diff --git a/hosts/router/dns.nix b/hosts/router/dns.nix
index 92e6553..c8bcd69 100644
--- a/hosts/router/dns.nix
+++ b/hosts/router/dns.nix
@@ -44,10 +44,12 @@ in
   services.adguardhome.mutableSettings = false;
   # https://github.com/AdguardTeam/Adguardhome/wiki/Configuration
   services.adguardhome.settings = {
+    querylog.interval = "168h"; # 7 days
     dns = {
       # Disable rate limit, default of 20 is too low
       # https://github.com/AdguardTeam/AdGuardHome/issues/6726
       ratelimit = 0;
+      enable_dnssec = true;
       bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
       upstream_dns = [
         # Default upstreams