diff --git a/cmd/cli/dns_proxy.go b/cmd/cli/dns_proxy.go
index 0bc042e..9044488 100644
--- a/cmd/cli/dns_proxy.go
+++ b/cmd/cli/dns_proxy.go
@@ -26,6 +26,7 @@ import (
 	"github.com/Control-D-Inc/ctrld/internal/controld"
 	"github.com/Control-D-Inc/ctrld/internal/dnscache"
 	ctrldnet "github.com/Control-D-Inc/ctrld/internal/net"
+	"github.com/Control-D-Inc/ctrld/internal/router"
 )
 
 const (
@@ -620,7 +621,7 @@ func (p *prog) proxy(ctx context.Context, req *proxyRequest) *proxyResponse {
 	ctrld.Log(ctx, mainLog.Load().Error(), "all %v endpoints failed", upstreams)
 
 	// if we have no healthy upstreams, trigger recovery flow
-	if p.recoverOnUpstreamFailure() {
+	if p.leakOnUpstreamFailure() {
 		if p.um.countHealthy(upstreams) == 0 {
 			p.recoveryCancelMu.Lock()
 			if p.recoveryCancel == nil {
@@ -1306,7 +1307,8 @@ func (p *prog) monitorNetworkChanges(ctx context.Context) error {
 		}
 		mainLog.Load().Debug().Msgf("Set default local IPv4: %s, IPv6: %s", selfIP, ipv6)
 
-		if p.recoverOnUpstreamFailure() {
+		// we only trigger recovery flow for network changes on non router devices
+		if router.Name() == "" {
 			p.handleRecovery(RecoveryReasonNetworkChange)
 		}
 	})
diff --git a/cmd/cli/prog.go b/cmd/cli/prog.go
index 8a86bcf..bafc8a4 100644
--- a/cmd/cli/prog.go
+++ b/cmd/cli/prog.go
@@ -985,12 +985,6 @@ func findWorkingInterface(currentIface string) string {
 	return currentIface
 }
 
-// recoverOnUpstreamFailure reports whether ctrld should recover from upstream failure.
-func (p *prog) recoverOnUpstreamFailure() bool {
-	// Default is false on routers, since this recovery flow is only useful for devices that move between networks.
-	return router.Name() == ""
-}
-
 func randomLocalIP() string {
 	n := rand.Intn(254-2) + 2
 	return fmt.Sprintf("127.0.0.%d", n)
@@ -1286,3 +1280,16 @@ func selfUninstallCheck(uninstallErr error, p *prog, logger zerolog.Logger) {
 		selfUninstall(p, logger)
 	}
 }
+
+// leakOnUpstreamFailure reports whether ctrld should initiate a recovery flow
+// when upstream failures occur.
+func (p *prog) leakOnUpstreamFailure() bool {
+	if ptr := p.cfg.Service.LeakOnUpstreamFailure; ptr != nil {
+		return *ptr
+	}
+	// Default is false on routers, since this leaking is only useful for devices that move between networks.
+	if router.Name() != "" {
+		return false
+	}
+	return true
+}