diff --git a/tasks/configure_network.yml b/tasks/configure_network.yml
index c695d840d36d713545d64e70db38ba251ce6a9e8..bb1956c75b2538088648c83754359a7eb94c50ac 100644
--- a/tasks/configure_network.yml
+++ b/tasks/configure_network.yml
@@ -1,6 +1,64 @@
 ---
-- name: configure DNS settings
-  net_system:
-    domain-search: "{{ vault_domain_name }}"
-    name_servers: "{{ vault_name_servers }}"
-    state: present
+# Sooo, WTF is this?
+# In Debian 11 Bullseye's default configuration, network is managed by
+#`ifupdown`. This is OK until you try to use NFS mounts, because they require
+# the network to be fully up and reachable. As `ifupdown` won't properly report
+# the actual network status, SystemD will try to mount NFS shares too early and
+# fail inevitably, because the network is not reachable yet.
+#
+# The only proper solution is to swith over to `systemd-networkd`, where this
+# kind of reporting works as expected and the task of mounting NFS shares is
+# put into the correct position during startup ordering.
+#
+# After these tasks have run, you can use `networkctl` to check if the network
+# is configured as expected.
+#
+# We seize the opportunity to switch over to `systemd-resolvd` as well, because
+# it offers DNSSec etc., and, frankly, because we can.
+#
+# After these tasks have run, you can use `resolvectl` to check if the name
+# resolution is configured as expected.
+#
+# As of the time of writing this (2023-01-12), this is a custom configuration,
+# but @Zumpe already told me that the GUBS dev team has plans to make
+# `systemd-networkd` and `systemd-resolved` the default for Debian 12 in GUBS
+# installations, so once this is done, we can probably dispose of these tasks
+# altogether.
+
+# Create a `systemd-networkd` config for ens192 and remove any configuration
+# for that interface from the traditional '/etc/network/interfaces' config file
+# to avoid any interference and hand over management for that interface to
+# `systemd-networkd`. Now, '/etc/network/interfaces' will only contain the
+# config for the loopback interface.
+- name: deploy network interface config
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "/{{ item }}"
+    mode: "0644"
+  loop:
+    - "etc/systemd/network/ens192.network"
+    - "etc/network/interfaces"
+
+- name: Link /etc/resolv.conf
+  ansible.builtin.file:
+    src: "/run/systemd/resolve/stub-resolv.conf"
+    dest: "/etc/resolv.conf"
+    state: link
+    force: true
+
+- name: Enable systemd-networkd but don't start now
+  ansible.builtin.systemd:
+    name: "{{ item.n }}"
+    enabled: true
+    state: "{{ item.s | default(omit) }}"
+    daemon_reload: true
+  loop:
+    - n: "systemd-networkd.service"
+    - n: "systemd-resolved.service"
+      s: started
+    - n: "systemd-networkd-wait-online.service"
+
+# The network changes require a reboot, so do that.
+- name: reboot system
+  ansible.builtin.reboot:
+  changed_when: False
diff --git a/tasks/main.yml b/tasks/main.yml
index 97dbda6b3f681202b83bc50e9a72243c8009e101..785d766ddd4f12e58e8738282ff897b4a1a30daa 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -145,6 +145,10 @@
   import_tasks: configure_ntp.yml
   tags: [ntp]
 
+- name: Configure Network
+  ansible.builtin.import_tasks: "configure_network.yml"
+  tags: [network, dns, resolv]
+
 # there's no way to get this task to become idempotent, so we have to skip the test
 - name: Flush handlers am Ende der Rolle
   ansible.builtin.meta: flush_handlers
diff --git a/templates/etc/network/interfaces.j2 b/templates/etc/network/interfaces.j2
new file mode 100644
index 0000000000000000000000000000000000000000..abdf860510c5f860b0c2f2a463908fbabf103198
--- /dev/null
+++ b/templates/etc/network/interfaces.j2
@@ -0,0 +1,9 @@
+
+# This file describes the network interfaces available on your system
+# and how to activate them. For more information, see interfaces(5).
+
+# The loopback network interface
+auto lo
+iface lo inet loopback
+
+# ALL OTHER INTERFACES ARE CONFIGURED BELOW "/etc/systemd/network/".
diff --git a/templates/etc/systemd/network/ens192.network.j2 b/templates/etc/systemd/network/ens192.network.j2
new file mode 100644
index 0000000000000000000000000000000000000000..2818653833c13098dc50b1139ae3923be191403f
--- /dev/null
+++ b/templates/etc/systemd/network/ens192.network.j2
@@ -0,0 +1,11 @@
+[Match]
+Name={{ ansible_facts.default_ipv4.interface }}
+
+[Network]
+Address={{ ansible_facts.default_ipv4.address }}/{{ ansible_facts.default_ipv4.prefix }}
+Gateway={{ ansible_facts.default_ipv4.gateway }}
+DNS=194.95.142.200
+DNS=194.95.142.203
+DNS=194.95.142.157
+Domains=slub-dresden.de
+LLMNR=no