diff --git a/internal/catalogue/node_resolver_test.go b/internal/catalogue/node_resolver_test.go
index 24caf3e..b5cec6d 100644
--- a/internal/catalogue/node_resolver_test.go
+++ b/internal/catalogue/node_resolver_test.go
@@ -176,3 +176,41 @@ func TestTheCataloguesResolverHoldersWriteTheFileAndProvideSplitDNS(t *testing.T
 		t.Skip("no module of the catalogue holds node-resolver yet")
 	}
 }
+
+// The catalogue's systemd-resolved, composed on a machine beside its uplink: the resolver file names the
+// machine's own private address alone, its kept copy is the same file, and resolved is given every mesh
+// resolver as its default route and the private address to listen on. Skipped without the catalogue.
+func TestTheCataloguesResolverComposesOnAMachine(t *testing.T) {
+	shelf := resolverShelf(t)
+	shelf["systemd-resolved"] = catalogueManifest(t, "systemd-resolved")
+	got, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", "systemd-resolved"}, splitDNSLaptop(), World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := got.Declaration(Rendering{Names: twoMachines, Machines: twoMachines, Suffix: "internal",
+		Holders:  map[string]map[string]string{"mesh-dns-resolver": {"anchor.internal": "10.42.0.1", "home.internal": "10.42.0.3"}},
+		Needed:   map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
+		Settings: SettingsBy{"dnsmasq": {{From: "the mesh", Values: map[string]any{"listen-addresses": "127.0.0.1"}}}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ids := byID(out)
+	resolv, _ := ids["systemd-resolved.fact-resolvers"]["content"].(string)
+	kept, _ := ids["systemd-resolved.fact-kept"]["content"].(string)
+	if !strings.Contains(resolv, "\nnameserver 10.42.0.2\noptions timeout:1 attempts:2 edns0\n") || resolv != kept {
+		t.Errorf("the resolver file does not name this machine's own resolver alone, or its copy differs:\n%s", resolv)
+	}
+	if ids["systemd-networkd.fact-resolvers"] != nil {
+		t.Error("the uplink's holder still writes the resolver file beside the resolver's")
+	}
+	conf, _ := ids["systemd-resolved.fact-resolved"]["content"].(string)
+	for _, want := range []string{"\nDNS=10.42.0.1 10.42.0.3 \n", "\nDNSStubListenerExtra=10.42.0.2\n", "\nFallbackDNS=\n"} {
+		if !strings.Contains(conf, want) {
+			t.Errorf("resolved's drop-in lacks %q:\n%s", want, conf)
+		}
+	}
+	if s, _ := ids["systemd-resolved.fact-suffix"]["content"].(string); s != "internal\n" {
+		t.Errorf("the mesh's domain is rendered as %q", s)
+	}
+}