diff --git a/kubernetes/defaults/main.yml b/kubernetes/defaults/main.yml
index 9f38917..a72d011 100644
--- a/kubernetes/defaults/main.yml
+++ b/kubernetes/defaults/main.yml
@@ -19,10 +19,16 @@ kubernetes:
   token: <shared token for nodes to join>
 
   network:
-    # Copies the current /etc/resolv.conf whilst only keeping "nameserver" lines
-    #  can be used to remove filter
+    # Writes /etc/resolv-k3s.conf (k3s resolv-conf, CoreDNS upstreams) from
+    #  resolv_conf_nameservers
     clean_resolv_conf: false
 
+    # Fixed upstreams, not copied from the node: a copied snapshot goes stale
+    #  when the node's DNS changes and can leave CoreDNS with a single upstream
+    resolv_conf_nameservers:
+      - 1.1.1.1
+      - 9.9.9.9
+
     # One of [none, flannel, calico, cilium]
     plugin: calico
 
diff --git a/kubernetes/tasks/prerequisites.yml b/kubernetes/tasks/prerequisites.yml
index b06ae67..45fde69 100644
--- a/kubernetes/tasks/prerequisites.yml
+++ b/kubernetes/tasks/prerequisites.yml
@@ -45,17 +45,15 @@
          else (ansible_default_ipv6.address | default('')) }}
 
 - block:
-    - name: Read resolv.conf
-      shell: "grep '^nameserver' /etc/resolv.conf"
-      register: nameserver_line
-      changed_when: false
-      check_mode: false
-
-    - name: Write /etc/resolv-k3s.conf with only nameservers
-      copy:
-        content: "{{ nameserver_line.stdout }}"
+    - name: Write /etc/resolv-k3s.conf with the fixed nameservers
+      template:
+        src: resolv-k3s.conf.jinja2
         dest: /etc/resolv-k3s.conf
+        owner: root
+        group: root
+        mode: "0644"
   when: kubernetes.network.clean_resolv_conf is true
+  tags: resolv_conf
 
 - name: Run handlers to reload configurations
   meta: flush_handlers
diff --git a/kubernetes/templates/resolv-k3s.conf.jinja2 b/kubernetes/templates/resolv-k3s.conf.jinja2
new file mode 100644
index 0000000..e9b6a39
--- /dev/null
+++ b/kubernetes/templates/resolv-k3s.conf.jinja2
@@ -0,0 +1,4 @@
+# Managed by Ansible (role kubernetes). Fixed upstreams, not copied from the node.
+{% for nameserver in kubernetes.network.resolv_conf_nameservers %}
+nameserver {{ nameserver }}
+{% endfor %}