diff --git a/hosts/common/net/dns/bind.nix b/hosts/common/net/dns/bind.nix
index 9f0aca7a2..6bc502ee6 100644
--- a/hosts/common/net/dns/bind.nix
+++ b/hosts/common/net/dns/bind.nix
@@ -98,6 +98,7 @@ in
 
     systemd.services.bind.serviceConfig.ExecStartPre = pkgs.writeShellScript "named-generate-config" ''
       mkdir -p /run/named/dhcp-configs
+      chmod g+w /run/named/dhcp-configs
       echo "// FILE GENERATED BY bind.service's ExecStartPre: CHANGES TO THIS FILE WILL BE OVERWRITTEN" > /run/named/dhcp-configs.conf
       for c in $(ls /run/named/dhcp-configs/); do
         cat "/run/named/dhcp-configs/$c" >> /run/named/dhcp-configs.conf
diff --git a/hosts/common/users/colin.nix b/hosts/common/users/colin.nix
index b6f14926f..1117f7c07 100644
--- a/hosts/common/users/colin.nix
+++ b/hosts/common/users/colin.nix
@@ -20,6 +20,7 @@
       "feedbackd"  # moby, so `fbcli` can control vibrator and LEDs
       "input"  # for /dev/input/<xyz>... TODO:is this still necessary?
       "media"  # servo
+      "named"  # for `sane-vpn {up,down}`
       "networkmanager"
       "nixbuild"
       "plugdev"  # desko, for ZSA/QMK/udev
diff --git a/pkgs/by-name/sane-scripts/src/sane-vpn b/pkgs/by-name/sane-scripts/src/sane-vpn
index ea2282cec..8a7284435 100755
--- a/pkgs/by-name/sane-scripts/src/sane-vpn
+++ b/pkgs/by-name/sane-scripts/src/sane-vpn
@@ -151,11 +151,6 @@ def get_dns_resolvers_for_dev(dev: str) -> list[str]:
     """
     passt/pasta can't proxy to e.g. 127.0.0.53, but it can to 127.0.0.1 and anything routable by the device
     """
-    nameservers = nameservers_from_resolvconf(RESOLVCONF)
-    if nameservers == []:
-        nameservers = [ "127.0.0.1 "]  #< libc default if unspecified
-    if "127.0.0.1" in nameservers:
-        return [ "127.0.0.1" ]
 
     # output looks like IP4.DNS[1]:192.168.0.1
     nmcli_stdout = subprocess.check_output([
@@ -169,6 +164,15 @@ def get_dns_resolvers_for_dev(dev: str) -> list[str]:
         _fname, ns = line.split(":")
         nameservers.append(ns)
 
+    if nameservers == []:
+        nameservers = nameservers_from_resolvconf(RESOLVCONF)
+        if nameservers == []:
+            nameservers = [ "127.0.0.1 "]  #< libc default if unspecified
+
+    # old logic from when i was using systemd-resolved (127.0.0.53, which pasta couldn't reach). safe to remove?
+    # if "127.0.0.1" in nameservers:
+    #     return [ "127.0.0.1" ]
+
     return nameservers
 
 
@@ -293,7 +297,7 @@ zone . {{
   }};
 }};
 '''
-    elif dir == ToggleDir.Down:
+    elif dir_ == ToggleDir.Down:
         text = ""
 
     if not os.path.isdir("/run/named/dhcp-configs"):