diff --git a/hosts/cirrus/configuration.nix b/hosts/cirrus/configuration.nix
index 56996f7..3c02b32 100644
--- a/hosts/cirrus/configuration.nix
+++ b/hosts/cirrus/configuration.nix
@@ -23,7 +23,7 @@
       matchConfig = { Name = "enp1s0"; };
       networkConfig = {
         Address = "95.216.166.21/32";
-        DNS = "1.1.1.1";
+        DNS = "9.9.9.9";
       };
       routes = [
         {
diff --git a/hosts/toaster/network.nix b/hosts/toaster/network.nix
index 018e9a3..a2d1316 100644
--- a/hosts/toaster/network.nix
+++ b/hosts/toaster/network.nix
@@ -13,6 +13,12 @@
   services.resolved = {
     enable = true;
     dnssec = "allow-downgrade";
+    fallbackDns = [
+      "9.9.9.9"
+      "2620:fe::fe"
+      "149.112.112.112"
+      "2620:fe::9"
+    ];
   };
 
   # workaround for networkd waiting for shit