diff --git a/home-manager/programs/fish/functions/_vpn_function.fish b/home-manager/programs/fish/functions/_vpn_function.fish
index c2a5aaf31..38ab48954 100644
--- a/home-manager/programs/fish/functions/_vpn_function.fish
+++ b/home-manager/programs/fish/functions/_vpn_function.fish
@@ -3,10 +3,12 @@ function _vpn_function --description "Connect/disconnect Tailscale exit node thr
 
   switch "$argv[1]"
     case on
-      tailscale set --exit-node=$kyber_host
+      # --accept-dns=true routes DNS through the exit node; without it
+      # DNS queries break while tunnelled and name resolution fails.
+      tailscale set --exit-node=$kyber_host --accept-dns=true
       and echo "VPN connected through kyber"
     case off
-      tailscale set --exit-node=
+      tailscale set --exit-node= --accept-dns=false
       and echo "VPN disconnected"
     case status
       tailscale status
@@ -14,10 +16,10 @@ function _vpn_function --description "Connect/disconnect Tailscale exit node thr
       # Toggle: if exit node is set, turn off; otherwise turn on
       set -l current (tailscale status --json 2>/dev/null | jq -r '.ExitNodeStatus.ID // empty')
       if test -n "$current"
-        tailscale set --exit-node=
+        tailscale set --exit-node= --accept-dns=false
         and echo "VPN disconnected"
       else
-        tailscale set --exit-node=$kyber_host
+        tailscale set --exit-node=$kyber_host --accept-dns=true
         and echo "VPN connected through kyber"
       end
     case '*'