diff --git a/etc/systemd/resolved.conf.d/dot-quad9-ecs-appliedprivacy.conf b/etc/systemd/resolved.conf.d/dot-quad9-ecs-appliedprivacy.conf
new file mode 100644
index 00000000..dce5dff4
--- /dev/null
+++ b/etc/systemd/resolved.conf.d/dot-quad9-ecs-appliedprivacy.conf
@@ -0,0 +1,7 @@
+# This is kind of DNS-over-TLS.conf, but with ECS and just the hope of
+# passing restricctive networks with Quad9. Use-case: Steam Deck
+[Resolve]
+DNS=2620:fe::11#dns11.quad9.net 149.112.112.11#dns11.quad9.net 2620:fe::fe:11#dns11.quad9.net 9.9.9.11#dns11.quad9.net [2a02:1b8:10:234::2]:443#dot1.applied-privacy.net 146.255.56.98:443#dot1.applied-privacy.net
+Domains=~.
+DNSOverTLS=yes
+Cache=yes