diff --git a/flake.lock b/flake.lock
index b8bec1b..3e83c61 100644
--- a/flake.lock
+++ b/flake.lock
@@ -834,11 +834,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1776269462,
-        "narHash": "sha256-9WA/wWlzYaJ2/X2y5YYk80ckhyLmhT5BjUVVR/8H5UY=",
+        "lastModified": 1776784995,
+        "narHash": "sha256-ikxb8cZGWHuZMs3xS471GVrpGA0xW1YFcIVOPTVkhBo=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "9419738cb8576d342fe830b3c317791a200de771",
+        "rev": "e3d40d2cd66a4f8052e4224ec027c6896a455847",
         "type": "github"
       },
       "original": {
@@ -1111,11 +1111,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1776225522,
-        "narHash": "sha256-W2npO5nesUm68vECpC3Dl/IOzamvcGAu9uV38hou2yg=",
+        "lastModified": 1776329215,
+        "narHash": "sha256-a8BYi3mzoJ/AcJP8UldOx8emoPRLeWqALZWu4ZvjPXw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "975dad1a84d727dce241bb41b27191948fa5a956",
+        "rev": "b86751bc4085f48661017fa226dee99fab6c651b",
         "type": "github"
       },
       "original": {
diff --git a/hosts/darwin/default.nix b/hosts/darwin/default.nix
index 1cb49cb..ce92ae0 100644
--- a/hosts/darwin/default.nix
+++ b/hosts/darwin/default.nix
@@ -5,7 +5,47 @@
   inputs,
   ...
 }:
-
+let
+  mossnetResolver = pkgs.writeShellScript "sync-mossnet-resolver" ''
+    set -eu
+
+    resolver_dir=/etc/resolver
+    resolver_file="$resolver_dir/mossnet.lan"
+    lan_dns=192.168.1.240
+    wg_dns=10.0.69.4
+    wanted_dns=""
+
+    resolve_with() {
+      ${pkgs.bind}/bin/dig +time=1 +tries=1 +short @"$1" read.mossnet.lan A >/dev/null 2>&1
+    }
+
+    if ${pkgs.wireguard-tools}/bin/wg show wg0 >/dev/null 2>&1 && resolve_with "$wg_dns"; then
+      wanted_dns="$wg_dns"
+    elif resolve_with "$lan_dns"; then
+      wanted_dns="$lan_dns"
+    fi
+
+    if [ -n "$wanted_dns" ]; then
+      wanted_config="nameserver $wanted_dns"
+      current_config=""
+
+      if [ -f "$resolver_file" ]; then
+        current_config="$(${pkgs.coreutils}/bin/tr -d '\n' < "$resolver_file")"
+      fi
+
+      ${pkgs.coreutils}/bin/mkdir -p "$resolver_dir"
+      if [ "$current_config" != "$wanted_config" ]; then
+        ${pkgs.coreutils}/bin/printf '%s\n' "$wanted_config" > "$resolver_file"
+        /usr/bin/dscacheutil -flushcache
+        /usr/bin/killall -HUP mDNSResponder
+      fi
+    elif [ -f "$resolver_file" ]; then
+      ${pkgs.coreutils}/bin/rm -f "$resolver_file"
+      /usr/bin/dscacheutil -flushcache
+      /usr/bin/killall -HUP mDNSResponder
+    fi
+  '';
+in
 {
   imports = [
     ./sketchybar
@@ -32,7 +72,7 @@
   age.secrets.github-token.owner = "anishlakhwara";
   age.secrets.anthropicToken.file = "${self}/secrets/anthropicToken.age";
   age.secrets.anthropicToken.owner = "anishlakhwara";
-  age.secrets.openaiToken.file = "${self}/secrets/anthropicToken.age";
+  age.secrets.openaiToken.file = "${self}/secrets/openaiToken.age";
   age.secrets.openaiToken.owner = "anishlakhwara";
 
   networking.wg-quick.interfaces = {
@@ -41,17 +81,8 @@
       listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
       privateKeyFile = config.age.secrets.work-wg.path;
       # dns = [ "10.0.69.4" ];
-      postUp = ''
-        sudo mkdir -p /etc/resolver
-        echo "nameserver 10.0.69.4" | sudo tee /etc/resolver/mossnet.lan > /dev/null
-        sudo dscacheutil -flushcache
-        sudo killall -HUP mDNSResponder
-      '';
-      postDown = ''
-        sudo rm -f /etc/resolver/mossnet.lan
-        sudo dscacheutil -flushcache
-        sudo killall -HUP mDNSResponder
-      '';
+      postUp = "${mossnetResolver}";
+      postDown = "${mossnetResolver}";
       peers = [
         # For a client configuration, one peer entry for the server will suffice.
         {
@@ -65,6 +96,14 @@
     };
   };
 
+  launchd.daemons.mossnet-resolver = {
+    serviceConfig = {
+      ProgramArguments = [ "${mossnetResolver}" ];
+      RunAtLoad = true;
+      StartInterval = 60;
+    };
+  };
+
   # Auto upgrade nix package and the daemon service.
   # services.nix-daemon.enable = true; # removed in newer nix-darwin
   nixpkgs.hostPlatform = "aarch64-darwin";