diff --git a/bin/netvm-enter-inner.sh b/bin/netvm-enter-inner.sh
index bdd47a1..fb369a3 100755
--- a/bin/netvm-enter-inner.sh
+++ b/bin/netvm-enter-inner.sh
@@ -1,6 +1,11 @@
 #!/usr/bin/env bash
 # runs as root inside the netns + a private mount ns; drops privs, execs cmd.
 set -euo pipefail
-mount --bind "$NETVM_RESOLV" /etc/resolv.conf
+# /etc/resolv.conf is a symlink to the systemd stub (127.0.0.53, unreachable
+# in the netns). Replace with a real file (private mount ns) so bwrap
+# children see the fix too: bwrap's --ro-bind /etc is non-recursive and
+# cannot bind over a dangling symlink.
+rm -f /etc/resolv.conf
+cp "$NETVM_RESOLV" /etc/resolv.conf
 exec setpriv --reuid="$NETVM_UID" --regid="$NETVM_GID" --clear-groups \
   env HOME="$NETVM_HOME" "$@"