diff --git a/PopuraDNS b/PopuraDNS
index f76f02b..c7c07e0 160000
--- a/PopuraDNS
+++ b/PopuraDNS
@@ -1 +1 @@
-Subproject commit f76f02bb7219fe4900755ea5c78d99259d32ea62
+Subproject commit c7c07e0e4b0e566ccb69b7456f27e873a261a787
diff --git a/README.md b/README.md
index 7761ced..d4f5d31 100644
--- a/README.md
+++ b/README.md
@@ -100,7 +100,7 @@ The stack now provides DNS resolution for a comprehensive set of alternative TLD
 | `.eth` | ensdns (10.5.0.11) via CoreDNS | Ethereum Name Service (local resolver) |
 | `.bit` | namecoindns (10.5.0.12) via CoreDNS | Namecoin names (local resolver service) |
 | `.alt` | alt-root 185.121.177.177 | Alternative DNS root |
-| `.loki` | Cloudflare 1.1.1.1 | Lokinet privacy network |
+| `.loki` | local lokinet (10.5.0.14) via CoreDNS | Lokinet privacy network |
 | `.zil` | Cloudflare 1.1.1.1 | Zilliqa blockchain |
 | `.web3` | Cloudflare 1.1.1.1 | General blockchain namespace |
 | Alfis TLDs | Alfis (10.5.0.3) | `.anon`, `.btn`, `.conf`, `.index`, `.merch`, `.mirror`, `.mob`, `.screen`, `.srv`, `.ygg` |
@@ -186,6 +186,23 @@ records in Namecoin itself and wait for local `namecoind` sync completion.
 > `.bit` responses may be empty or incomplete.
 
 
+## Local Lokinet (.loki) resolver
+
+`.loki` lookups are resolved by a local Lokinet daemon path:
+
+* CoreDNS forwards `loki.:53` to `10.5.0.14:53` (`lokinet`).
+* `lokinet` resolves `.loki` names through the Lokinet network.
+
+Quick test:
+
+```sh
+docker exec darkpihole dig @10.5.0.4 A oxen.loki
+```
+
+> **Note:** Lokinet may need a short bootstrap period after startup before
+> `.loki` names resolve.
+
+
 ## Monitoring the proxy
 
 A lightweight Prometheus/Grafana stack is included to expose 3proxy metrics
diff --git a/docker-compose.yml b/docker-compose.yml
index d1bc670..b942ccc 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -240,6 +240,23 @@ services:
       darkproxy:
         ipv4_address: 10.5.0.11
 
+  lokinet:
+    build:
+      context: ./lokinet
+      dockerfile: Dockerfile
+    container_name: darklokinet
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - NET_BIND_SERVICE
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    sysctls:
+      - "net.ipv6.conf.all.disable_ipv6=0"
+    networks:
+      darkproxy:
+        ipv4_address: 10.5.0.14
+
   namecoind:
     image: ukd1/namecoind:latest
     container_name: darknamecoind
diff --git a/lokinet/Dockerfile b/lokinet/Dockerfile
new file mode 100644
index 0000000..fdc8bd8
--- /dev/null
+++ b/lokinet/Dockerfile
@@ -0,0 +1,20 @@
+FROM debian:bookworm-slim
+
+ARG LOKINET_VERSION=v0.9.14
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates curl xz-utils iproute2 iptables \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN set -eux; \
+    curl -fsSL -o /tmp/lokinet.tar.xz "https://github.com/oxen-io/lokinet/releases/download/${LOKINET_VERSION}/lokinet-linux-amd64-${LOKINET_VERSION}.tar.xz"; \
+    tar -xJf /tmp/lokinet.tar.xz -C /tmp; \
+    mv "/tmp/lokinet-linux-amd64-${LOKINET_VERSION}/lokinet" /usr/local/bin/lokinet; \
+    chmod +x /usr/local/bin/lokinet; \
+    mkdir -p /etc/lokinet /var/lib/lokinet; \
+    mv "/tmp/lokinet-linux-amd64-${LOKINET_VERSION}/bootstrap.signed" /etc/lokinet/bootstrap.signed; \
+    rm -rf /tmp/lokinet.tar.xz "/tmp/lokinet-linux-amd64-${LOKINET_VERSION}"
+
+COPY lokinet.ini /etc/lokinet/lokinet.ini
+
+CMD ["/usr/local/bin/lokinet", "--config", "/etc/lokinet/lokinet.ini"]
diff --git a/lokinet/lokinet.ini b/lokinet/lokinet.ini
new file mode 100644
index 0000000..f382d35
--- /dev/null
+++ b/lokinet/lokinet.ini
@@ -0,0 +1,19 @@
+[router]
+data-dir=/var/lib/lokinet
+
+[network]
+auto-routing=false
+blackhole-routes=false
+ifname=lokinet0
+
+[dns]
+bind=0.0.0.0:53
+upstream=1.1.1.1:53
+no-resolvconf=1
+
+[bootstrap]
+add-node=/etc/lokinet/bootstrap.signed
+
+[logging]
+type=print
+level=info