···183183 ];
184184 dnssec-signing = true;
185185 dnssec-policy = "rsa2k";
186186+ # Disable zone file syncing since the zone file is in the read-only Nix store
187187+ # This prevents "flush event failed" errors when knot tries to write DNSSEC updates
188188+ zonefile-sync = "-1";
189189+ # Load zone changes from journal instead of rewriting the zone file
190190+ # Required when DNSSEC signing is enabled with read-only zone files
191191+ zonefile-load = "difference";
186192 }
187193 ];
188194 };