diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3fc0cd68..d23f99bf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,9 @@ NOTE: Add new changes BELOW THIS COMMENT.
 
 ### Added
 
+- The ability to make bootstrap DNS lookups prefer IPv6 addresses to IPv4 ones
+  using the new `dns.bootstrap_prefer_ipv6` configuration file property
+  ([#4262]).
 - Docker container's healthcheck ([#3290]).
 - The new HTTP API `POST /control/protection`, that updates protection state
   and adds an optional pause duration ([#1333]).  The format of request body
@@ -137,6 +140,7 @@ In this release, the schema version has changed from 17 to 20.
 [#1472]: https://github.com/AdguardTeam/AdGuardHome/issues/1472
 [#3290]: https://github.com/AdguardTeam/AdGuardHome/issues/3290
 [#3459]: https://github.com/AdguardTeam/AdGuardHome/issues/3459
+[#4262]: https://github.com/AdguardTeam/AdGuardHome/issues/4262
 [#5567]: https://github.com/AdguardTeam/AdGuardHome/issues/5567
 [#5584]: https://github.com/AdguardTeam/AdGuardHome/issues/5584
 [#5631]: https://github.com/AdguardTeam/AdGuardHome/issues/5631
diff --git a/go.mod b/go.mod
index d2b9dc5b..067f1ba1 100644
--- a/go.mod
+++ b/go.mod
@@ -3,8 +3,7 @@ module github.com/AdguardTeam/AdGuardHome
 go 1.19
 
 require (
-	// TODO(a.garipov): Use v0.48.0 when it's released.
-	github.com/AdguardTeam/dnsproxy v0.48.2
+	github.com/AdguardTeam/dnsproxy v0.48.3
 	github.com/AdguardTeam/golibs v0.13.0
 	github.com/AdguardTeam/urlfilter v0.16.1
 	github.com/NYTimes/gziphandler v1.1.1
diff --git a/go.sum b/go.sum
index df72582e..89828f63 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-github.com/AdguardTeam/dnsproxy v0.48.2 h1:zEWeImyJGPeQAZ7+F/sgOJ2WbCRN1zbINLsDAEnFWjI=
-github.com/AdguardTeam/dnsproxy v0.48.2/go.mod h1:Y7g7jRTd/u7+KJ/QvnGI2PCE8vnisp6EsW47/Sz0DZw=
+github.com/AdguardTeam/dnsproxy v0.48.3 h1:h9xgDSmd1MqsPFNApyaPVXolmSTtzOWOcfWvPeDEP6s=
+github.com/AdguardTeam/dnsproxy v0.48.3/go.mod h1:Y7g7jRTd/u7+KJ/QvnGI2PCE8vnisp6EsW47/Sz0DZw=
 github.com/AdguardTeam/golibs v0.4.0/go.mod h1:skKsDKIBB7kkFflLJBpfGX+G8QFTx0WKUzB6TIgtUj4=
 github.com/AdguardTeam/golibs v0.10.4/go.mod h1:rSfQRGHIdgfxriDDNgNJ7HmE5zRoURq8R+VdR81Zuzw=
 github.com/AdguardTeam/golibs v0.13.0 h1:hVBeNQXT/BgcjKz/4FMpFGvEYqXiXDJG+b5XpGCUOLk=
diff --git a/internal/dnsforward/config.go b/internal/dnsforward/config.go
index 0203ca42..165ed33b 100644
--- a/internal/dnsforward/config.go
+++ b/internal/dnsforward/config.go
@@ -199,6 +199,10 @@ type FilteringConfig struct {
 	// IpsetListFileName, if set, points to the file with ipset configuration.
 	// The format is the same as in [IpsetList].
 	IpsetListFileName string `yaml:"ipset_file"`
+
+	// BootstrapPreferIPv6, if true, instructs the bootstrapper to prefer IPv6
+	// addresses to IPv4 ones for DoH, DoQ, and DoT.
+	BootstrapPreferIPv6 bool `yaml:"bootstrap_prefer_ipv6"`
 }
 
 // EDNSClientSubnet is the settings list for EDNS Client Subnet.
@@ -479,6 +483,7 @@ func (s *Server) prepareUpstreamSettings() error {
 			Bootstrap:    s.conf.BootstrapDNS,
 			Timeout:      s.conf.UpstreamTimeout,
 			HTTPVersions: httpVersions,
+			PreferIPv6:   s.conf.BootstrapPreferIPv6,
 		},
 	)
 	if err != nil {
@@ -494,6 +499,7 @@ func (s *Server) prepareUpstreamSettings() error {
 				Bootstrap:    s.conf.BootstrapDNS,
 				Timeout:      s.conf.UpstreamTimeout,
 				HTTPVersions: httpVersions,
+				PreferIPv6:   s.conf.BootstrapPreferIPv6,
 			},
 		)
 		if err != nil {
diff --git a/internal/dnsforward/dnsforward.go b/internal/dnsforward/dnsforward.go
index ffec33f2..89cc1539 100644
--- a/internal/dnsforward/dnsforward.go
+++ b/internal/dnsforward/dnsforward.go
@@ -447,6 +447,8 @@ func (s *Server) setupResolvers(localAddrs []string) (err error) {
 			Bootstrap: bootstraps,
 			Timeout:   defaultLocalTimeout,
 			// TODO(e.burkov): Should we verify server's certificates?
+
+			PreferIPv6: s.conf.BootstrapPreferIPv6,
 		},
 	)
 	if err != nil {
diff --git a/internal/dnsforward/http.go b/internal/dnsforward/http.go
index c8def88e..d7e238b4 100644
--- a/internal/dnsforward/http.go
+++ b/internal/dnsforward/http.go
@@ -645,6 +645,7 @@ func (err domainSpecificTestError) Error() (msg string) {
 func checkDNS(
 	upstreamConfigStr string,
 	bootstrap []string,
+	bootstrapPrefIPv6 bool,
 	timeout time.Duration,
 	healthCheck healthCheckFunc,
 ) (err error) {
@@ -672,8 +673,9 @@ func checkDNS(
 	log.Debug("dnsforward: checking if upstream %q works", upstreamAddr)
 
 	u, err := upstream.AddressToUpstream(upstreamAddr, &upstream.Options{
-		Bootstrap: bootstrap,
-		Timeout:   timeout,
+		Bootstrap:  bootstrap,
+		Timeout:    timeout,
+		PreferIPv6: bootstrapPrefIPv6,
 	})
 	if err != nil {
 		return fmt.Errorf("failed to choose upstream for %q: %w", upstreamAddr, err)
@@ -705,6 +707,7 @@ func (s *Server) handleTestUpstreamDNS(w http.ResponseWriter, r *http.Request) {
 
 	result := map[string]string{}
 	bootstraps := req.BootstrapDNS
+	bootstrapPrefIPv6 := s.conf.BootstrapPreferIPv6
 	timeout := s.conf.UpstreamTimeout
 
 	type upsCheckResult = struct {
@@ -721,7 +724,7 @@ func (s *Server) handleTestUpstreamDNS(w http.ResponseWriter, r *http.Request) {
 		}
 		defer func() { resCh <- res }()
 
-		checkErr := checkDNS(ups, bootstraps, timeout, healthCheck)
+		checkErr := checkDNS(ups, bootstraps, bootstrapPrefIPv6, timeout, healthCheck)
 		if checkErr != nil {
 			res.res = checkErr.Error()
 		} else {
diff --git a/internal/home/clients.go b/internal/home/clients.go
index 48b95baf..9453b951 100644
--- a/internal/home/clients.go
+++ b/internal/home/clients.go
@@ -408,6 +408,7 @@ func (clients *clientsContainer) findUpstreams(
 			Bootstrap:    config.DNS.BootstrapDNS,
 			Timeout:      config.DNS.UpstreamTimeout.Duration,
 			HTTPVersions: dnsforward.UpstreamHTTPVersions(config.DNS.UseHTTP3Upstreams),
+			PreferIPv6:   config.DNS.BootstrapPreferIPv6,
 		},
 	)
 	if err != nil {