diff --git a/common.nix b/common.nix
index a5d95a3..34a4894 100644
--- a/common.nix
+++ b/common.nix
@@ -67,7 +67,6 @@
 
   # Enable network-manager
   networking.networkmanager.enable = true;
-  networking.nameservers = [ "1.1.1.1" "9.9.9.9" ];
 
   # Fish shell
   programs.fish.enable = true;
@@ -87,5 +86,6 @@
       git
       localsend
       nvd
+      busybox
   ];
 }
diff --git a/services/adguard.nix b/services/adguard.nix
index 109e2eb..5b69a28 100644
--- a/services/adguard.nix
+++ b/services/adguard.nix
@@ -8,8 +8,8 @@
       # Web UI bound to localhost; nginx reverse-proxies at adguard.nordhammer.it
       host = "127.0.0.1";
       port = 3000;
-      # Allow UI changes (blocklists, rules, clients) to persist
-      mutableSettings = true;
+      # Nix is authoritative: settings below overwrite UI-made changes on rebuild
+      mutableSettings = false;
       settings = {
         dns = {
           bind_hosts = [ "0.0.0.0" ];