diff --git a/anaconda.spec.in b/anaconda.spec.in
index 3f88e8f257c..d8fb551d205 100644
--- a/anaconda.spec.in
+++ b/anaconda.spec.in
@@ -287,6 +287,9 @@ Requires: skopeo
 Requires: nvme-cli
 # Needed for bootc
 Requires: podman
+# needed for encrypted DNS
+Requires: dnsconfd
+Requires: dnsconfd-dracut
 
 %description install-img-deps
 The anaconda-install-img-deps metapackage lists all boot.iso installation
@@ -353,6 +356,9 @@ Requires: dracut-live
 Requires: xz
 Requires: python3-kickstart
 Requires: iputils
+# Required for encrypted DNS
+Requires: dnsconfd-dracut
+Requires: dnsconfd
 
 %description dracut
 The 'anaconda' dracut module handles installer-specific boot tasks and
diff --git a/pyanaconda/modules/network/network.py b/pyanaconda/modules/network/network.py
index 142697feddf..287998d5e6e 100644
--- a/pyanaconda/modules/network/network.py
+++ b/pyanaconda/modules/network/network.py
@@ -422,6 +422,17 @@ def collect_requirements(self):
                 reason="Necessary for biosdevname network device naming feature."
             ))
 
+        # encrypted dns
+        if self._is_using_dnsconfd(kernel_arguments):
+            requirements.append(Requirement.for_package(
+                "dnsconfd",
+                reason="Necessary for encrypted DNS configurtion."
+            ))
+            requirements.append(Requirement.for_package(
+                "dnsconfd-dracut",
+                reason="Necessary for encrypted DNS configuration in initramfs."
+            ))
+
         return requirements
 
     def configure_activation_on_boot_with_task(self, onboot_ifaces):
@@ -810,3 +821,6 @@ def _is_using_persistent_device_names(self, kernel_args):
 
     def _is_using_biosdevname(self, kernel_args):
         return kernel_args.get('biosdevname') == "1"
+
+    def _is_using_dnsconfd(self, kernel_args):
+        return kernel_args.get('rd.net.dns-backend') == "dnsconfd"