diff --git a/helm/robusta/templates/_helpers.tpl b/helm/robusta/templates/_helpers.tpl
index 95520fb38..ee0faf217 100644
--- a/helm/robusta/templates/_helpers.tpl
+++ b/helm/robusta/templates/_helpers.tpl
@@ -11,6 +11,40 @@ If release name contains chart name it will be used as a full name.
 {{- end }}
 {{- end }}
 
+{{/*
+Render dnsPolicy (+ optional dnsConfig) for a component.
+Pass the component's dnsConfig dict as the context, e.g.:
+  {{- include "robusta.dnsConfig" .Values.runner.dnsConfig | nindent 6 }}
+When disabled (or unset) it falls back to dnsPolicy: ClusterFirst.
+*/}}
+{{- define "robusta.dnsConfig" -}}
+{{- if and . .enabled -}}
+{{- $policy := default "ClusterFirst" .policy -}}
+{{- $hasConfig := or .nameservers .searches .options -}}
+{{- if and (eq $policy "None") (not .nameservers) -}}
+{{- fail "dnsConfig: when dnsPolicy is 'None', you must provide at least one nameserver (Kubernetes requires it)" -}}
+{{- end -}}
+dnsPolicy: {{ $policy | quote }}
+{{- if $hasConfig }}
+dnsConfig:
+  {{- with .nameservers }}
+  nameservers:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .searches }}
+  searches:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .options }}
+  options:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- else -}}
+dnsPolicy: ClusterFirst
+{{- end -}}
+{{- end -}}
+
 {{ define "robusta.configfile" -}}
 playbook_repos:
 {{ toYaml .Values.playbookRepos | indent 2 }}
diff --git a/helm/robusta/templates/forwarder.yaml b/helm/robusta/templates/forwarder.yaml
index 99c7d577e..e4190806d 100644
--- a/helm/robusta/templates/forwarder.yaml
+++ b/helm/robusta/templates/forwarder.yaml
@@ -40,6 +40,7 @@ spec:
       securityContext:
       {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- include "robusta.dnsConfig" .Values.kubewatch.dnsConfig | nindent 6 }}
       containers:
       - name: kubewatch
         # this is a custom version of kubewatch built from https://github.com/aantn/kubewatch
diff --git a/helm/robusta/templates/runner.yaml b/helm/robusta/templates/runner.yaml
index f7d9bd177..7cf65d837 100644
--- a/helm/robusta/templates/runner.yaml
+++ b/helm/robusta/templates/runner.yaml
@@ -43,32 +43,7 @@ spec:
       securityContext:
       {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if .Values.runner.dnsConfig.enabled }}
-      {{- $policy := .Values.runner.dnsConfig.policy }}
-      {{- $hasConfig := or .Values.runner.dnsConfig.nameservers .Values.runner.dnsConfig.searches .Values.runner.dnsConfig.options }}
-
-      {{- if and (eq $policy "None") (not $hasConfig) }}
-        {{- fail "dnsConfig: when dnsPolicy is 'None', you must set at least one of nameservers, searches, or options" }}
-      {{- end }}
-      dnsPolicy: {{ $policy | quote }}
-      {{- if $hasConfig }}
-      dnsConfig:
-        {{- with .Values.runner.dnsConfig.nameservers }}
-        nameservers:
-          {{- toYaml . | nindent 10 }}
-        {{- end }}
-        {{- with .Values.runner.dnsConfig.searches }}
-        searches:
-          {{- toYaml . | nindent 10 }}
-        {{- end }}
-        {{- with .Values.runner.dnsConfig.options }}
-        options:
-          {{- toYaml . | nindent 10 }}
-        {{- end }}
-      {{- end }}
-      {{ else }}
-      dnsPolicy: ClusterFirst
-      {{- end }}
+      {{- include "robusta.dnsConfig" .Values.runner.dnsConfig | nindent 6 }}
       {{- if .Values.runner.hardenedFs }}
       initContainers:
       - name: setup-venv
diff --git a/helm/robusta/values.yaml b/helm/robusta/values.yaml
index 243c183c7..00f0f2c15 100644
--- a/helm/robusta/values.yaml
+++ b/helm/robusta/values.yaml
@@ -658,6 +658,12 @@ kubewatch:
   tolerations: []
   annotations: {}
   nodeSelector: ~
+  dnsConfig:
+    enabled: false
+    policy: ClusterFirst
+    nameservers: []
+    searches: []
+    options: []
   # set to override global.imagePullSecrets for kubewatch; leave empty to inherit the global
   imagePullSecrets: []
   config: