diff --git a/app/proxy_tunnel.py b/app/proxy_tunnel.py
index 23a6331b..02331eee 100644
--- a/app/proxy_tunnel.py
+++ b/app/proxy_tunnel.py
@@ -277,6 +277,9 @@ def sidecar_kwargs(name: str, slug: str, proxy_id: int | None, network: str | No
         "name": name,
         "labels": labels,
         "network": network,
+        # The isolated bridge's resolvers, as every earner on it gets them: its
+        # rules refuse the daemon's LAN resolver. None on the default bridge.
+        "dns": orchestrator.container_dns(network),
         "hostname": hostname,
         "cap_drop": ["ALL"],
         "cap_add": ["NET_ADMIN"],
diff --git a/tests/test_proxy_tunnel.py b/tests/test_proxy_tunnel.py
index 7fea50a9..ac08be81 100644
--- a/tests/test_proxy_tunnel.py
+++ b/tests/test_proxy_tunnel.py
@@ -172,6 +172,15 @@ def test_hardening(self):
         assert "environment" not in kw and "command" not in kw
         assert kw["log_config"] == {"type": "json-file", "config": {"max-size": "1m", "max-file": "2"}}
 
+    def test_a_tunnel_on_the_isolated_bridge_gets_its_resolvers(self):
+        # The bridge's rules refuse the daemon's LAN resolver, so the tunnel
+        # needs the same resolvers every earner on it gets (container_dns).
+        with patch.dict(os.environ, {"CASHPILOT_TUNNEL_IMAGE": "drumsergio/cashpilot-tunnel:1.64.0"}):
+            fenced = proxy_tunnel.sidecar_kwargs("cashpilot-tunnel-x-p1", "x", 1, "cp-isolated", "x-p1")
+            plain = proxy_tunnel.sidecar_kwargs("cashpilot-tunnel-x-p1", "x", 1, None, "x-p1")
+        assert fenced["dns"] == orchestrator.container_dns("cp-isolated") == ["1.1.1.1", "9.9.9.9"]
+        assert plain["dns"] is None
+
     def test_secret_goes_only_into_the_archive(self):
         client = MagicMock()
         created = MagicMock(id="sidecar-id", status="running")