diff --git a/nix/modules/hive-matrix.nix b/nix/modules/hive-matrix.nix
index 9a6ddf9c..b63cd224 100644
--- a/nix/modules/hive-matrix.nix
+++ b/nix/modules/hive-matrix.nix
@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.services.hyperhive.matrix;
+  networkCfg = config.services.hyperhive.network;
   hyperhiveDomain = config.services.hyperhive.domain;
   effectiveServerName = if cfg.serverName != null then cfg.serverName else hyperhiveDomain;
 
@@ -337,6 +338,29 @@ in
         { ... }:
         {
           system.stateVersion = "26.05";
+
+          # tuwunel hard-fails to boot if `/etc/resolv.conf` has no
+          # `nameserver` line (`Failed to configure DNS resolver ... no
+          # nameservers found in config` → exit 1). This declarative
+          # nixos-container generates its own resolv.conf via resolvconf
+          # and — unlike agent containers, whose resolv.conf is written by
+          # hive-c0re's lifecycle — it has no nameserver source, so it
+          # comes up empty (just `options edns0`). When the hive network
+          # module is on, point it at the dnsmasq resolver the module runs
+          # at `bridgeIp`; this container always shares the host netns
+          # (`privateNetwork = false`), so it reaches `bridgeIp` whether or
+          # not `isolateContainers` is set. With the network module off,
+          # inherit the host's resolv.conf (which carries the host
+          # resolver). See `docs/network.md`.
+          networking = lib.mkMerge [
+            (lib.mkIf networkCfg.enable {
+              nameservers = [ networkCfg.bridgeIp ];
+            })
+            (lib.mkIf (!networkCfg.enable) {
+              useHostResolvConf = true;
+            })
+          ];
+
           services.matrix-tuwunel = {
             enable = true;
             package = cfg.package;