diff --git a/nixos/boxes/colony/vms/estuary/dns.nix b/nixos/boxes/colony/vms/estuary/dns.nix
index 1c51ee7..309ce46 100644
--- a/nixos/boxes/colony/vms/estuary/dns.nix
+++ b/nixos/boxes/colony/vms/estuary/dns.nix
@@ -62,7 +62,11 @@ in
         };
 
         settings = {
-          query-local-address = [ "0.0.0.0" "::" ];
+          query-local-address = [
+            assignments.internal.ipv4.address
+            assignments.internal.ipv6.address
+            assignments.base.ipv6.address
+          ];
           forward-zones = map (z: "${z}=127.0.0.1:5353") authZones;
 
           # DNS NOTIFY messages override TTL