diff --git a/src/dns.mjs b/src/dns.mjs
index d6c6944..72bf653 100644
--- a/src/dns.mjs
+++ b/src/dns.mjs
@@ -2325,6 +2325,11 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
     readManifest = async (path) => parseManifest(await defaultReadMaybe(path)),
     uid = typeof process.getuid === "function" ? process.getuid() : 0,
     escalate = escalateSelf,
+    // Injected for the same reason as everything above: the enable/disable
+    // decision tree reads the host's drop-ins only on linux/systemd-resolved,
+    // and a test running on any other OS must be able to say "linux" without
+    // lying about the machine it is on.
+    platform: platformImpl = detectPlatform,
   } = deps;
   const [sub, ...rest] = args;
   const flag = (name, fallback) => {
@@ -2595,7 +2600,7 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
   }
 
   if (sub === "enable" || sub === "disable") {
-    const platform = detectPlatform();
+    const platform = platformImpl();
     if (!platform) {
       out(`unsupported platform: ${process.platform}`);
       return 1;
diff --git a/test/dns-disable-restore.test.mjs b/test/dns-disable-restore.test.mjs
index 04aa338..f769312 100644
--- a/test/dns-disable-restore.test.mjs
+++ b/test/dns-disable-restore.test.mjs
@@ -298,6 +298,10 @@ let lastVerifyArgs = null;
 
 function noSystem() {
   return {
+    // The enable/disable tree reads host drop-ins only on linux +
+    // systemd-resolved; pinning the platform makes those paths deterministic
+    // on a Mac or Windows checkout instead of silently skipped.
+    platform: () => "linux",
     tlds: async () => ["eggs", "hacker"],
     safety: async () => ({ safe: true, upstreams: ["1.1.1.1"], why: "" }),
     preflight: async () => ({ ok: true, blockers: [], conflicts: [], duplicates: [], holder: null }),
diff --git a/test/dns-enable-rollback.test.mjs b/test/dns-enable-rollback.test.mjs
index 996c812..8e16e14 100644
--- a/test/dns-enable-rollback.test.mjs
+++ b/test/dns-enable-rollback.test.mjs
@@ -449,6 +449,10 @@ test("--dry-run still reports a preflight that would refuse", async () => {
 /** Every system call `enable` makes, stubbed to a machine where nothing is wrong. */
 function noSystem() {
   return {
+    // The enable tree consults host drop-ins only on linux +
+    // systemd-resolved; pinning the platform keeps those paths testable from
+    // any OS the suite runs on.
+    platform: () => "linux",
     tlds: async () => ["eggs", "hacker"],
     safety: async () => ({ safe: true, upstreams: ["1.1.1.1"], why: "no bridge is running yet — this one will be ours" }),
     preflight: async () => ({ ok: true, blockers: [], conflicts: [], holder: null }),