diff --git a/.github/workflows/app-pipeline-renew-node-ssl-certs.yml b/.github/workflows/app-pipeline-renew-node-ssl-certs.yml
index 6d80faff..3511e6a5 100644
--- a/.github/workflows/app-pipeline-renew-node-ssl-certs.yml
+++ b/.github/workflows/app-pipeline-renew-node-ssl-certs.yml
@@ -2,7 +2,6 @@ name: Renew node ssl cert
 
 on:
   pull_request:
-  push:
     paths:
       - '.github/workflows/app-pipeline-renew-node-ssl-certs.yml'
   workflow_dispatch:
diff --git a/ansible/playbooks/roles/vhosts/common/tasks/main.yml b/ansible/playbooks/roles/vhosts/common/tasks/main.yml
index 8cfd29a5..e4e39167 100644
--- a/ansible/playbooks/roles/vhosts/common/tasks/main.yml
+++ b/ansible/playbooks/roles/vhosts/common/tasks/main.yml
@@ -13,8 +13,8 @@
 - name: Run secure_ssh.sh script
   script: files/secure_ssh.sh
 
-- name: Disable systemd-resolved and set static DNS
-  include_tasks: disable-systemd-resolved.yml
+- name: Set systemd-resolved and set static DNS
+  include_tasks: setup-systemd-resolved.yml
 
 - name: Install packages
   script: files/install-packages.sh
diff --git a/ansible/playbooks/roles/vhosts/common/tasks/setup-systemd-resolved.yml b/ansible/playbooks/roles/vhosts/common/tasks/setup-systemd-resolved.yml
new file mode 100644
index 00000000..e7a130c7
--- /dev/null
+++ b/ansible/playbooks/roles/vhosts/common/tasks/setup-systemd-resolved.yml
@@ -0,0 +1,36 @@
+# playbooks/setup-systemd-resolved.yml
+- name: Ensure systemd-resolved is installed
+  package:
+    name: systemd-resolved
+    state: present
+
+- name: Enable and start systemd-resolved
+  systemd:
+    name: systemd-resolved
+    enabled: yes
+    state: started
+
+- name: Configure /etc/systemd/resolved.conf
+  ini_file:
+    path: /etc/systemd/resolved.conf
+    section: "Resolve"
+    option: "{{ item.option }}"
+    value: "{{ item.value }}"
+    mode: '0644'
+  loop:
+    - { option: "DNSStubListener", value: "no" }
+    - { option: "DNS", value: "" }
+    - { option: "FallbackDNS", value: "" }
+
+- name: Restart systemd-resolved
+  systemd:
+    name: systemd-resolved
+    state: restarted
+    daemon_reload: yes
+
+- name: Ensure /etc/resolv.conf points to /run/systemd/resolve/resolv.conf
+  file:
+    src: /run/systemd/resolve/resolv.conf
+    dest: /etc/resolv.conf
+    state: link
+    force: true