yml b/kubernetes/ansible/playbooks/site.yml
index 10efddd..7d66720 100644
--- a/kubernetes/ansible/playbooks/site.yml
+++ b/kubernetes/ansible/playbooks/site.yml
@@ -35,10 +35,18 @@
 - name: Install Cilium CNI
   hosts: master[0]
   gather_facts: false
+  tags: [cilium]
   tasks:
     - name: Import Cilium tasks
       ansible.builtin.import_tasks: tasks/cilium.yml
 
+- name: Configure CoreDNS
+  hosts: master[0]
+  gather_facts: false
+  tasks:
+    - name: Import CoreDNS tasks
+      ansible.builtin.import_tasks: tasks/coredns.yml
+
 - name: Install Rook-Ceph storage
   hosts: master[0]
   gather_facts: false
diff --git a/kubernetes/ansible/playbooks/tasks/cilium.yml b/kubernetes/ansible/playbooks/tasks/cilium.yml
index 47024b1..05bd718 100644
--- a/kubernetes/ansible/playbooks/tasks/cilium.yml
+++ b/kubernetes/ansible/playbooks/tasks/cilium.yml
@@ -68,35 +68,6 @@
   retries: 30
   delay: 15
 
-- name: Run CoreDNS in the node network namespace
-  kubernetes.core.k8s:
-    state: patched
-    definition:
-      apiVersion: apps/v1
-      kind: Deployment
-      metadata:
-        name: coredns
-        namespace: kube-system
-      spec:
-        template:
-          spec:
-            hostNetwork: true
-            dnsPolicy: ClusterFirstWithHostNet
-
-- name: Wait for CoreDNS to be ready
-  kubernetes.core.k8s_info:
-    kind: Pod
-    namespace: kube-system
-    label_selectors:
-      - k8s-app=kube-dns
-  register: coredns_pods
-  until: >-
-    coredns_pods.resources | default([]) | length >= 2 and
-    coredns_pods.resources | default([]) | map(attribute='status.conditions') | flatten |
-    selectattr('type', 'equalto', 'Ready') | selectattr('status', 'equalto', 'True') | list | length >= 2
-  retries: 30
-  delay: 15
-
 - name: Wait for all nodes to be Ready
   kubernetes.core.k8s_info:
     kind: Node
diff --git a/kubernetes/ansible/playbooks/tasks/coredns.yml b/kubernetes/ansible/playbooks/tasks/coredns.yml
new file mode 100644
index 0000000..18a02b9
--- /dev/null
+++ b/kubernetes/ansible/playbooks/tasks/coredns.yml
@@ -0,0 +1,33 @@
+---
+# CoreDNS runs host-networked because kubelet liveness probes to local pod IPs
+# are unreliable over Cilium's IPv6 host path (see docs/debugging.md 2026-08-19).
+# Kept separate from Cilium installation so the Nixidy deployment path
+# (docs/nixidy.md Phase 3) can skip Cilium while still applying this patch.
+- name: Run CoreDNS in the node network namespace
+  kubernetes.core.k8s:
+    state: patched
+    definition:
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: coredns
+        namespace: kube-system
+      spec:
+        template:
+          spec:
+            hostNetwork: true
+            dnsPolicy: ClusterFirstWithHostNet
+
+- name: Wait for CoreDNS to be ready
+  kubernetes.core.k8s_info:
+    kind: Pod
+    namespace: kube-system
+    label_selectors:
+      - k8s-app=kube-dns
+  register: coredns_pods
+  until: >-
+    coredns_pods.resources | default([]) | length >= 2 and
+    coredns_pods.resources | default([]) | map(attribute='status.conditions') | flatten |
+    selectattr('type', 'equalto', 'Ready') | selectattr('status', 'equalto', 'True') | list | length >= 2
+  retries: 30
+  delay: 15