diff --git a/CHANGELOG.md b/CHANGELOG.md
index 17eddc3..b7e19ec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## Unreleased
+
+### BUG FIXES
+
+- Added the polkit action IDs `org.freedesktop.resolve1.{flush-caches,reset-server-features,reset-statistics}`
+  to the list of actions allowed for the user running the OpenVPN client.  The
+  absence of these actions previously led to failures calling the relevant
+  D-Bus methods under configurations that enabled cache flushes, server feature
+  resets, or statistics resets.
+
 ## 2.0.0 (2025.03.23)
 
 ### IMPROVEMENTS
diff --git a/docs/nixos-modules.md b/docs/nixos-modules.md
index 1ec04cc..16ff8db 100644
--- a/docs/nixos-modules.md
+++ b/docs/nixos-modules.md
@@ -10,7 +10,10 @@ package
 
 
 *Default:*
-` pkgs.update-systemd-resolved `
+
+```nix
+pkgs.update-systemd-resolved
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -33,7 +36,10 @@ attribute set of (submodule)
 
 
 *Default:*
-` { } `
+
+```nix
+{ }
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -74,7 +80,10 @@ absolute path *(read only)*
 
 
 *Default:*
-` "/nix/store/<hash>-update-systemd-resolved-<name>.conf" `
+
+```nix
+"/nix/store/<hash>-update-systemd-resolved-<name>.conf"
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -96,7 +105,10 @@ boolean
 
 
 *Default:*
-` false `
+
+```nix
+false
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -118,7 +130,10 @@ string
 
 
 *Default:*
-` "‹name›" `
+
+```nix
+"‹name›"
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -142,7 +157,10 @@ boolean
 
 
 *Default:*
-` false `
+
+```nix
+false
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -163,7 +181,10 @@ submodule
 
 
 *Default:*
-` { } `
+
+```nix
+{ }
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -190,7 +211,10 @@ description of this feature\.
 
 
 *Default:*
-` true `
+
+```nix
+true
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -215,13 +239,16 @@ attribute set of ((submodule) or non-empty string convertible to it)
 
 
 *Default:*
-` { } `
+
+```nix
+{ }
+```
 
 
 
 *Example:*
 
-```
+```nix
 {
   "3.4.5.6" = { };
   resolver-the-first = {
@@ -251,7 +278,10 @@ function that evaluates to a(n) string *(read only)*
 
 
 *Default:*
-` <function> `
+
+```nix
+<function>
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -272,7 +302,10 @@ non-empty string
 
 
 *Default:*
-` "‹name›" `
+
+```nix
+"‹name›"
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -296,7 +329,10 @@ null or non-empty string
 
 
 *Default:*
-` null `
+
+```nix
+null
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -317,7 +353,10 @@ null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)
 
 
 *Default:*
-` null `
+
+```nix
+null
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -338,7 +377,10 @@ null or non-empty string
 
 
 *Default:*
-` null `
+
+```nix
+null
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -366,7 +408,10 @@ the global value for ` DNSOverTLS ` configured in ` resolved.conf `\.
 
 
 *Default:*
-` null `
+
+```nix
+null
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -394,7 +439,10 @@ the global value for ` DNSSEC ` configured in ` resolved.conf `\.
 
 
 *Default:*
-` null `
+
+```nix
+null
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -419,7 +467,10 @@ list of non-empty string
 
 
 *Default:*
-` [ ] `
+
+```nix
+[ ]
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -443,7 +494,10 @@ null or non-empty string
 
 
 *Default:*
-` null `
+
+```nix
+null
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -468,7 +522,10 @@ description of this feature\.
 
 
 *Default:*
-` null `
+
+```nix
+null
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -496,7 +553,10 @@ the global value for ` LLMNR ` configured in ` resolved.conf `\.
 
 
 *Default:*
-` null `
+
+```nix
+null
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -524,7 +584,10 @@ the global value for ` MulticastDNS ` configured in ` resolved.conf `\.
 
 
 *Default:*
-` null `
+
+```nix
+null
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -549,7 +612,10 @@ description of this feature\.
 
 
 *Default:*
-` null `
+
+```nix
+null
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -575,7 +641,10 @@ description of this feature\.
 
 
 *Default:*
-` null `
+
+```nix
+null
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -600,7 +669,10 @@ list of non-empty string
 
 
 *Default:*
-` [ ] `
+
+```nix
+[ ]
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
@@ -625,7 +697,10 @@ list of non-empty string
 
 
 *Default:*
-` [ ] `
+
+```nix
+[ ]
+```
 
 *Declared by:*
  - [nix/nixos-modules\.nix](/nix/nixos-modules.nix)
diff --git a/flake.lock b/flake.lock
index 8071f9c..2293227 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741473158,
-        "narHash": "sha256-kWNaq6wQUbUMlPgw8Y+9/9wP0F8SHkjy24/mN3UAppg=",
+        "lastModified": 1768818222,
+        "narHash": "sha256-460jc0+CZfyaO8+w8JNtlClB2n4ui1RbHfPTLkpwhU8=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "7c9e793ebe66bcba8292989a68c0419b737a22a0",
+        "rev": "255a2b1725a20d060f566e4755dbf571bbbb5f76",
         "type": "github"
       },
       "original": {
@@ -25,11 +25,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1741352980,
-        "narHash": "sha256-+u2UunDA4Cl5Fci3m7S643HzKmIDAe+fiXrLqYsR2fs=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f4330d22f1c5d2ba72d3d22df5597d123fdb60a9",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -40,11 +40,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1742422364,
-        "narHash": "sha256-mNqIplmEohk5jRkqYqG19GA8MbQ/D4gQSK0Mu4LvfRQ=",
+        "lastModified": 1782723713,
+        "narHash": "sha256-oPXCU/SSUokcGaJREHibG1CBX3+s/W7orDWQOZDsEeQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a84ebe20c6bc2ecbcfb000a50776219f48d134cc",
+        "rev": "b5aa0fbd538984f6e3d201be0005b4463d8b09f8",
         "type": "github"
       },
       "original": {
@@ -56,11 +56,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1740877520,
-        "narHash": "sha256-oiwv/ZK/2FhGxrCkQkB83i7GnWXPPLzoqFHpDD3uYpk=",
+        "lastModified": 1782614948,
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "147dee35aab2193b174e4c0868bd80ead5ce755c",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
         "type": "github"
       },
       "original": {
@@ -84,11 +84,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742370146,
-        "narHash": "sha256-XRE8hL4vKIQyVMDXykFh4ceo3KSpuJF3ts8GKwh5bIU=",
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "adc195eef5da3606891cedf80c0d9ce2d3190808",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
         "type": "github"
       },
       "original": {
diff --git a/nix/checks.nix b/nix/checks.nix
index dfde97a..c75cacc 100644
--- a/nix/checks.nix
+++ b/nix/checks.nix
@@ -94,7 +94,7 @@
         // (lib.optionalAttrs (sc ? "Group") {group = sc.Group;})
         // {inherit pkgs lib;};
     in
-      pkgs.nixosTest {
+      pkgs.testers.nixosTest {
         inherit name;
 
         nodes = {
@@ -247,15 +247,15 @@
 
             services.resolved = {
               enable = true;
-              dnssec = "false"; # overridden for VPN interface
-              extraConfig = ''
-                MulticastDNS=no
-              '';
+              settings.Resolve = {
+                DNSSEC = false; # overridden for VPN interface
+                MulticastDNS = false;
+              };
             };
 
             users.users.openvpn = {
               description = "openvpn client user";
-              shell = "${pkgs.utillinux}/bin/nologin";
+              shell = "${pkgs.util-linux or pkgs.utillinux}/bin/nologin";
               isSystemUser = true;
               group = "network";
             };
@@ -324,7 +324,9 @@
 
             security.polkit = {
               enable = true;
-              debug = true;
+
+              # Override the default `["--no-debug" "--log-level=notice"]`.
+              extraArgs = ["--log-level=debug"];
 
               # Log authorization checks.
               extraConfig = ''
diff --git a/nix/packages.nix b/nix/packages.nix
index 3e225bb..e7a2a56 100644
--- a/nix/packages.nix
+++ b/nix/packages.nix
@@ -67,7 +67,7 @@
       # `make test`.
       doCheck = true;
 
-      PREFIX = placeholder "out";
+      env.PREFIX = placeholder "out";
 
       # Rewrite update-systemd-resolved.conf to replace the preset path to
       # update-systemd-resolved with the Nix store path of the
diff --git a/tests/helpers/assertions.sh b/tests/helpers/assertions.sh
index d2fc2a1..1520567 100755
--- a/tests/helpers/assertions.sh
+++ b/tests/helpers/assertions.sh
@@ -33,7 +33,7 @@ all_pairs() {
   local last
 
   # This is called indirectly.
-  # shellcheck disable=SC2317
+  # shellcheck disable=SC2329
   __all_pairs_cond() {
     if [[ -v last ]]; then
       "$all_pairs_cond" "$last" "${1?internal error}" || return
diff --git a/update-systemd-resolved b/update-systemd-resolved
index a4a7d20..2bb821c 100755
--- a/update-systemd-resolved
+++ b/update-systemd-resolved
@@ -320,7 +320,7 @@ _up() {
 
   # This function is called indirectly below (via `each_dhcp_setting`); disable
   # check for unreachable commands.
-  # shellcheck disable=SC2317
+  # shellcheck disable=SC2329
   _dispatch_dhcp_setting() {
     local setting_type="${1?}"
     local setting_value="${2?}"
@@ -779,7 +779,7 @@ each_ip_expansion_func() {
     # messages about (say) not being able to find the `python` or `sipcalc`
     # programs.
     # `log` is called indirectly; disable warning about unreachable command.
-    # shellcheck disable=SC2317
+    # shellcheck disable=SC2329
     if (
       log() { :; }
       "test_${type}_expansion_func" "$expansion_func_impl"
@@ -838,7 +838,7 @@ set_up_ip_expansion_func() {
   if ! declare -f "$expansion_func" &> /dev/null; then
     # This function is called indirectly below (via `each_ip_expansion_func`);
     # disable check for unreachable commands.
-    # shellcheck disable=SC2317
+    # shellcheck disable=SC2329
     choose_expansion_func_impl() {
       expansion_func_impl="$1"
 
@@ -1421,7 +1421,10 @@ const updateSystemdResolved = {
     "set-dns-over-tls",
     "set-dnssec",
     "set-dnssec-negative-trust-anchors",
-    "revert"
+    "revert",
+    "flush-caches",
+    "reset-server-features",
+    "reset-statistics"
   ]),
 
   actionIsAllowed: function(action) {