diff --git a/hosts/AZ-PRM-1/services/containers/semaphore.nix b/hosts/AZ-PRM-1/services/containers/semaphore.nix
index 20d1fc4..dd2881f 100644
--- a/hosts/AZ-PRM-1/services/containers/semaphore.nix
+++ b/hosts/AZ-PRM-1/services/containers/semaphore.nix
@@ -24,7 +24,12 @@ in {
     volumes = [
       "semaphore_data:/var/lib/semaphore"
     ];
-    extraOptions = ["--network=web" "--ip=10.89.0.17" "--add-host=postgres:10.89.0.1"];
+    # Public DNS: the corporate DNS behind aardvark answers AAAA queries for
+    # galaxy.ansible.com but not A queries — with no IPv6 route in the web
+    # network ansible-galaxy downloads failed (EAI_AGAIN / empty responses).
+    # Bypass with public resolvers; git.az-gruppe.com is publicly resolvable,
+    # targets connect by IP (same pattern as librechat/homarr on AZ-CLD-1).
+    extraOptions = ["--network=web" "--ip=10.89.0.17" "--add-host=postgres:10.89.0.1" "--dns=8.8.8.8" "--dns=8.8.4.4"];
   };
 
   # Idempotent provisioning of the semaphore role/database on the host