diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 80331efb..f5efd435 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -1025,6 +1025,21 @@ in
     # One-shot: tea config.yml from the seeded forge token. Shape
     # contract (always exit 0, no set -e, skip-silently, re-runnable):
     # docs/conventions.md::Best-effort oneshot services.
+    # Take resolvconf + dhcpcd out of the /etc/resolv.conf loop so the
+    # bridge resolver the oneshot below writes actually sticks. At their
+    # NixOS defaults, resolvconf regenerates resolv.conf from host-tracking
+    # *after* the oneshot has pointed it at the bridge (dhcpcd re-triggers
+    # that when the veth comes up under isolation) — silently clobbering the
+    # bridge nameserver back to the host resolver, which isn't authoritative
+    # for the hive's own zones, so `forge.<domain>` stops resolving. We
+    # disable resolvconf and tell dhcpcd not to touch resolv.conf (without
+    # disabling dhcpcd itself, so the veth still gets its address); then
+    # whoever wrote resolv.conf last owns it: the nixos-container host-copy
+    # in shared netns, or the oneshot in isolated mode. (Same "take
+    # resolvconf out of the loop" approach the matrix container uses.)
+    networking.resolvconf.enable = false;
+    networking.dhcpcd.extraConfig = "nohook resolv.conf";
+
     # Point resolv.conf at the hive bridge resolver when the container is
     # network-isolated. nixos-container copies the *host's* /etc/resolv.conf
     # into the container at every start — but the host resolver (e.g.