diff --git a/hosts/mercury/configuration.nix b/hosts/mercury/configuration.nix
index 79e16b1..4b9896f 100644
--- a/hosts/mercury/configuration.nix
+++ b/hosts/mercury/configuration.nix
@@ -6,7 +6,8 @@
 {
   imports = [
     ../../common.nix           # shared base: user / ssh / nix / firewall
-    # ../../services/<dns>.nix  # add once the DNS service is chosen (below)
+    ../../services/unbound.nix  # local recursive resolver (127.0.0.1:5335)
+    # ../../services/<dns>.nix  # add once the adblock DNS engine is chosen (below)
   ];
 
   networking.hostName = "mercury";
@@ -17,9 +18,10 @@
   networking.useDHCP = false;
   networking.usePredictableInterfaceNames = false;   # keep it named eth0
   networking.interfaces.eth0.ipv4.addresses = [
-    { address = "10.0.0.2"; prefixLength = 24; }      # CHANGE-ME: the Pi's IP
+    { address = "10.0.0.10"; prefixLength = 24; }     # the Pi's current IP
   ];
-  networking.defaultGateway = { address = "10.0.0.1"; interface = "eth0"; };  # CHANGE-ME
+  # VERIFY with `ip route` on the Pi — assuming the router is .1.
+  networking.defaultGateway = { address = "10.0.0.1"; interface = "eth0"; };
   # Upstream resolvers for the box itself (the adblock DNS forwards to these).
   networking.nameservers = [ "1.1.1.1" "9.9.9.9" ];
 
diff --git a/services/unbound.nix b/services/unbound.nix
new file mode 100644
index 0000000..88fbc70
--- /dev/null
+++ b/services/unbound.nix
@@ -0,0 +1,32 @@
+{ ... }:
+
+# Local recursive DNS resolver (privacy + DNSSEC). Your adblock DNS
+# (pihole/AdGuard) forwards to this instead of a public upstream.
+# Listens on 127.0.0.1:5335 — point the adblock engine's upstream there:
+#   AdGuard:  dns.upstream_dns = [ "127.0.0.1:5335" ];
+#   pihole:   upstream = "127.0.0.1#5335";
+{
+  services.unbound = {
+    enable = true;
+    # NixOS manages the DNSSEC root trust anchor (unbound-anchor).
+    settings.server = {
+      interface = [ "127.0.0.1" ];
+      port = 5335;
+      access-control = [ "127.0.0.0/8 allow" ];
+
+      do-ip6 = "no";              # flip to yes if you resolve over IPv6
+      prefer-ip6 = "no";
+
+      # Privacy / hardening (standard pi-hole+unbound guide).
+      hide-identity = true;
+      hide-version = true;
+      harden-glue = true;
+      harden-dnssec-stripped = true;
+      use-caps-for-id = false;
+      qname-minimisation = true;
+
+      edns-buffer-size = 1232;
+      prefetch = true;
+    };
+  };
+}