diff --git a/infrastructure/roles/pihole_dns/tasks/main.yml b/infrastructure/roles/pihole_dns/tasks/main.yml
index 47e58c9..77e4cb0 100644
--- a/infrastructure/roles/pihole_dns/tasks/main.yml
+++ b/infrastructure/roles/pihole_dns/tasks/main.yml
@@ -23,7 +23,7 @@
     mode: "0644"
   notify: restart pihole-FTL
 
-- name: Configure knoe.dev GKE service records (LAN split-horizon)
+- name: Configure knoe.dev GKE service records (dnsmasq fallback)
   ansible.builtin.template:
     src: 06-knoe-dev.conf.j2
     dest: /etc/dnsmasq.d/06-knoe-dev.conf
@@ -32,6 +32,21 @@
     mode: "0644"
   notify: restart pihole-FTL
 
+- name: Register knoe.dev GKE records in Pi-hole 6 dns.hosts (native override)
+  # Pi-hole 6 uses pihole-FTL's internal dns.hosts for local records.
+  # dnsmasq address= directives work for some domains but Pi-hole 6 may
+  # serve cached upstream answers over them; dns.hosts always wins.
+  ansible.builtin.shell: |
+    # Build the hosts array: preserve existing non-knoe entries + add ours
+    CURRENT=$(pihole-FTL --config dns.hosts 2>/dev/null | tr -d '[]' | tr ',' '\n' | grep -v '0.knoe.dev' | grep -v '^$' | sed 's/^ *//' | sed 's/ *$//')
+    NEW_ENTRIES="{% for r in knoe_dev_dns_records %}{{ r.ip }} {{ r.name }}{% if not loop.last %}\n{% endif %}{% endfor %}"
+    ALL=$(printf '%s\n%s' "$CURRENT" "$(printf '%b' "$NEW_ENTRIES")" | grep -v '^$' | sort -u)
+    JSON=$(echo "$ALL" | awk '{print "\"" $0 "\""}' | paste -sd ',' | sed 's/^/[/;s/$/]/')
+    pihole-FTL --config dns.hosts "$JSON"
+    pihole reloaddns
+  register: pihole_hosts_result
+  changed_when: true
+
 - name: Read current Pi-hole FTL DB journal mode (WAL?)
   ansible.builtin.command: sqlite3 /etc/pihole/pihole-FTL.db "PRAGMA journal_mode;"
   register: pihole_journal