diff --git a/nginx.conf b/nginx.conf
index bac771e..0ad1684 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -19,11 +19,13 @@ server {
   add_header Cross-Origin-Resource-Policy "same-origin" always;
   add_header X-Robots-Tag "noindex, nofollow" always;
 
-  # Use the cluster CoreDNS resolver so upstream hostnames are resolved
-  # lazily (per-request), not at nginx startup. The proxy_pass targets below
-  # use $variable form to force this lazy resolution; otherwise nginx fails
-  # to start when cluster DNS is briefly unavailable (e.g. node recovery).
-  resolver 10.43.0.10 valid=30s ipv6=off;
+  # Use the cluster CoreDNS resolver for in-cluster Services AND public
+  # resolvers as fallback for external hostnames (demo.flow-master.ai etc.).
+  # k3s CoreDNS by default forwards external lookups, but if the forward
+  # is missing the proxy_pass to demo.flow-master.ai fails with 502/504.
+  # Listing public resolvers alongside ensures lookups succeed in both
+  # cases. Targets use $variable form to force lazy per-request resolution.
+  resolver 10.43.0.10 1.1.1.1 8.8.8.8 valid=30s ipv6=off;
 
   # Reverse-proxy /api to the demo backend so live mode is same-origin.
   location /api/ {