diff --git a/nixos/modules/services/networking/pihole-ftl.nix b/nixos/modules/services/networking/pihole-ftl.nix
index f170da405e70..e229d818cb8c 100644
--- a/nixos/modules/services/networking/pihole-ftl.nix
+++ b/nixos/modules/services/networking/pihole-ftl.nix
@@ -198,6 +198,19 @@ in
         '';
       };
     };
+
+    webserverEnabled = mkOption {
+      type = types.bool;
+      default = (
+        (hasAttrByPath [ "webserver" "port" ] cfg.settings)
+        && !builtins.elem cfg.settings.webserver.port [
+          ""
+          null
+        ]
+      );
+      internal = true;
+      description = "Whether the webserver is enabled.";
+    };
   };
 
   config = mkIf cfg.enable {
@@ -208,15 +221,7 @@ in
       }
 
       {
-        assertion =
-          builtins.length cfg.lists == 0
-          || (
-            (hasAttrByPath [ "webserver" "port" ] cfg.settings)
-            && !builtins.elem cfg.settings.webserver.port [
-              ""
-              null
-            ]
-          );
+        assertion = builtins.length cfg.lists == 0 || cfg.webserverEnabled;
         message = ''
           The Pi-hole webserver must be enabled for lists set in services.pihole-ftl.lists to be automatically loaded on startup via the web API.
           services.pihole-ftl.settings.port must be defined, e.g. by enabling services.pihole-web.enable and defining services.pihole-web.port.
@@ -348,6 +353,8 @@ in
 
       pihole-ftl-setup = {
         description = "Pi-hole FTL setup";
+        enable = builtins.length cfg.lists > 0;
+
         # Wait for network so lists can be downloaded
         after = [ "network-online.target" ];
         requires = [ "network-online.target" ];
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a50c15852666..84e79bd17947 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1194,6 +1194,7 @@ in
   pict-rs = runTest ./pict-rs.nix;
   pingvin-share = runTest ./pingvin-share.nix;
   pinnwand = runTest ./pinnwand.nix;
+  pihole-ftl = import ./pihole-ftl { inherit runTest; };
   plantuml-server = runTest ./plantuml-server.nix;
   plasma6 = runTest ./plasma6.nix;
   plausible = runTest ./plausible.nix;
diff --git a/nixos/tests/pihole-ftl/basic.nix b/nixos/tests/pihole-ftl/basic.nix
new file mode 100644
index 000000000000..2d1a867b0938
--- /dev/null
+++ b/nixos/tests/pihole-ftl/basic.nix
@@ -0,0 +1,47 @@
+# A basic test with no webserver, no API, just checking DNS functionality
+{
+  lib,
+  pkgs,
+  ...
+}:
+
+rec {
+  name = "pihole-ftl-basic";
+  meta.maintainers = with lib.maintainers; [ averyvigolo ];
+
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      services.pihole-ftl = {
+        enable = true;
+        openFirewallDNS = true;
+      };
+      environment.systemPackages = with pkgs; [ dig ];
+    };
+
+  nodes.client =
+    { pkgs, lib, ... }:
+    {
+      environment.systemPackages = with pkgs; [ dig ];
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      machine.wait_for_unit("pihole-ftl.service")
+      machine.wait_for_open_port(53)
+      client.wait_for_unit("network.target")
+
+      with subtest("the pi-hole machine resolves properly"):
+        ret, out = machine.execute("dig @localhost +short pi.hole")
+        assert ret == 0, "pi.hole should resolve on the local machine"
+        assert out.rstrip() == "127.0.0.1", "pi.hole should resolve to localhost on the local machine"
+
+      machine_address = "${(builtins.head nodes.machine.networking.interfaces.eth1.ipv4.addresses).address}"
+
+      with subtest("a client machine resolves properly"):
+        ret, out = client.execute(f"dig @{machine_address} +short pi.hole")
+        assert ret == 0, "pi.hole should resolve on a client machine"
+        assert out.rstrip() == machine_address, "pi.hole should resolve to the machine's address"
+    '';
+}
diff --git a/nixos/tests/pihole-ftl/default.nix b/nixos/tests/pihole-ftl/default.nix
new file mode 100644
index 000000000000..71c971174dca
--- /dev/null
+++ b/nixos/tests/pihole-ftl/default.nix
@@ -0,0 +1,5 @@
+{ runTest }:
+
+{
+  basic = runTest ./basic.nix;
+}