diff --git a/scripts/setup-dns-proxy.sh b/scripts/setup-dns-proxy.sh
index ea91066ec7..5ae751f4a4 100755
--- a/scripts/setup-dns-proxy.sh
+++ b/scripts/setup-dns-proxy.sh
@@ -158,7 +158,22 @@ kctl exec -n openshell "$POD" -- \
   sh -c "nohup python3 -u /tmp/dns-proxy.py '${DNS_UPSTREAM}' '${VETH_GW}' \
     > /tmp/dns-proxy.log 2>&1 &"
 
-sleep 2
+# Wait for forwarder to actually be serving (up to 10s).
+# The PID file is written before the socket is bound, so we probe
+# with a real DNS query instead of just checking the file. See #2017.
+_dns_ready=0
+for _i in $(seq 1 10); do
+  if kctl exec -n openshell "$POD" -- \
+    sh -c "printf '%b' '\x00\x1e\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x06google\x03com\x00\x00\x01\x00\x01' \
+      | timeout 1 socat - UDP:${VETH_GW}:53 2>/dev/null" | grep -q .; then
+    _dns_ready=1
+    break
+  fi
+  sleep 1
+done
+if [ "$_dns_ready" -eq 0 ]; then
+  echo "WARNING: DNS forwarder not responding after 10s — verification may fail"
+fi
 
 # ── Step 4: Allow UDP DNS in sandbox iptables ───────────────────────
 #
@@ -272,12 +287,19 @@ if [ -n "$SANDBOX_NS" ]; then
   fi
 
   # 6d. Actual DNS resolution from sandbox (getent hosts)
-  DNS_RESULT="$(sb_exec getent hosts github.com 2>/dev/null || true)"
+  # Retry up to 3 times — on slower hardware (Jetson ARM64) the forwarder
+  # may need a few extra seconds after binding. See #2017.
+  DNS_RESULT=""
+  for _dns_try in 1 2 3; do
+    DNS_RESULT="$(sb_exec getent hosts github.com 2>/dev/null || true)"
+    [ -n "$DNS_RESULT" ] && break
+    [ "$_dns_try" -lt 3 ] && sleep 2
+  done
   if [ -n "$DNS_RESULT" ]; then
     echo "  [PASS] getent hosts github.com -> ${DNS_RESULT}"
     VERIFY_PASS=$((VERIFY_PASS + 1))
   else
-    echo "  [FAIL] getent hosts github.com returned empty (DNS not resolving)"
+    echo "  [FAIL] getent hosts github.com returned empty after 3 attempts (DNS not resolving)"
     VERIFY_FAIL=$((VERIFY_FAIL + 1))
   fi
 else