diff --git a/nix/modules/hive-matrix.nix b/nix/modules/hive-matrix.nix
index 4e620d79..e510de50 100644
--- a/nix/modules/hive-matrix.nix
+++ b/nix/modules/hive-matrix.nix
@@ -352,7 +352,7 @@ in
           # The earlier fix turned host-tracking off and trusted resolvconf
           # to honour `networking.nameservers` — but that's a RUNTIME
           # resolvconf behaviour, not verifiable at eval time, and it STILL
-          # came up empty in practice (#1500). So take resolvconf out of the
+          # came up empty in practice. So take resolvconf out of the
           # loop entirely and write a STATIC `/etc/resolv.conf` from
           # `bridgeIp` that nothing regenerates. Eval-proven: the generated
           # `environment.etc."resolv.conf".text` is `nameserver <bridgeIp>`.
@@ -362,9 +362,11 @@ in
           # resolv.conf. See `docs/network.md`.
           networking = lib.mkMerge [
             (lib.mkIf networkCfg.enable {
+              # resolvconf is taken out of the loop entirely; the static
+              # `environment.etc."resolv.conf"` below is the sole source of
+              # the resolver file (no `nameservers` — nothing would read it).
               useHostResolvConf = lib.mkForce false;
               resolvconf.enable = lib.mkForce false;
-              nameservers = [ networkCfg.bridgeIp ];
             })
             (lib.mkIf (!networkCfg.enable) {
               useHostResolvConf = true;