diff --git a/modules/build-types/pxe-boot.nix b/modules/build-types/pxe-boot.nix
index 1f59723..d3626d7 100644
--- a/modules/build-types/pxe-boot.nix
+++ b/modules/build-types/pxe-boot.nix
@@ -417,6 +417,27 @@ in
           ExecStart = stageSystemRescue;
         };
       };
+      dnsmasq = {
+        enable = true;
+        settings = {
+          # Proxy mode: respond only to PXE DHCP requests, leave normal leases to router
+          dhcp-range = [ "192.168.2.0,proxy" ];
+          # iPXE client detection
+          dhcp-match = [
+            "set:ipxe,175"
+            "set:efi64,option:client-arch,7"
+            "set:efi64,option:client-arch,9"
+          ];
+          dhcp-userclass = "set:ipxe,iPXE";
+          # Boot file selection
+          dhcp-boot = [
+            "tag:ipxe,tag:efi64,http://${vars.pxeServerIp}/boot.ipxe"
+            "tag:ipxe,http://${vars.pxeServerIp}/boot.ipxe"
+            "tag:efi64,ipxe.efi,,${vars.pxeServerIp}"
+            "undionly.kpxe,,${vars.pxeServerIp}"
+          ];
+        };
+      };
     };
   };