diff --git a/modules/build-types/gui.nix b/modules/build-types/gui.nix
index 4215bd4..3627f88 100644
--- a/modules/build-types/gui.nix
+++ b/modules/build-types/gui.nix
@@ -38,7 +38,10 @@
     pulse.enable = true;
   };
 
-  users.users.nixos.extraGroups = [ "networkmanager" ];
+  # The networkmanager group only exists when NM is actually enabled — the
+  # lxc platform module force-disables it, so don't add the user to a group
+  # that won't exist there.
+  users.users.nixos.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];
 
   programs.firefox.enable = true;
 
diff --git a/modules/build-types/minimal.nix b/modules/build-types/minimal.nix
index f0a0733..9853475 100644
--- a/modules/build-types/minimal.nix
+++ b/modules/build-types/minimal.nix
@@ -1,9 +1,12 @@
-{ pkgs, ... }:
+{ lib, pkgs, config, ... }:
 
 {
   networking.networkmanager.enable = true;
 
-  users.users.nixos.extraGroups = [ "networkmanager" ];
+  # The networkmanager group only exists when NM is actually enabled — the
+  # lxc platform module force-disables it, so don't add the user to a group
+  # that won't exist there.
+  users.users.nixos.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];
 
   environment.systemPackages = with pkgs; [
     inetutils
diff --git a/modules/platforms/lxc.nix b/modules/platforms/lxc.nix
index 412e3e2..2d26aae 100644
--- a/modules/platforms/lxc.nix
+++ b/modules/platforms/lxc.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ lib, ... }:
 
 {
   boot.isContainer = true;
@@ -11,4 +11,20 @@
   # file doesn't correctly launch the current generation, so even a
   # correctly-installed system can fail to come up after reboot.
   boot.loader.initScript.enable = true;
+
+  # boot.isContainer disables services.udev (see nixpkgs'
+  # virtualisation/container-config.nix), and NetworkManager depends on a
+  # running udevd to enumerate/classify devices. That leaves NM unable to
+  # reliably manage the container's veth interface, which is what broke
+  # DHCP-hostname registration in Pi-hole. systemd-networkd talks to the
+  # kernel over rtnetlink directly and doesn't have that dependency.
+  networking.networkmanager.enable = lib.mkForce false;
+  networking.useNetworkd = true;
+
+  # container-config.nix also defaults this to true, which assumes a
+  # systemd-nspawn-style host bind-mount of /etc/resolv.conf. Real Proxmox
+  # LXC doesn't do that (nixpkgs' own virtualisation/proxmox-lxc.nix module
+  # forces this false for the same reason), so leaving it true silently
+  # breaks DNS instead of falling back to networkd/DHCP-provided servers.
+  networking.useHostResolvConf = lib.mkForce false;
 }