diff --git a/bin/lib/platform.js b/bin/lib/platform.js
index 7c6f574117f..0a559695de9 100644
--- a/bin/lib/platform.js
+++ b/bin/lib/platform.js
@@ -5,6 +5,13 @@ const os = require("os");
 const path = require("path");
 
 function isWsl(opts = {}) {
+  // Explicit override — lets tests pin behavior regardless of the host kernel.
+  // Useful because the WSL detection below consults `os.release()`, which
+  // returns a "microsoft"-tagged string on WSL2 hosts even when env vars are
+  // unset. Without this override, any test calling functions that consult
+  // `isWsl()` becomes non-deterministic on WSL2 dev machines.
+  if (typeof opts.isWsl === "boolean") return opts.isWsl;
+
   const platform = opts.platform ?? process.platform;
   if (platform !== "linux") return false;
 
diff --git a/test/platform.test.js b/test/platform.test.js
index 51f838cb133..614a9e2e6d3 100644
--- a/test/platform.test.js
+++ b/test/platform.test.js
@@ -159,11 +159,22 @@ describe("platform helpers", () => {
   });
 
   describe("shouldPatchCoredns", () => {
-    it("patches CoreDNS for Colima and Podman", () => {
-      expect(shouldPatchCoredns("colima")).toBe(true);
-      expect(shouldPatchCoredns("podman")).toBe(true);
-      expect(shouldPatchCoredns("docker-desktop")).toBe(false);
-      expect(shouldPatchCoredns("docker")).toBe(false);
+    // Pass explicit `isWsl: false` so this test pins the function's runtime
+    // matching logic on every host. Without the override, `shouldPatchCoredns`
+    // consults `isWsl()`, which returns true on WSL2 dev machines (via
+    // `os.release()`), and the assertions flip below.
+    it("patches CoreDNS for Colima and Podman (non-WSL host)", () => {
+      expect(shouldPatchCoredns("colima", { isWsl: false })).toBe(true);
+      expect(shouldPatchCoredns("podman", { isWsl: false })).toBe(true);
+      expect(shouldPatchCoredns("docker-desktop", { isWsl: false })).toBe(false);
+      expect(shouldPatchCoredns("docker", { isWsl: false })).toBe(false);
+    });
+
+    it("never patches CoreDNS on WSL2 (host DNS unreachable from k3s pods)", () => {
+      expect(shouldPatchCoredns("colima", { isWsl: true })).toBe(false);
+      expect(shouldPatchCoredns("podman", { isWsl: true })).toBe(false);
+      expect(shouldPatchCoredns("docker-desktop", { isWsl: true })).toBe(false);
+      expect(shouldPatchCoredns("docker", { isWsl: true })).toBe(false);
     });
   });