diff --git a/Caddyfile b/Caddyfile
index b58997e..61f8f27 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -401,8 +401,13 @@ webui.ginnoir.com {
 
 # ComfyUI node editor — inference runs on the Mac at 192.168.1.121 (Metal/MPS).
 # LAN/tailnet only; no Authentik (WebSocket queue/progress breaks under forward_auth).
-# Hostname imgstudio (not comfyui): _acme-challenge.comfyui.ginnoir.com embeds a
-# false ".com" that breaks Cloudflare DNS-01 zone lookup.
+#
+# The explicit `resolvers` below is what made DNS-01 work here, not the imgstudio
+# hostname (an earlier comment blamed a "false .com" in comfyui.ginnoir.com —
+# that was wrong). The LAN resolver returns NODATA for `SOA ginnoir.com`, so
+# certmagic's zone lookup climbs to `com.` and Cloudflare rejects it. The caddy
+# container now pins public resolvers stack-wide (stacks/proxy/docker-compose.yml),
+# making this block redundant; kept as belt-and-braces.
 imgstudio.ginnoir.com {
 	import internal_only
 	tls {
diff --git a/stacks/proxy/docker-compose.yml b/stacks/proxy/docker-compose.yml
index 09ebd78..8dfbf52 100644
--- a/stacks/proxy/docker-compose.yml
+++ b/stacks/proxy/docker-compose.yml
@@ -19,6 +19,21 @@ services:
     restart: unless-stopped
     labels:
       - "com.centurylabs.watchtower.enable=false"
+    # Public resolvers for ACME DNS-01 zone detection.
+    #
+    # The LAN resolver (OPNsense Unbound, 192.168.1.1) is authoritative for
+    # ginnoir.com via the split-horizon override, but its local-zone only holds
+    # A records — so `SOA ginnoir.com` returns NODATA. certmagic's zone lookup
+    # walks up the label chain looking for an SOA, finds none at ginnoir.com,
+    # climbs to `com.`, and asks Cloudflare for a `com` zone. Result:
+    #   "adding temporary record for zone \"com.\": expected 1 zone, got 0"
+    # and every DNS-01 renewal fails until certs expire.
+    #
+    # Docker's embedded DNS (127.0.0.11) still resolves container names and the
+    # gitea.ginnoir.com alias below; only external lookups go to Cloudflare.
+    dns:
+      - 1.1.1.1
+      - 1.0.0.1
     networks:
       edge:
         aliases: