diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4b94f62..81c2e78 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -130,12 +130,12 @@ jobs:
             deployed_sha=$(git ls-remote "$repo_url" "$branch" | cut -f1)
 
             if [[ "$deployed_sha" == "$expected_sha" ]]; then
-              echo "Deployed $expected_sha"
+              echo "✅ ${{ matrix.server }} deployed $expected_sha"
               exit 0
             fi
-            
-            echo "Deployed ${deployed_sha::7}, waiting for ${expected_sha::7}..."
-            sleep 10
+
+            echo "⏳ ${{ matrix.server }}: deployed ${deployed_sha::7}, waiting for ${expected_sha::7}..."
+            sleep 5
           done
   notify:
     if: always()
diff --git a/README.md b/README.md
deleted file mode 100644
index ff24898..0000000
--- a/README.md
+++ /dev/null
@@ -1 +0,0 @@
-[![CI](https://github.com/SebastianStork/nixos-config/actions/workflows/ci.yml/badge.svg)](https://github.com/SebastianStork/nixos-config/actions/workflows/ci.yml)
diff --git a/modules/nixos/networking/default.nix b/modules/nixos/networking/default.nix
index e6bb605..24f8ac3 100644
--- a/modules/nixos/networking/default.nix
+++ b/modules/nixos/networking/default.nix
@@ -36,13 +36,4 @@ in
       readOnly = true;
     };
   };
-
-  config = {
-    networking = {
-      useNetworkd = true;
-      useDHCP = false;
-    };
-
-    services.resolved.enable = true;
-  };
 }
diff --git a/modules/nixos/networking/underlay.nix b/modules/nixos/networking/underlay.nix
index 480f0ee..94f7401 100644
--- a/modules/nixos/networking/underlay.nix
+++ b/modules/nixos/networking/underlay.nix
@@ -40,6 +40,11 @@ in
 
   config = lib.mkMerge [
     {
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+      };
+
       systemd.network = {
         enable = true;
         networks."10-${cfg.interface}" = {
@@ -54,6 +59,12 @@ in
           };
         };
       };
+
+      services.resolved = {
+        enable = true;
+        dnssec = "allow-downgrade";
+        dnsovertls = "opportunistic";
+      };
     }
 
     (lib.mkIf cfg.wireless.enable {