diff --git a/dns/sysresolver.go b/dns/sysresolver.go
index ec2dd63..66393cd 100644
--- a/dns/sysresolver.go
+++ b/dns/sysresolver.go
@@ -29,8 +29,8 @@ const dnsHealthCheckTimeout = 2 * time.Second
 //     finally /etc/resolv.conf.
 //   - macOS: reads /etc/resolv.conf, which is never modified by olm's
 //     supplemental scutil DNS override.
-//   - Windows: enumerates DHCP-assigned DNS servers from every network adapter
-//     in the registry.
+//   - Windows: enumerates every network adapter's effective DNS servers
+//     (static if set, else DHCP-assigned) from the registry.
 //   - Other platforms: returns an empty list (no-op monitor).
 type SystemDNSMonitor struct {
 	mu         sync.RWMutex
diff --git a/dns/sysresolver_windows.go b/dns/sysresolver_windows.go
index ce38515..8d78325 100644
--- a/dns/sysresolver_windows.go
+++ b/dns/sysresolver_windows.go
@@ -19,10 +19,14 @@ const (
 // readSystemDNS returns the current system DNS servers in "host:53" format by
 // enumerating every network adapter in the Windows registry.
 //
-// For each adapter olm reads the DHCP-assigned DNS servers (DhcpNameServer).
-// Static DNS (NameServer) is ignored on the assumption that it belongs to the
-// olm WireGuard adapter or another VPN; DHCP-assigned servers always reflect
-// the physical network's DNS.  Loopback and link-local addresses are excluded.
+// For each adapter olm reads the effective DNS servers: static (NameServer)
+// if set, since a static entry overrides DHCP for that adapter and is what
+// the OS resolver actually uses, otherwise falling back to the DHCP-assigned
+// servers (DhcpNameServer). This also picks up olm's own WireGuard adapter,
+// which olm points at its local DNS proxy via a static NameServer entry; that
+// address is expected to be filtered out by the caller via
+// SystemDNSMonitor.SetExcludeIP. Loopback and link-local addresses are
+// excluded.
 func readSystemDNS() []string {
 	key, err := registry.OpenKey(registry.LOCAL_MACHINE, tcpipInterfacesPath, registry.ENUMERATE_SUB_KEYS)
 	if err != nil {
@@ -45,13 +49,16 @@ func readSystemDNS() []string {
 			continue
 		}
 
-		dhcp, _, err := iKey.GetStringValue(dhcpNameServerKey)
+		servers, _, err := iKey.GetStringValue(staticNameServerKey)
+		if err != nil || servers == "" {
+			servers, _, err = iKey.GetStringValue(dhcpNameServerKey)
+		}
 		iKey.Close()
-		if err != nil || dhcp == "" {
+		if err != nil || servers == "" {
 			continue
 		}
 
-		for _, s := range splitWinDNSList(dhcp) {
+		for _, s := range splitWinDNSList(servers) {
 			addr, err := netip.ParseAddr(s)
 			if err != nil {
 				continue