diff --git a/hosts/nixserve/default.nix b/hosts/nixserve/default.nix
index 0654e19..b42de03 100644
--- a/hosts/nixserve/default.nix
+++ b/hosts/nixserve/default.nix
@@ -9,6 +9,11 @@
   networking.hostName = "nixserve";
   networking.hostId = "941b956b";
   networking.networkmanager.enable = true;
+  # nixserve's own DNS lookups (e.g. HACS/docker pulls) go to the local Pi-hole
+  # first instead of detouring through Tailscale's DNS proxy -> home router,
+  # which was timing out under HACS's bursty concurrent lookups. Tailscale's
+  # MagicDNS resolver (100.100.100.100) stays as a fallback nameserver.
+  networking.nameservers = [ "127.0.0.1" ];
 
   boot.supportedFilesystems = [ "zfs" ];
   boot.zfs.forceImportRoot = false;
diff --git a/hosts/nixserve/services.nix b/hosts/nixserve/services.nix
index 77d8914..534b7a2 100644
--- a/hosts/nixserve/services.nix
+++ b/hosts/nixserve/services.nix
@@ -67,6 +67,12 @@ in
     enable = true;
     openFirewall = true;
     useRoutingFeatures = "server";
+    # Don't let Tailscale take over nixserve's own DNS resolution: its stub
+    # resolver (100.100.100.100) intermittently times out under bursty lookups
+    # (a known upstream issue, e.g. tailscale/tailscale#6850, #10768, #8829),
+    # which broke HACS updates. nixserve resolves via local Pi-hole instead
+    # (see networking.nameservers in hosts/nixserve/default.nix).
+    extraSetFlags = [ "--accept-dns=false" ];
   };
 
   services.syncthing = {