diff --git a/update_and_deploy_fips.sh b/update_and_deploy_fips.sh
index 3c75fef..01b4249 100755
--- a/update_and_deploy_fips.sh
+++ b/update_and_deploy_fips.sh
@@ -231,6 +231,84 @@ restart_unit_with_diagnostics() {
   fi
 }
 
+ensure_dnsmasq_package() {
+  if command -v dnsmasq >/dev/null 2>&1; then
+    return
+  fi
+
+  echo "==> dnsmasq not found; installing"
+  if command -v apt-get >/dev/null 2>&1; then
+    install_system_packages dnsmasq
+  elif command -v dnf >/dev/null 2>&1 || command -v yum >/dev/null 2>&1; then
+    install_system_packages dnsmasq
+  elif command -v pacman >/dev/null 2>&1; then
+    install_system_packages dnsmasq
+  elif command -v zypper >/dev/null 2>&1; then
+    install_system_packages dnsmasq
+  elif command -v apk >/dev/null 2>&1; then
+    install_system_packages dnsmasq
+  else
+    echo "Warning: unable to auto-install dnsmasq on this distro." >&2
+    return 1
+  fi
+}
+
+configure_dnsmasq_fips_dns() {
+  local conf_file="/etc/dnsmasq.d/fips.conf"
+  local resolv_file="/etc/resolv.conf"
+  local backup_file
+  local tmp_file
+  local upstream_dns
+
+  require_sudo
+  ensure_dnsmasq_package || return 1
+
+  upstream_dns="$(awk '/^nameserver[[:space:]]+/ { print $2 }' "${resolv_file}" 2>/dev/null | grep -Ev '^(127\.0\.0\.1|::1)$' | head -n1 || true)"
+  if [[ -z "${upstream_dns}" ]]; then
+    upstream_dns="1.1.1.1"
+  fi
+
+  echo "==> Configuring dnsmasq for .fips forwarding"
+  tmp_file="$(mktemp)"
+  cat > "${tmp_file}" <<EOF
+# Managed by update_and_deploy_fips.sh
+port=53
+listen-address=0.0.0.0
+bind-interfaces
+
+# .fips domains -> FIPS resolver
+server=/fips/127.0.0.1#5354
+
+# everything else -> upstream
+server=${upstream_dns}
+
+no-resolv
+no-hosts
+EOF
+  sudo install -m 0644 "${tmp_file}" "${conf_file}"
+  rm -f "${tmp_file}"
+
+  if [[ -f "${resolv_file}" ]]; then
+    backup_file="${resolv_file}.bak.$(date +%Y%m%d%H%M%S)"
+    sudo cp "${resolv_file}" "${backup_file}" || true
+
+    if ! grep -Eq '^[[:space:]]*nameserver[[:space:]]+127\.0\.0\.1([[:space:]]|$)' "${resolv_file}"; then
+      tmp_file="$(mktemp)"
+      {
+        echo "nameserver 127.0.0.1"
+        awk '!/^[[:space:]]*nameserver[[:space:]]+127\.0\.0\.1([[:space:]]|$)/ { print }' "${resolv_file}" 2>/dev/null || true
+      } > "${tmp_file}"
+      if ! sudo install -m 0644 "${tmp_file}" "${resolv_file}"; then
+        echo "Warning: unable to update ${resolv_file}; configure local nameserver manually." >&2
+      fi
+      rm -f "${tmp_file}"
+    fi
+  fi
+
+  sudo systemctl enable dnsmasq.service >/dev/null 2>&1 || true
+  restart_unit_with_diagnostics "dnsmasq.service" "no"
+}
+
 ensure_build_toolchain
 ensure_tun_ready
 
@@ -305,6 +383,7 @@ ENABLE_PERSISTENT_IDENTITY="$(ask_yes_no "Enable persistent identity?" "yes")"
 ADD_DEFAULT_PEERS="$(ask_yes_no "Add default static peers (laantungir/fips-test-node/fips.v0l.io)?" "yes")"
 ADD_CURRENT_USER_TO_FIPS_GROUP="$(ask_yes_no "Add current user to fips group?" "yes")"
 START_SERVICE_NOW="$(ask_yes_no "Start/restart fips service now?" "yes")"
+CONFIGURE_DNSMASQ_FOR_FIPS="$(ask_yes_no "Configure dnsmasq for .fips DNS forwarding in this qube?" "yes")"
 
 echo "==> Preparing ${INSTALL_MODE} payload"
 
@@ -452,6 +531,10 @@ if [[ "${START_SERVICE_NOW}" == "yes" ]]; then
   restart_unit_with_diagnostics "fips.service" "yes"
   restart_unit_with_diagnostics "fips-dns.service" "no"
 
+  if [[ "${CONFIGURE_DNSMASQ_FOR_FIPS}" == "yes" ]]; then
+    configure_dnsmasq_fips_dns || echo "Warning: dnsmasq configuration failed; continuing." >&2
+  fi
+
   echo "==> Running post-deploy health check"
   if [[ -x "${SCRIPT_DIR}/test_fips.sh" ]]; then
     "${SCRIPT_DIR}/test_fips.sh"