diff --git a/netinfra/pihole/README.md b/netinfra/pihole/README.md
index 78b7b44..e49a749 100644
--- a/netinfra/pihole/README.md
+++ b/netinfra/pihole/README.md
@@ -34,6 +34,14 @@ docker compose up -d
 Files are deployed to `/home/localuser/services/pihole/` on each node. Volumes
 (`./etc-pihole`, `./etc-dnsmasq.d`) hold the persistent state.
 
+## IPv6 disabled
+
+Both netinfra nodes run **IPv4-only**. IPv6 is disabled at the kernel level
+(`/etc/sysctl.d/99-disable-ipv6.conf`) because netinfra-01 has no IPv6 internet
+route, and Pi-hole's default IPv6 upstream (Google `2001:4860:4860::8888`) was
+causing continuous "Network unreachable" errors + intermittent DNS failures
+detected by Uptime Kuma. The upstream is now `8.8.8.8` (IPv4 only).
+
 ## Verify
 
 ```bash
diff --git a/netinfra/pihole/docker-compose.yml b/netinfra/pihole/docker-compose.yml
index 060860c..6faf0a2 100644
--- a/netinfra/pihole/docker-compose.yml
+++ b/netinfra/pihole/docker-compose.yml
@@ -16,6 +16,7 @@ services:
       TZ: 'America/Chicago'
       FTLCONF_webserver_api_password: '${PIHOLE_WEB_PASSWORD}'
       FTLCONF_dns_listeningMode: 'all'
+      FTLCONF_dns_upstreams: '["8.8.8.8"]'
     volumes:
       - './etc-pihole:/etc/pihole'
       - './etc-dnsmasq.d:/etc/dnsmasq.d'