diff --git a/services/nginx.nix b/services/nginx.nix
index f718a92..1a70a18 100644
--- a/services/nginx.nix
+++ b/services/nginx.nix
@@ -62,6 +62,8 @@ in
         domain = "*.nordhammer.it";
         extraDomainNames = [ "nordhammer.it" ];
         dnsProvider = "cloudflare";
+        # AdGuard's local rewrite swallows SOA lookups, breaking lego's zone detection
+        dnsResolver = "1.1.1.1:53";
         credentialFiles = {
           "CF_DNS_API_TOKEN_FILE" = "/var/secrets/cloudflare-token";
         };