diff --git a/host-specific/misaki/services.nix b/host-specific/misaki/services.nix
index e97fbbc..04108a6 100644
--- a/host-specific/misaki/services.nix
+++ b/host-specific/misaki/services.nix
@@ -305,12 +305,22 @@ in
         hosts ${./coredns/packetlost.dev.hosts} packetlost.dev {
           fallthrough
         }
+        # Forward names not defined in the LAN hosts file, including ACME DNS-01.
+        forward . tls://2a07:a8c0::dd:2feb:853 tls://2a07:a8c1::dd:2feb:853 tls://45.90.28.93:853 tls://45.90.30.93:853 {
+          tls_servername dd2feb.dns.nextdns.io
+          health_check 5s
+        }
         bind enp4s0f1
       }
       ngp.computer {
         hosts ${./coredns/ngp.computer.hosts} ngp.computer {
           fallthrough
         }
+        # Forward names not defined in the LAN hosts file, including ACME DNS-01.
+        forward . tls://2a07:a8c0::dd:2feb:853 tls://2a07:a8c1::dd:2feb:853 tls://45.90.28.93:853 tls://45.90.30.93:853 {
+          tls_servername dd2feb.dns.nextdns.io
+          health_check 5s
+        }
         bind enp4s0f1
       }
       localhost {
diff --git a/users.nix b/users.nix
index 0d334f7..0cdfe0c 100644
--- a/users.nix
+++ b/users.nix
@@ -57,7 +57,7 @@
           name = "chiefnoah.keys";
           # Update this with:
           # `curl https://meta.sr.ht/~chiefnoah.keys | sha256sum`
-          sha256 = "1lzc76ic41qc915irzbilbcci4n031hdszq4k8m6xz9qqjpcjhhg";
+          sha256 = "0mc2sbz3546q4llq5hmzw6j8ba1s6xiza0vs7zw177fhv9ra8yrw";
         }
       )
     );