diff --git a/docker-compose.yml b/docker-compose.yml
index 342db74..e6fbd5a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,6 +8,24 @@
 # ──────────────────────────────────────────────────────────────────
 
 services:
+  dnsmasq:
+    image: jpillora/dnsmasq
+    container_name: dnsmasq
+    restart: unless-stopped
+    ports:
+      # Bind DNS to the host LAN IP so it doesn't clash with systemd-resolved on :53.
+      - "${HOST_LAN_IP}:53:53/udp"
+      - "${HOST_LAN_IP}:53:53/tcp"
+    volumes:
+      - ./dnsmasq/dnsmasq.conf:/etc/dnsmasq.conf:ro
+    networks:
+      - mcnet
+    # The webproc UI (:8080) can be exposed later behind Caddy as dns.${BASE_DOMAIN};
+    # guard it with HTTP_USER / HTTP_PASS env vars.
+    # environment:
+    #   HTTP_USER: "admin"
+    #   HTTP_PASS: "change-me"
+
   drasl:
     image: unmojang/drasl:latest
     container_name: drasl