diff --git a/kubernetes/talos/patches/site-homelab.yaml b/kubernetes/talos/patches/site-homelab.yaml
index f0607281..4f790a2d 100644
--- a/kubernetes/talos/patches/site-homelab.yaml
+++ b/kubernetes/talos/patches/site-homelab.yaml
@@ -51,3 +51,13 @@ kind: RoutingRuleConfig
 name: "1001"
 src: 10.244.0.0/16
 table: "47"
+---
+# Host DNS asks k8s-gateway first, so containerd resolves in-cluster names
+# (gitea.renner.uno) in the cluster. The UDM answers while k8s-gateway is not
+# reachable yet; Talos moves on after a 2 s read timeout. This list replaces
+# the nameservers from DHCP.
+apiVersion: v1alpha1
+kind: ResolverConfig
+nameservers:
+  - address: 10.96.0.11
+  - address: 10.2.40.1