diff --git a/hshbase/systemd-resolved/init.sls b/hshbase/systemd-resolved/init.sls
index 64a8829bb334e31c1d6aa177c461fed5cc6cf3e8..86d7bf658e7dc846d7f7f46001a135e0107de3ac 100644
--- a/hshbase/systemd-resolved/init.sls
+++ b/hshbase/systemd-resolved/init.sls
@@ -21,3 +21,18 @@ hsh_override_resolveconf_with_symlink:
     - force: True
     - require:
       - service: hsh_enable_and_restart_systemd_resolved
+
+{% if grains['oscodename'] == 'stretch' %}
+hsh_override_resolveconf_with_symlink:
+  file.managed:
+    - name: /run/systemd/resolve/stub-resolv.conf
+    - require:
+      - service: hsh_enable_and_restart_systemd_resolved
+    - content: |
+        # This file is managed by Salt.
+        # Welcome to the Debian 9 sadness. This file is a workaround.
+        # With Debian 10, systemd-resolved should replace this.
+        ########
+        nameserver 127.0.0.53
+        options edns0
+{% endif %}