diff --git a/cloud-init/user-data-alpine.yml.tftpl b/cloud-init/user-data-alpine.yml.tftpl
index 1148f5e..10763c6 100644
--- a/cloud-init/user-data-alpine.yml.tftpl
+++ b/cloud-init/user-data-alpine.yml.tftpl
@@ -15,10 +15,14 @@ users:
     ssh_authorized_keys:
       - ${ssh_key}
 
-# 3. apk repositories configuration
-# Pin the two repositories used on this homelab: edge/main + edge/community.
-# Written BEFORE package_update/package_upgrade so apk uses this config immediately.
+# 3. Base system files (DNS + apk repos, written before package_update)
+# Alpine has no netplan/systemd-resolved, so we write resolv.conf ourselves.
 write_files:
+  - path: /etc/resolv.conf
+    owner: root:root
+    permissions: '0644'
+    content: |
+      nameserver ${dns_server}
   - path: /etc/apk/repositories
     owner: root:root
     permissions: '0644'
diff --git a/terraform/prod/02-cloud-init.tf b/terraform/prod/02-cloud-init.tf
index 9fa72ab..ec3217c 100644
--- a/terraform/prod/02-cloud-init.tf
+++ b/terraform/prod/02-cloud-init.tf
@@ -33,6 +33,9 @@ resource "proxmox_virtual_environment_file" "cloud_config" {
         # VM information
         hostname = "${each.key}.${var.domain_suffix}"
 
+        # Network (used by templates that need to write /etc/resolv.conf themselves, e.g. Alpine)
+        dns_server = var.dns_servers[0]
+
         # Tailscale variables
         vm_name            = each.key
         tailscale_auth_key = var.tailscale_auth_key