diff --git a/modules/build-types/pxe-boot.nix b/modules/build-types/pxe-boot.nix
index 5006c7d..16a43b5 100644
--- a/modules/build-types/pxe-boot.nix
+++ b/modules/build-types/pxe-boot.nix
@@ -423,6 +423,10 @@ in
   services.dnsmasq = {
     enable = true;
     settings = {
+      # Disable DNS listener — only proxy DHCP is needed here.
+      # Without this dnsmasq tries to bind port 53 which systemd-resolved
+      # already owns, causing startup failure.
+      port = 0;
       dhcp-range = [ "192.168.2.0,proxy" ];
       dhcp-match = [
         "set:ipxe,175"