diff --git a/main.tf b/main.tf
index 69a3574..99fabc4 100644
--- a/main.tf
+++ b/main.tf
@@ -15,7 +15,7 @@ locals {
     )
   ])
 
-  technitium_enabled = try(data.external.infisical.result["technitium_api_token"], "") != ""
+  technitium_enabled = var.technitium_enabled && try(data.external.infisical.result["technitium_api_token"], "") != ""
   ipam_enabled       = try(data.external.infisical.result["ipam_username"], "") != ""
   caddy_enabled      = var.caddy_host != ""
 
diff --git a/terraform.tfvars b/terraform.tfvars
index 070af1a..4223690 100644
--- a/terraform.tfvars
+++ b/terraform.tfvars
@@ -29,6 +29,10 @@ technitium_host = "http://192.168.7.2:5380"
 # Every declared node automatically gets an A record in the search_domain zone
 # (lan.oswaldtheotter.net). Define extra zones and manual records below.
 
+# Set to false to stop Terraform from managing Technitium DNS zones/records
+# (the LXC itself is unaffected; only module.technitium is skipped).
+technitium_enabled = false
+
 # Additional zones beyond the auto-managed search_domain zone.
 dns_zones = {
   # "internal.oswaldtheotter.net" = { type = "Primary" }
diff --git a/vars.tf b/vars.tf
index 3644ee9..8b301b2 100644
--- a/vars.tf
+++ b/vars.tf
@@ -40,6 +40,12 @@ variable "technitium_host" {
   default     = ""
 }
 
+variable "technitium_enabled" {
+  description = "Set to false to stop Terraform from managing Technitium DNS zones/records, without changing anything else. Still requires technitium_api_token in Infisical to actually turn on."
+  type        = bool
+  default     = true
+}
+
 variable "dns_zones" {
   description = "Additional Technitium DNS zones to create, beyond the auto-managed search_domain zone. Keyed by zone name."
   type = map(object({