diff --git a/nix/nixos-module/container/dnscache.nix b/nix/nixos-module/container/dnscache.nix
index c2c19ac..3552b56 100644
--- a/nix/nixos-module/container/dnscache.nix
+++ b/nix/nixos-module/container/dnscache.nix
@@ -51,8 +51,9 @@ lib.mkIf config.site.hosts.${hostName}.services.dnscache.enable {
             "${config.site.net.flpk.subnet4} allow"
             "2a0f:5382:acab:1400::/56 allow"
           ]
-          # yggdrasil
-          "${config.site.net.c3d2.subnets6.yggdrasil} allow"
+          [ # yggdrasil
+            "${config.site.net.c3d2.subnets6.yggdrasil} allow"
+          ]
           [ # default
           "0.0.0.0/0 deny"
           "::/0 deny"