diff --git a/netinfra/pihole/README.md b/netinfra/pihole/README.md
index e49a749..f2ad36c 100644
--- a/netinfra/pihole/README.md
+++ b/netinfra/pihole/README.md
@@ -34,14 +34,24 @@ docker compose up -d
 Files are deployed to `/home/localuser/services/pihole/` on each node. Volumes
 (`./etc-pihole`, `./etc-dnsmasq.d`) hold the persistent state.
 
-## IPv6 disabled
+## IPv6 disabled + Rate-limiting disabled
 
+### IPv6
 Both netinfra nodes run **IPv4-only**. IPv6 is disabled at the kernel level
 (`/etc/sysctl.d/99-disable-ipv6.conf`) because netinfra-01 has no IPv6 internet
 route, and Pi-hole's default IPv6 upstream (Google `2001:4860:4860::8888`) was
 causing continuous "Network unreachable" errors + intermittent DNS failures
 detected by Uptime Kuma. The upstream is now `8.8.8.8` (IPv4 only).
 
+### Rate-limiting
+Pi-hole's default rate-limit (1000 queries / 60 seconds per client) was
+**the root cause of Uptime Kuma DNS flapping**. Uptime Kuma runs on the
+Cloudron VPS (`tsys-cloudron`, `100.107.35.78`) and sends high-volume DNS
+queries to monitor dozens of hosts. When it exceeded 1000 queries/60s,
+Pi-hole responded with REFUSED, which Uptime Kuma detected as DNS being
+down. Rate-limiting is now disabled (`count=0, interval=0`) since this is a
+private tailnet with no risk of DNS amplification attacks.
+
 ## Verify
 
 ```bash
diff --git a/netinfra/pihole/docker-compose.yml b/netinfra/pihole/docker-compose.yml
index 6faf0a2..99effb8 100644
--- a/netinfra/pihole/docker-compose.yml
+++ b/netinfra/pihole/docker-compose.yml
@@ -16,6 +16,11 @@ services:
       TZ: 'America/Chicago'
       FTLCONF_webserver_api_password: '${PIHOLE_WEB_PASSWORD}'
       FTLCONF_dns_listeningMode: 'all'
+      # Rate-limiting disabled (count=0). Uptime Kuma on Cloudron VPS sends
+      # high-volume DNS queries for monitoring; default 1000/60s limit was
+      # causing intermittent REFUSED responses → Uptime Kuma flapping.
+      FTLCONF_dns_rateLimit_count: '0'
+      FTLCONF_dns_rateLimit_interval: '0'
       FTLCONF_dns_upstreams: '["8.8.8.8"]'
     volumes:
       - './etc-pihole:/etc/pihole'