diff --git a/etc/opt/chromium/policies/managed/README.md b/etc/opt/chromium/policies/managed/README.md
index 3116cd2f..3cc6d12d 100644
--- a/etc/opt/chromium/policies/managed/README.md
+++ b/etc/opt/chromium/policies/managed/README.md
@@ -151,7 +151,8 @@ Incompatible with any actual DoH policy.
 
 ## `doh-dns0.json`
 
-Simply enables DNS-over-HTTPS with DNS0.eu
+Simply enables DNS-over-HTTPS with DNS0.eu. `automatic` means downgrade is
+allowed (the system resolver is encrypted), `secure` would lock it.
 
 ## `enable-ech-ocsp.json`
 
diff --git a/etc/opt/chromium/policies/managed/doh-dns0.json b/etc/opt/chromium/policies/managed/doh-dns0.json
index 5f1e4ed0..b7f968b6 100644
--- a/etc/opt/chromium/policies/managed/doh-dns0.json
+++ b/etc/opt/chromium/policies/managed/doh-dns0.json
@@ -1,4 +1,4 @@
 {
-  "DnsOverHttpsMode": "secure",
+  "DnsOverHttpsMode": "automatic",
   "DnsOverHttpsTemplates": "https://dns0.eu"
 }