diff --git a/plugins/lookup/container_dns.py b/plugins/lookup/container_dns.py
index 46d1b61cbd..dea93945b7 100644
--- a/plugins/lookup/container_dns.py
+++ b/plugins/lookup/container_dns.py
@@ -5,7 +5,6 @@ from typing import Any
 from ansible.plugins.lookup import LookupBase
 
 _TOR_ROLE = "svc-net-tor"
-_BRIDGE_MODE = "compose"
 
 
 def resolve_container_dns(variables: dict[str, Any]) -> list[str]:
@@ -17,8 +16,8 @@ def resolve_container_dns(variables: dict[str, Any]) -> list[str]:
     bridge address because docker discards loopback resolvers, and it is
     absent before docker itself is installed, hence the guard.
 
-    Only compose mode gets the bridge: TOR_CONTAINER_DNS_HOST creates the
-    matching dnsmasq listener there and nowhere else.
+    Both deploy modes get the bridge: a Tor node runs the same dnsmasq
+    listener in compose and in swarm, so both resolve onions alike.
 
     The clearnet resolver stays as a second entry so that losing dnsmasq costs
     onion names rather than all name resolution.
@@ -26,19 +25,12 @@ def resolve_container_dns(variables: dict[str, Any]) -> list[str]:
     facts = variables.get("ansible_facts") or {}
     bridge = ((facts.get("docker0") or {}).get("ipv4") or {}).get("address") or ""
     on_tor_node = _TOR_ROLE in (variables.get("group_names") or [])
-    bridge_reachable = (
-        str(variables.get("DEPLOYMENT_MODE") or "").strip() == _BRIDGE_MODE
-    )
 
     clearnet = ((variables.get("networks") or {}).get("internet") or {}).get(
         "dns"
     ) or ""
 
-    return [
-        str(r)
-        for r in (bridge if (on_tor_node and bridge_reachable) else "", clearnet)
-        if r
-    ]
+    return [str(r) for r in (bridge if on_tor_node else "", clearnet) if r]
 
 
 class LookupModule(LookupBase):
diff --git a/roles/svc-net-tor/tasks/router.yml b/roles/svc-net-tor/tasks/router.yml
index dfd32a5ff0..273c0dc320 100644
--- a/roles/svc-net-tor/tasks/router.yml
+++ b/roles/svc-net-tor/tasks/router.yml
@@ -5,7 +5,6 @@
     fail_msg: >-
       networks.internet.dns must be set on a Tor node: dnsmasq runs with
       no-resolv and would answer .onion only.
-  when: DEPLOYMENT_MODE == 'compose'
 - name: "📦 Egress router | Install dnsmasq (host split-DNS forwarder)"
   become: true
   package_install:
@@ -35,7 +34,7 @@
   register: _tor_dnsmasq_foreign
 - name: "🔧 Egress router | Decide whether this dnsmasq is ours to reshape"
   ansible.builtin.set_fact:
-    TOR_DNSMASQ_OWNS_LISTENER: "{{ _tor_dnsmasq_foreign.matched == 0 and DEPLOYMENT_MODE == 'compose' }}"
+    TOR_DNSMASQ_OWNS_LISTENER: "{{ _tor_dnsmasq_foreign.matched == 0 }}"
 
 - name: "📝 Egress router | Render dnsmasq .onion split-DNS drop-in"
   ansible.builtin.template: # nocheck: stack-host-template (per-host dnsmasq system config in /etc/dnsmasq.d)
diff --git a/roles/svc-net-tor/vars/main.yml b/roles/svc-net-tor/vars/main.yml
index d0ed0db149..9f52d6e924 100644
--- a/roles/svc-net-tor/vars/main.yml
+++ b/roles/svc-net-tor/vars/main.yml
@@ -13,7 +13,7 @@ TOR_FLAVOR: "{{ lookup('config', application_id, 'services.tor.flavor', 'public'
 TOR_TRANS_PORT: "{{ lookup('config', application_id, 'services.tor.ports.local.trans') }}"
 TOR_DNS_PORT: "{{ lookup('config', application_id, 'services.tor.ports.local.dns') }}"
 TOR_DNSMASQ_CONF: "/etc/dnsmasq.d/tor-onion.conf"
-TOR_CONTAINER_DNS_HOST: "{{ ansible_facts['docker0']['ipv4']['address'] | default('', true) if DEPLOYMENT_MODE == 'compose' else '' }}"
+TOR_CONTAINER_DNS_HOST: "{{ ansible_facts['docker0']['ipv4']['address'] | default('', true) }}"
 TOR_HS_BACKEND_HOST: "{{ ansible_facts['default_ipv4']['address'] if DEPLOYMENT_MODE == 'swarm' else (TOR_CONTAINER_DNS_HOST | ternary(TOR_CONTAINER_DNS_HOST, '127.0.0.1'))
   }}"