diff --git a/ansible/roles/netbird-server/tasks/main.yml b/ansible/roles/netbird-server/tasks/main.yml
index 27eaae23..3b07e3a1 100644
--- a/ansible/roles/netbird-server/tasks/main.yml
+++ b/ansible/roles/netbird-server/tasks/main.yml
@@ -157,6 +157,29 @@
   ansible.builtin.pause:
     seconds: 10
 
+# The host's mesh client must not manage DNS: containers here resolve through
+# the host stub, and the renner.uno nameserver group is unreachable from it.
+- name: Check for the host NetBird client
+  ansible.builtin.stat:
+    path: /usr/bin/netbird
+  register: _netbird_client
+
+- name: Read the host NetBird client config
+  ansible.builtin.command: netbird debug config
+  register: _netbird_client_config
+  changed_when: false
+  when: _netbird_client.stat.exists
+
+# disable-dns is only applied on a fresh `up`, not to a connected client.
+- name: Reconnect the host NetBird client with DNS management disabled
+  ansible.builtin.shell: |
+    set -eu
+    netbird down
+    netbird up --disable-dns
+  when:
+    - _netbird_client.stat.exists
+    - not (_netbird_client_config.stdout | from_json).disableDns
+
 - name: Display deployment status
   ansible.builtin.debug:
     msg: |