diff --git a/roles/hass-dhcp/files/after-network.conf b/roles/hass-dhcp/files/after-network.conf
new file mode 100644
index 0000000..10ce259
--- /dev/null
+++ b/roles/hass-dhcp/files/after-network.conf
@@ -0,0 +1,4 @@
+[Unit]
+After=network.target
+After=network-online.target
+Wants=network-online.target
diff --git a/roles/hass-dhcp/tasks/main.yml b/roles/hass-dhcp/tasks/main.yml
index 0c042c0..e453907 100644
--- a/roles/hass-dhcp/tasks/main.yml
+++ b/roles/hass-dhcp/tasks/main.yml
@@ -13,6 +13,25 @@
   notify:
   - restart dnsmasq
 
+- name: ensure dnsmasq systemd unit drop-in directory exists
+  file:
+    path: /etc/systemd/system/dnsmasq.service.d
+    mode: u=rwx,go=rx
+    owner: root
+    group: root
+    state: directory
+  tags:
+  - systemd
+- name: ensure dnsmasq starts after network is up
+  copy:
+    src: after-network.conf
+    dest: /etc/systemd/system/dnsmasq.service.d/after-network.conf
+    mode: u=rw,go=r
+    owner: root
+    group: root
+  tags:
+  - systemd
+
 - meta: flush_handlers
 - name: ensure homeassistant firewall zone exists
   firewalld: