diff --git a/profiles/misc/stubby.nix b/profiles/misc/stubby.nix
index 4f7de05..b588323 100644
--- a/profiles/misc/stubby.nix
+++ b/profiles/misc/stubby.nix
@@ -1,4 +1,4 @@
-{ ... }: {
+{ pkgs, ... }: {
   services.stubby = {
     enable = true;
     upstreamServers = ''
@@ -21,6 +21,13 @@
     };
   };
 
+  system.activationScripts.immutableDns = {
+    text = ''
+      ${pkgs.e2fsprogs}/bin/chattr +i /etc/resolv.conf
+    '';
+    deps = [ ];
+  };
+
   networking = {
     networkmanager.dns = "none";
     resolvconf.dnsExtensionMechanism = false;