diff --git a/default/systemd/resolved.conf b/default/systemd/resolved.conf
new file mode 100644
index 00000000..5c4adafa
--- /dev/null
+++ b/default/systemd/resolved.conf
@@ -0,0 +1,4 @@
+[Resolve]
+DNS=1.1.1.1
+FallbackDNS=8.8.8.8
+DNSStubListener=yes
diff --git a/install/config/config.sh b/install/config/config.sh
index 4f08303a..27be0ff6 100644
--- a/install/config/config.sh
+++ b/install/config/config.sh
@@ -26,6 +26,9 @@ sudo gpgconf --launch dirmngr || true
 sudo sed -i 's|^\(auth\s\+required\s\+pam_faillock.so\)\s\+preauth.*$|\1 preauth silent deny=10 unlock_time=120|' "/etc/pam.d/system-auth"
 sudo sed -i 's|^\(auth\s\+\[default=die\]\s\+pam_faillock.so\)\s\+authfail.*$|\1 authfail deny=10 unlock_time=120|' "/etc/pam.d/system-auth"
 
+# Set Cloudflare as primary DNS (with Google as backup)
+sudo cp ~/.local/share/omarchy/default/systemd/resolved.conf /etc/systemd/
+
 # Set common git aliases
 git config --global alias.co checkout
 git config --global alias.br branch