diff --git a/mermaids.sh b/mermaids.sh
index 381de17..9ff484c 100644
--- a/mermaids.sh
+++ b/mermaids.sh
@@ -135,29 +135,49 @@ die() { echo -e "${RED}[$(date +%H:%M:%S)]${NC} $1"; exit 1; }
 PORT="${1:-80}"
 
 # === Now run operations ===
-log "Setting up apt with public DNS..."
-mkdir -p /etc/apt/apt.conf.d
-cat > /etc/apt/apt.conf.d/99-dns <<'APTCONF'
-Acquire::Dns "1.1.1.1";
-APTCONF
+log "Setting up DNS (critical step)..."
 
-cat > /etc/resolv.conf <<'RESOLVCONF'
+# Backup original resolv.conf
+cp /etc/resolv.conf /etc/resolv.conf.bak 2>/dev/null || true
+
+# Force public DNS (bypass AdGuard which may have DoH issues)
+cat > /etc/resolv.conf <<'EOF'
 nameserver 1.1.1.1
-RESOLVCONF
+nameserver 8.8.8.8
+EOF
 
-log "Updating package lists..."
+# Verify DNS works
+log "Verifying DNS resolution..."
+if ! nslookup deb.debian.org 1.1.1.1 &>/dev/null; then
+  die "DNS resolution failed — check network connectivity"
+fi
+
+log "DNS verified ✓"
+
+# === 2. Now configure apt ===
+log "Configuring apt sources..."
+mkdir -p /etc/apt/apt.conf.d
+
+# Use explicit DNS for apt (redundant but safe)
+cat > /etc/apt/apt.conf.d/99-dns <<'EOF'
+Acquire::Dns "1.1.1.1";
+Acquire::Dns "8.8.8.8";
+EOF
+
+# Enable non-free repository
 if grep -q "deb debianmain" /etc/apt/sources.list; then
   sed -i 's/deb \(.*\) main/deb \1 main non-free non-free-firmware/' /etc/apt/sources.list
 fi
 
-apt-get update -o Acquire::Retries=3 || {
-  warn "apt-get update failed — checking DNS..."
-  cat /etc/resolv.conf
-  exit 1
+# === 3. Update apt (with retries) ===
+log "Updating package lists (with retries)..."
+apt-get update -o Acquire::Retries=5 -o APT::Acquire::Retries=5 || {
+  warn "First apt-get update failed — retrying..."
+  sleep 5
+  apt-get update -o Acquire::Retries=5 || die "apt-get update failed after retries"
 }
 
-# Clean up temporary DNS config
-rm -f /etc/resolv.conf /etc/apt/apt.conf.d/99-dns 2>/dev/null
+log "✓ apt-get update succeeded"
 
 log "Installing dependencies..."
 apt-get install -y -qq \