diff --git a/hosts/asusmini/auto-update.nix b/hosts/asusmini/auto-update.nix
index 0a7d4fb..40ef7e8 100644
--- a/hosts/asusmini/auto-update.nix
+++ b/hosts/asusmini/auto-update.nix
@@ -7,6 +7,7 @@
       git
       nix
       openssh
+      dnscontrol
     ];
 
     serviceConfig = {
@@ -48,6 +49,9 @@
         exit 1
       fi
 
+      echo "Applying DNS configuration..."
+      dnscontrol push --config dns/dnscontrol.js --creds dns/creds.json
+
       echo "Auto-update completed successfully"
     '';
   };
diff --git a/hosts/asusmini/default.nix b/hosts/asusmini/default.nix
index 37fafdc..116fc49 100644
--- a/hosts/asusmini/default.nix
+++ b/hosts/asusmini/default.nix
@@ -67,7 +67,11 @@
   };
 
   # Allow unfree packages
-  nixpkgs.config.allowUnfree = true;
+  nixpkgs.config = {
+    allowUnfree = true;
+    # PDS v0.4.219 uses a pnpm 9 lockfile; pnpm is build-only here.
+    permittedInsecurePackages = [ "pnpm-9.15.9" ];
+  };
 
   # List packages installed in system profile. To search, run:
   # $ nix search wget
diff --git a/overlays/default.nix b/overlays/default.nix
index 13463f0..417e222 100644
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -31,6 +31,36 @@ final: prev: {
     };
 
     sourceRoot = "${src.name}/service";
+    patches = [];
+    nativeBuildInputs =
+      (builtins.filter (pkg: !(builtins.elem (pkg.pname or "") [ "nodejs" "pnpm" ])) old.nativeBuildInputs)
+      ++ [ prev.nodejs_22 prev.pnpm_9 ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      pushd ./node_modules/.pnpm/better-sqlite3@*/node_modules/better-sqlite3
+      npm run build-release --offline --nodedir="${prev.srcOnly prev.nodejs_22}"
+      find build -type f -exec remove-references-to -t "${prev.srcOnly prev.nodejs_22}" {} \;
+      popd
+
+      makeWrapper "${prev.nodejs_22}/bin/node" "$out/bin/pds" \
+        --add-flags --enable-source-maps \
+        --add-flags "$out/lib/pds/index.js" \
+        --set-default NODE_ENV production
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/{bin,lib/pds}
+      mv node_modules $out/lib/pds
+      mv index.js $out/lib/pds
+
+      runHook postInstall
+    '';
 
     # pnpmDeps must be re-fetched whenever src changes because pnpm-lock.yaml
     # may have changed. The hash below was computed by running a build with
@@ -39,8 +69,8 @@ final: prev: {
       pname = "pds";
       inherit version src sourceRoot;
       pnpm = prev.pnpm_9;
-      fetcherVersion = 2;
-      hash = "sha256-n7UurqgR15vu1yNRXCWTWpEU42xgqVVaKurIMvt3XYk=";
+      fetcherVersion = 3;
+      hash = "sha256-rZpimxX4oDXIaUdAkkNPEff6qYJ9C8KptsPWJKwPiFo=";
     };
   });
 }