diff --git a/docker/40-openconcho-config.sh b/docker/40-openconcho-config.sh
index 547b81d..88656ca 100644
--- a/docker/40-openconcho-config.sh
+++ b/docker/40-openconcho-config.sh
@@ -11,6 +11,14 @@ cat > /usr/share/nginx/html/config.js <<EOF
 window.__OPENCONCHO_DEFAULT_HONCHO_URL__ = "${OPENCONCHO_DEFAULT_HONCHO_URL:-}";
 EOF
 
+# Derive nginx's resolver from the container's own DNS so the runtime-variable
+# proxy_pass resolves on BOTH user-defined networks (Docker embedded DNS at
+# 127.0.0.11) and the default bridge (host nameservers from /etc/resolv.conf).
+# Hardcoding 127.0.0.11 breaks `docker run` on the default bridge (no embedded DNS).
+RESOLVERS=$(awk '/^nameserver/ { print $2 }' /etc/resolv.conf | tr '\n' ' ' | sed 's/ *$//')
+[ -z "$RESOLVERS" ] && RESOLVERS=127.0.0.11
+printf 'resolver %s ipv6=off valid=10s;\n' "$RESOLVERS" > /etc/nginx/conf.d/00-resolver.conf
+
 # Render the SSRF allowlist into an nginx map for $allow_upstream.
 # Unset/empty OPENCONCHO_UPSTREAM_ALLOWLIST → open (default 1), fine for the
 # localhost-bound default. Set it (comma-separated host globs) before exposing
diff --git a/docker/nginx.conf.template b/docker/nginx.conf.template
index 2dff4c3..04abd34 100644
--- a/docker/nginx.conf.template
+++ b/docker/nginx.conf.template
@@ -12,8 +12,9 @@ server {
     # Don't leak the nginx version.
     server_tokens off;
 
-    # Resolver required for per-request DNS when proxy_pass targets a runtime variable.
-    resolver 127.0.0.11 ipv6=off valid=10s;
+    # The resolver (required for per-request DNS with a runtime-variable proxy_pass)
+    # is rendered by the entrypoint into conf.d from the container's own DNS, so it
+    # works on both user-defined networks (127.0.0.11) and the default bridge.
 
     # Header-driven same-origin proxy: the browser names the Honcho upstream per
     # request via X-Honcho-Upstream, so the browser never makes a cross-origin call.