diff --git a/cmd/cli/vpn_dns.go b/cmd/cli/vpn_dns.go
index 6b94e0a..f671d2d 100644
--- a/cmd/cli/vpn_dns.go
+++ b/cmd/cli/vpn_dns.go
@@ -46,6 +46,9 @@ type vpnDNSManager struct {
 	// state for one guarded refresh cycle because Windows can briefly report an
 	// intermediate empty adapter/DNS state after sleep/wake or reconnect.
 	retainedAfterEmptyDiscovery bool
+	// discoverVPNDNS is injected for tests so Refresh does not depend on the
+	// runner host's real VPN/virtual adapter state.
+	discoverVPNDNS func(context.Context) []ctrld.VPNDNSConfig
 	// Called when VPN DNS server list changes, to update intercept exemptions.
 	onServersChanged vpnDNSExemptFunc
 }
@@ -56,6 +59,7 @@ type vpnDNSManager struct {
 func newVPNDNSManager(exemptFunc vpnDNSExemptFunc) *vpnDNSManager {
 	return &vpnDNSManager{
 		routes:           make(map[string][]string),
+		discoverVPNDNS:   ctrld.DiscoverVPNDNS,
 		onServersChanged: exemptFunc,
 	}
 }
@@ -66,7 +70,11 @@ func (m *vpnDNSManager) Refresh(guardAgainstNoNameservers bool) {
 	logger := mainLog.Load()
 
 	logger.Debug().Msg("Refreshing VPN DNS configurations")
-	configs := ctrld.DiscoverVPNDNS(context.Background())
+	discoverVPNDNS := m.discoverVPNDNS
+	if discoverVPNDNS == nil {
+		discoverVPNDNS = ctrld.DiscoverVPNDNS
+	}
+	configs := discoverVPNDNS(context.Background())
 
 	// Detect exit mode: if the default route goes through a VPN DNS interface,
 	// the VPN is routing ALL traffic (exit node / full tunnel). This is more
diff --git a/cmd/cli/vpn_dns_test.go b/cmd/cli/vpn_dns_test.go
index cda5716..e8c03e6 100644
--- a/cmd/cli/vpn_dns_test.go
+++ b/cmd/cli/vpn_dns_test.go
@@ -1,6 +1,7 @@
 package cli
 
 import (
+	"context"
 	"testing"
 
 	"github.com/Control-D-Inc/ctrld"
@@ -20,6 +21,7 @@ func TestVPNDNSRefreshRetainsStateForOneGuardedEmptyDiscovery(t *testing.T) {
 		gotExemptions = exemptions
 		return nil
 	})
+	m.discoverVPNDNS = func(context.Context) []ctrld.VPNDNSConfig { return nil }
 	m.configs = []ctrld.VPNDNSConfig{{
 		InterfaceName: "Ethernet 6",
 		Servers:       []string{"10.25.37.21", "10.25.37.22"},
@@ -46,6 +48,7 @@ func TestVPNDNSRefreshClearsOnSecondGuardedEmptyDiscovery(t *testing.T) {
 		gotExemptions = exemptions
 		return nil
 	})
+	m.discoverVPNDNS = func(context.Context) []ctrld.VPNDNSConfig { return nil }
 	m.configs = []ctrld.VPNDNSConfig{{
 		InterfaceName: "Ethernet 6",
 		Servers:       []string{"10.25.37.21"},