diff --git a/iso/build-live-iso.sh b/iso/build-live-iso.sh
index 7f0ca8c..631e415 100755
--- a/iso/build-live-iso.sh
+++ b/iso/build-live-iso.sh
@@ -130,6 +130,17 @@ if [ -f /etc/nsswitch.conf ]; then
     echo "live-setup: removed mdns from nsswitch.conf (hosts line)"
 fi
 
+# ── DNS: ensure a working nameserver is configured ───────────────────────
+# NetworkManager will overwrite resolv.conf once DHCP completes.
+# If the DHCP-provided nameserver is broken (e.g. QEMU's 10.0.2.3), add
+# 8.8.8.8 as a fallback. We write it now so first-login.sh can reach the
+# internet immediately after login without waiting for NM to settle.
+if ! grep -q '^nameserver' /etc/resolv.conf 2>/dev/null || \
+   grep -q '^nameserver 10\.0\.2\.3' /etc/resolv.conf 2>/dev/null; then
+    printf 'nameserver 8.8.8.8\nnameserver 1.1.1.1\n' > /etc/resolv.conf
+    echo "live-setup: set fallback DNS (8.8.8.8, 1.1.1.1)"
+fi
+
 # ── D-Bus session socket for the live user's login session ───────────────
 # dbus-launch is called by lightdm-session / Xsession automatically.
 # Ensure dbus system bus is accessible (needed by nix and Cinnamon).