diff --git a/standard/atomic-update-ca-trust.service b/standard/atomic-update-ca-trust.service
index 245766cd..9c0cc8c2 100644
--- a/standard/atomic-update-ca-trust.service
+++ b/standard/atomic-update-ca-trust.service
@@ -20,6 +20,11 @@ DefaultDependencies=no
 Requires=local-fs.target
 After=local-fs.target
 Before=sysinit.target
+# systemd-resolved also uses DefaultDependencies=no and orders itself before
+# sysinit.target, so without an explicit ordering it can start in parallel
+# with regeneration and read a stale trust store for DNS-over-TLS. Order
+# before it; systemd ignores this when the unit is not installed.
+Before=systemd-resolved.service
 
 [Service]
 Type=oneshot