diff --git a/modules/nixos/network.nix b/modules/nixos/network.nix
index fce7b48..9c948d9 100644
--- a/modules/nixos/network.nix
+++ b/modules/nixos/network.nix
@@ -1,12 +1,19 @@
 {
   host,
+  config,
+  lib,
   pkgs,
   ...
 }:
 {
   networking = {
     hostName = "${host}";
-    networkmanager.enable = true;
+    networkmanager = {
+      enable = true;
+      # resolved is only enabled when tailscale is; pointing NM at a
+      # systemd-resolved that isn't running would break DNS entirely
+      dns = lib.mkIf config.services.resolved.enable "systemd-resolved";
+    };
     wireless.enable = true;
   };
 
diff --git a/modules/nixos/tailscale.nix b/modules/nixos/tailscale.nix
index 781bcbf..ee15a68 100644
--- a/modules/nixos/tailscale.nix
+++ b/modules/nixos/tailscale.nix
@@ -10,5 +10,12 @@ in
 {
   config = mkIf cfg.enable {
     services.tailscale.enable = true;
+
+    # systemd-resolved is needed for tailscale's MagicDNS to work properly
+    services.resolved.enable = true;
+
+    # tailscaled applies its DNS config (split DNS, MagicDNS) to
+    # systemd-resolved over D-Bus, which is polkit-guarded
+    security.polkit.enable = true;
   };
 }