diff --git a/configuration-files/roles/dns_backend/templates/unbound.conf.j2 b/configuration-files/roles/dns_backend/templates/unbound.conf.j2
index 1fe762d..eddaed5 100644
--- a/configuration-files/roles/dns_backend/templates/unbound.conf.j2
+++ b/configuration-files/roles/dns_backend/templates/unbound.conf.j2
@@ -84,6 +84,9 @@ server:
   so-rcvbuf:              {{ unbound_so_rcvbuf }}
   so-sndbuf:              {{ unbound_so_sndbuf }}
 
+  # Mitigate CVE-2026-44690
+  aggressive-nsec:        no
+
 {% if unbound_test_records %}
   # --------------------------------------------------------------------------------------------------------------------
   # Test records