diff --git a/ops/nixos/lib/common.nix b/ops/nixos/lib/common.nix
index 23b990e719..53b3f0cf54 100644
--- a/ops/nixos/lib/common.nix
+++ b/ops/nixos/lib/common.nix
@@ -76,6 +76,7 @@ in
     services.resolved = {
       enable = true;
       llmnr = "false";  # LLMNR breaks search domains.
+      dnssec = "false";  # DNSSEC support in systemd-resolved is just broken.
       domains = config.networking.search;
       extraConfig = ''
         # For global search domains to work, we also need global DNS servers.