diff --git a/cmd/cli/dns_proxy.go b/cmd/cli/dns_proxy.go
index 1b08c9d..6b26a33 100644
--- a/cmd/cli/dns_proxy.go
+++ b/cmd/cli/dns_proxy.go
@@ -1281,6 +1281,9 @@ func (p *prog) reinitializeOSResolver(networkChange bool) {
 
 		// Launch a goroutine that monitors the non-OS upstreams.
 		go func() {
+			p.leakingQueryReset.Store(true)
+			defer p.leakingQueryReset.Store(false)
+
 			recoveredUpstream, err := p.waitForNonOSResolverRecovery(ctx)
 			if err != nil {
 				mainLog.Load().Warn().Err(err).Msg("No non-OS upstream recovered within the timeout; not re-enabling the listener")