diff --git a/k8s-ng/core/coredns-config/deployment.yaml b/k8s-ng/core/coredns-config/deployment.yaml
index ee708cc..13ba288 100644
--- a/k8s-ng/core/coredns-config/deployment.yaml
+++ b/k8s-ng/core/coredns-config/deployment.yaml
@@ -11,6 +11,17 @@ spec:
   replicas: 3
   template:
     spec:
+      tolerations:
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+        # DNS also belongs on the internal core node used by Actions jobs.
+        - key: workload
+          operator: Equal
+          value: ai
+          effect: NoSchedule
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
diff --git a/k8s-ng/core/coredns-config/kustomization.yaml b/k8s-ng/core/coredns-config/kustomization.yaml
index 88a04b5..5b98e94 100644
--- a/k8s-ng/core/coredns-config/kustomization.yaml
+++ b/k8s-ng/core/coredns-config/kustomization.yaml
@@ -3,3 +3,4 @@ kind: Kustomization
 
 resources:
   - deployment.yaml
+  - service.yaml
diff --git a/k8s-ng/core/coredns-config/service.yaml b/k8s-ng/core/coredns-config/service.yaml
new file mode 100644
index 0000000..15225fe
--- /dev/null
+++ b/k8s-ng/core/coredns-config/service.yaml
@@ -0,0 +1,11 @@
+# Keep DNS on the caller's node when it has a healthy CoreDNS replica. K3s owns
+# the rest of this Service; server-side apply preserves its ports and selector.
+apiVersion: v1
+kind: Service
+metadata:
+  name: kube-dns
+  namespace: kube-system
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false,Delete=false
+spec:
+  trafficDistribution: PreferSameNode