diff --git a/README.md b/README.md
index fe4945c..a11033e 100644
--- a/README.md
+++ b/README.md
@@ -301,7 +301,11 @@ stopped on the new host while its directory is copied:
 
 1. **DNS** (operator, Gandi zone `commoninternet.net`): A records `ci`, `*.ci` and `ns-acme` →
    the new IPv4. `acme NS ns-acme` and `_acme-challenge.ci CNAME <account>.acme…` stay as they
-   are. Wait for propagation (`dig +short ci.commoninternet.net`).
+   are. Wait for propagation (`dig +short ci.commoninternet.net`) — the records carry a 3 h TTL,
+   and resolvers that cached the old answer (the Hetzner ones in particular) keep serving it that
+   long. The new host must not list such a resolver: with a mixed set, every other lookup of its
+   own names went to the old server on 2026-09-07 (runner/bridge 404s). `networking.nix` drops
+   the Hetzner resolvers and `configuration.nix` pins the host's own names.
 2. Check the new host answers on the new IP before DNS moves: `dig @<new-ip> ns-acme.commoninternet.net`
    (acme-dns), `curl --resolve ci.commoninternet.net:443:<new-ip> https://ci.commoninternet.net/`
    (dashboard, valid cert), same for `report.ci` and `drone.ci`.
diff --git a/nix/hosts/cc-ci/configuration.nix b/nix/hosts/cc-ci/configuration.nix
index 1f4ef94..5ae76b9 100644
--- a/nix/hosts/cc-ci/configuration.nix
+++ b/nix/hosts/cc-ci/configuration.nix
@@ -79,6 +79,17 @@
   };
 
   networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
+  # This host's own public names resolve to itself regardless of external DNS state (host
+  # processes: the drone runner, the harness, the orchestrator; containers use the resolvers
+  # above). Per-run recipe domains are random and cannot be pinned — those follow public DNS.
+  networking.hosts."195.201.88.249" = [
+    "ci.commoninternet.net"
+    "drone.ci.commoninternet.net"
+    "report.ci.commoninternet.net"
+    "traefik.ci.commoninternet.net"
+    "warm-keycloak.ci.commoninternet.net"
+    "oc.ci.commoninternet.net"
+  ];
 
   # ---- memory: 8 GB RAM shared by the swarm (recipe deploys) and 3–6 agent sessions ---------
   swapDevices = [ { device = "/swapfile"; size = 8192; } ];
diff --git a/nix/hosts/cc-ci/networking.nix b/nix/hosts/cc-ci/networking.nix
index d3aa712..8fd73b6 100644
--- a/nix/hosts/cc-ci/networking.nix
+++ b/nix/hosts/cc-ci/networking.nix
@@ -5,10 +5,12 @@
   # This file was populated at runtime with the networking
   # details gathered from the active system.
   networking = {
-    nameservers = [ "2a01:4ff:ff00::add:2"
- "2a01:4ff:ff00::add:1"
- "185.12.64.2"
- ];
+    # The Hetzner resolvers nixos-infect wrote here are deliberately gone: configuration.nix sets
+    # 1.1.1.1/8.8.8.8. During the 2026-09-07 cutover the Hetzner caches kept the OLD address for
+    # the full 3h TTL while the public resolvers already had the new one, and every other lookup
+    # of drone.ci.commoninternet.net from this box went to the old server (404s in the runner and
+    # the bridge). One consistent resolver set, and the host's own names pinned in
+    # configuration.nix, keep the CI independent of that.
     defaultGateway = { address = "172.31.1.1"; interface = "eth0"; };
     defaultGateway6 = {
       address = "fe80::1";