diff --git a/agent/src/apply.ts b/agent/src/apply.ts
index a83c67ef..019ebabb 100644
--- a/agent/src/apply.ts
+++ b/agent/src/apply.ts
@@ -63,10 +63,9 @@ export const services: ManagedService[] = [
     unit: 'dnsmasq',
     async render(config) {
       const site = config.site;
-      // Skip dnsmasq management until the site's DHCP/DNS settings are fully
-      // configured — the templates need all of these fields.
-      if (!site?.internalDomain || !site.dhcpRange || !site.subnetMask
-        || !site.gateway || !site.dnsForwarders) {
+      // DHCP and internal DNS can run on an isolated site. Only the core
+      // DHCP settings are required; gateway and DNS forwarders are optional.
+      if (!site?.internalDomain || !site.dhcpRange || !site.subnetMask) {
         return null;
       }
       const data = { site };
diff --git a/agent/templates/dnsmasq/dhcp-opts.ejs b/agent/templates/dnsmasq/dhcp-opts.ejs
index 03977999..0642d05d 100644
--- a/agent/templates/dnsmasq/dhcp-opts.ejs
+++ b/agent/templates/dnsmasq/dhcp-opts.ejs
@@ -1 +1 @@
-option:router,<%= site.gateway %>
+<%_ if (site.gateway) { _%>option:router,<%= site.gateway %><%_ } else { _%>option:router<%_ } _%>
diff --git a/agent/templates/dnsmasq/servers.ejs b/agent/templates/dnsmasq/servers.ejs
index b374733e..099592f5 100644
--- a/agent/templates/dnsmasq/servers.ejs
+++ b/agent/templates/dnsmasq/servers.ejs
@@ -1,3 +1,3 @@
-<%_ site.dnsForwarders.split(',').forEach((forwarder) => { _%>
-server=<%= forwarder.trim() %>
+<%_ (site.dnsForwarders || '').split(',').map((forwarder) => forwarder.trim()).filter(Boolean).forEach((forwarder) => { _%>
+server=<%= forwarder %>
 <%_ }) _%>