diff --git a/flake.nix b/flake.nix
index 3650041..ae100d2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -60,6 +60,33 @@
           ];
         };
 
+        # x86_64 QEMU VM to runtime-test mercury's DNS/DHCP stack (pihole +
+        # unbound) before flashing the aarch64 SD. Build + run:
+        #   nix build .#nixosConfigurations.mercury-vm.config.system.build.vm
+        #   ./result/bin/run-mercury-vm-vm
+        mercury-vm = nixpkgs.lib.nixosSystem {
+          inherit system;   # x86_64-linux, fast to build/boot with KVM
+          modules = [
+            (nixpkgs + "/nixos/modules/virtualisation/qemu-vm.nix")
+            ./common.nix
+            ./services/unbound.nix
+            ./services/pihole.nix
+            ({ lib, ... }: {
+              networking.hostName = "mercury-vm";
+              users.users.darman.initialPassword = "test";
+              users.users.root.initialPassword = "test";
+              services.openssh.settings.PasswordAuthentication = lib.mkForce true;
+              virtualisation.graphics = false;
+              virtualisation.memorySize = 2048;
+              virtualisation.forwardPorts = [
+                { from = "host"; host.port = 2223; guest.port = 22; }
+                { from = "host"; host.port = 8081; guest.port = 80; }
+              ];
+              system.stateVersion = "26.05";
+            })
+          ];
+        };
+
         # VirtualBox test image. Build the OVA with:
         #   nix build .#nixosConfigurations.jupiter-vbox.config.system.build.virtualBoxOVA
         # NOTE: no disko here — the virtualbox-image module supplies the disk.