diff --git a/dnsmasq/dnsmasq.conf.tmpl b/dnsmasq/dnsmasq.conf.tmpl
new file mode 100644
index 0000000..d1d8ca4
--- /dev/null
+++ b/dnsmasq/dnsmasq.conf.tmpl
@@ -0,0 +1,4 @@
+# Resolve every *.${BASE_DOMAIN} (and the apex) to the Docker host LAN IP.
+# Rendered by tooling/render-config.sh -> dnsmasq/dnsmasq.conf (gitignored).
+address=/${BASE_DOMAIN}/${HOST_LAN_IP}
+no-resolv