diff --git a/vm/provision.sh b/vm/provision.sh
index c45c4b6..739802b 100644
--- a/vm/provision.sh
+++ b/vm/provision.sh
@@ -40,9 +40,11 @@ echo LANG=en_US.UTF-8 > /etc/locale.conf
 
 echo "== NetworkManager instead of systemd-networkd"
 systemctl disable systemd-networkd.service systemd-networkd.socket systemd-resolved.service || true
-# NetworkManager writes its own resolv.conf; the cloud image's points at
-# systemd-resolved
+# The cloud image's resolv.conf links to systemd-resolved's. NetworkManager
+# only writes a plain file, and systemd's tmpfiles puts the link back at boot
+# if the file is missing, so leave an empty one for NetworkManager to fill.
 rm -f /etc/resolv.conf
+touch /etc/resolv.conf
 systemctl enable NetworkManager.service gdm.service sshd.service
 # Arch's cloud image makes boot wait until the clock has synced, and sshd
 # waits for that. Without systemd-networkd, systemd-timesyncd thinks it's