diff --git a/servers/legion/adguard.tf b/servers/legion/adguard.tf
index ef6d8d0..f769b63 100644
--- a/servers/legion/adguard.tf
+++ b/servers/legion/adguard.tf
@@ -88,6 +88,8 @@ resource "kubernetes_config_map" "adguard_defaults" {
           url: https://easylist.to/easylist/easyprivacy.txt
           name: EasyPrivacy
           id: 5
+      tls:
+        allow_unencrypted_doh: true
       filtering:
         filtering_enabled: true
         rewrites:
diff --git a/servers/legion/apps/adguard.yaml b/servers/legion/apps/adguard.yaml
index 9691869..e5c4e82 100644
--- a/servers/legion/apps/adguard.yaml
+++ b/servers/legion/apps/adguard.yaml
@@ -57,6 +57,9 @@ spec:
                       else:
                           cfg.setdefault("filters", []).append(df)
 
+                  # Enforce allow_unencrypted_doh
+                  cfg.setdefault("tls", {})["allow_unencrypted_doh"] = True
+
                   # Fix/ensure rewrites
                   cfg.setdefault("filtering", {})
                   existing_rw = {rw["domain"]: rw for rw in cfg["filtering"].get("rewrites", [])}