diff --git a/internal/controld/config.go b/internal/controld/config.go
index b833699..d2451eb 100644
--- a/internal/controld/config.go
+++ b/internal/controld/config.go
@@ -10,7 +10,6 @@ import (
 	"io"
 	"net"
 	"net/http"
-	"os"
 	"runtime"
 	"strings"
 	"time"
@@ -127,7 +126,7 @@ func FetchResolverUID(ctx context.Context, req *UtilityOrgRequest, version strin
 
 	hostname := req.Hostname
 	if req.Hostname == "" {
-		hostname, _ = os.Hostname()
+		hostname, _ = preferredHostname()
 		ctrld.Log(ctx, logger.Debug(), "Using system hostname: %s", hostname)
 		req.Hostname = hostname
 	} else {
diff --git a/internal/controld/hostname_darwin.go b/internal/controld/hostname_darwin.go
new file mode 100644
index 0000000..107b4cd
--- /dev/null
+++ b/internal/controld/hostname_darwin.go
@@ -0,0 +1,26 @@
+package controld
+
+import (
+	"os"
+	"os/exec"
+	"strings"
+)
+
+// preferredHostname returns the best available hostname on macOS.
+// It prefers scutil --get ComputerName which is the user-configured name
+// from System Settings → General → About → Name. This is immune to
+// DHCP/network state that can cause os.Hostname() and even LocalHostName
+// to return generic names like "Mac.lan" on Sequoia with Private Wi-Fi
+// Address enabled.
+//
+// Fallback chain: ComputerName → LocalHostName → os.Hostname()
+func preferredHostname() (string, error) {
+	for _, key := range []string{"ComputerName", "LocalHostName"} {
+		if out, err := exec.Command("scutil", "--get", key).Output(); err == nil {
+			if name := strings.TrimSpace(string(out)); name != "" {
+				return name, nil
+			}
+		}
+	}
+	return os.Hostname()
+}
diff --git a/internal/controld/hostname_others.go b/internal/controld/hostname_others.go
new file mode 100644
index 0000000..9ae1026
--- /dev/null
+++ b/internal/controld/hostname_others.go
@@ -0,0 +1,10 @@
+//go:build !darwin
+
+package controld
+
+import "os"
+
+// preferredHostname returns the system hostname on non-Darwin platforms.
+func preferredHostname() (string, error) {
+	return os.Hostname()
+}