diff --git a/mailu/quadlets/mailu-resolver.container b/mailu/quadlets/mailu-resolver.container
index db31e9a..68c8b42 100644
--- a/mailu/quadlets/mailu-resolver.container
+++ b/mailu/quadlets/mailu-resolver.container
@@ -14,5 +14,8 @@ Network=mailu-default.network:ip=10.230.230.254
 [Service]
 Restart=always
 
+ExecStartPost=-/bin/sh -c 'sleep 3; podman exec mailu-resolver unbound-anchor -a /etc/unbound/trusted-key.key -F -v; podman kill --signal HUP mailu-resolver'
+#the absolute young scholars who designed this didnt think about the DNSSEC actually expiring so this janky bullshit will have to do
+
 [Install]
 WantedBy=mailu.target