diff --git a/modules/services/networking/dhclient.nix b/modules/services/networking/dhclient.nix
index 38454d421b12..5d82854fef50 100644
--- a/modules/services/networking/dhclient.nix
+++ b/modules/services/networking/dhclient.nix
@@ -20,8 +20,6 @@ let
       #echo "$exit_status" >> /tmp/dhcp-exit
 
       if test "$reason" = BOUND -o "$reason" = REBOOT; then
-          ${pkgs.glibc}/sbin/nscd --invalidate hosts
-
           # Restart ntpd.  (The "ip-up" event below will trigger the
           # restart.)  We need to restart it to make sure that it will
           # actually do something: if ntpd cannot resolve the server
diff --git a/modules/services/system/nscd.nix b/modules/services/system/nscd.nix
index 22d6e38a74b4..3f6ef510f5cd 100644
--- a/modules/services/system/nscd.nix
+++ b/modules/services/system/nscd.nix
@@ -57,5 +57,15 @@ in
         exec = "nscd -f ${./nscd.conf} -d 2> /dev/null";
       };
 
+    # Flush nscd's ‘hosts’ database when the network comes up to get
+    # rid of any negative entries.
+    jobs.invalidate_nscd =
+      { name = "invalidate-nscd";
+        description = "Invalidate NSCD cache";
+        startOn = "ip-up";
+        task = true;
+        exec = "${pkgs.glibc}/sbin/nscd --invalidate hosts";
+      };
+
   };
 }