diff --git a/ap/systemd-resolved-disable.conf b/ap/systemd-resolved-disable.conf
new file mode 100644
index 0000000..8fdfd73
--- /dev/null
+++ b/ap/systemd-resolved-disable.conf
@@ -0,0 +1,4 @@
+[Unit]
+# Disable DNS listener - dnsmasq handles DNS+DHCP on bridge
+# Even localhost-only listening blocks dnsmasq from binding to port 53
+ConditionVirtualization=!container
diff --git a/deploy.sh b/deploy.sh
index f55ffe3..2b71a6f 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -150,6 +150,9 @@ install -D -m0644 ap/rtw89.conf             /etc/modprobe.d/rtw89.conf
 install -D -m0644 ap/99-van-router.conf     /etc/sysctl.d/99-van-router.conf
 
 echo "== dns =="
+# Disable systemd-resolved DNS listener — dnsmasq handles DNS+DHCP on bridge.
+# Even localhost-only listening blocks dnsmasq from binding to port 53.
+install -D -m0644 ap/systemd-resolved-disable.conf /etc/systemd/system/systemd-resolved.service.d/disable.conf
 # Fixed upstream resolvers (deploy.conf's DNS_RESOLVERS), never a WAN's own
 # DHCP/RA-provided DNS — see the files themselves for the full rationale.
 # (NM's ipv4/ipv6.ignore-auto-dns can't be set as a config-file connection