@@ -48,6 +48,9 @@ mainProvider = dnsProviders.quad9;
 
   lanCfg = config.systemd.network.networks."40-${lan}";
   myAddresses = map netlib.removeMask lanCfg.address;
+  dnsAddresses = map netlib.removeMask (
+    lib.filter (a: a ? Label && a.Label == "dns") lanCfg.addresses
+  );
 in
 {
   imports = [
@@ -133,6 +136,22 @@ {
             Address = "fe80::1/64";
             Scope = "link";
           }
+          {
+            Address = "10.0.0.53/32";
+            Label = "dns";
+          }
+          {
+            Address = "${ulaPrefix}::53/48";
+            AddPrefixRoute = false;
+            Label = "dns"; # ignored in networkd, used for filtering here
+          }
+        ];
+        routes = [
+          {
+            Destination = "${ulaPrefix}::/48";
+            Metric = 128;
+            PreferredSource = "${ulaPrefix}:42::1";
+          }
         ];
         networkConfig = {
           IPv6AcceptRA = false;
@@ -142,7 +161,7 @@ MulticastDNS = true;
           Domains = [ config.networking.domain ];
           LinkLocalAddressing = "ipv6"; # required for networkd RA despite fe80::1 static assignment
           DNSOverTLS = false;
-          DNS = map (a: "${netlib.wrapv6 a}:${toString config.services.dnsmasq.settings.port}") myAddresses;
+          DNS = map netlib.wrapv6 myAddresses;
           DNSDefaultRoute = false;
           IPv6SendRA = true;
         };
@@ -156,7 +175,7 @@ };
         ipv6SendRAConfig = {
           Managed = true;
           OtherInformation = true;
-          DNS = builtins.filter netlib.isv6 myAddresses ++ [ "_link_local" ];
+          DNS = builtins.filter netlib.isv6 dnsAddresses;
         };
         ipv6Prefixes = [
           {
@@ -230,12 +249,13 @@ };
 
   services.adguardhome.settings =
     let
-      mkHostPort = (addr: "${netlib.wrapv6 addr}:${toString config.services.dnsmasq.settings.port}");
-      dnsmasqAddrs = map mkHostPort (builtins.filter netlib.isv6 myAddresses);
+      dnsmasqAddrs = map netlib.wrapv6 myAddresses;
       mkTLSHost = p: "tls://${p.hostname}";
     in
     {
       dns = {
+        bind_hosts = dnsAddresses;
+
         upstream_dns = (map mkTLSHost allProviders) ++ [
           # [/domain1/domain2/domainN/]upstreamString
           "[/${domain}/]${lib.strings.join " " dnsmasqAddrs}"
@@ -297,11 +317,9 @@ enable = true;
     alwaysKeepRunning = true;
     resolveLocalQueries = false;
     settings = {
-      domain = "${domain}";
-      interface = [
-        lan
-      ];
-      port = 5553;
+      domain = domain;
+      listen-address = myAddresses;
+      bind-interfaces = true;
       enable-ra = false;
 
       dhcp-fqdn = true;
@@ -322,14 +340,23 @@ addn-hosts = [ "/etc/dnsmasq-hosts" ];
 
       dhcp-option = [
         # 0.0.0.0 means the address of the system running dnsmasq
-        "option:dns-server,0.0.0.0"
-        "option:ntp-server,0.0.0.0"
-
         # [::] means the *global* address of the system running dnsmasq
         # [fd00::] refers to a ULA
         # [fe80::] refers to a link-local address
-        "option6:dns-server,[fd00::],[fe80::]"
-      ];
+        "option:ntp-server,0.0.0.0"
+      ]
+      ++ (
+        if config.services.adguardhome.enable then
+          [
+            "option:dns-server,10.0.0.53"
+            "option6:dns-server,[${ulaPrefix}::53]"
+          ]
+        else
+          [
+            "option:dns-server,0.0.0.0"
+            "option6:dns-server,[fd00::],[fe80::]"
+          ]
+      );
 
       no-resolv = true;
       dns-loop-detect = true;