diff --git a/.forgejo/workflows/prerelease.yml b/.forgejo/workflows/prerelease.yml
index 8b2fe2d..f20ca66 100644
--- a/.forgejo/workflows/prerelease.yml
+++ b/.forgejo/workflows/prerelease.yml
@@ -38,7 +38,6 @@ jobs:
           - metacli
           - agent
           - vpc
-          - dhcp
     uses: ./.forgejo/workflows/build.yml
     with:
       tag: ${{ needs.set-release-target.outputs.release_cible }}
@@ -52,4 +51,4 @@ jobs:
     uses: ./.forgejo/workflows/release.yml
     with:
       tag: ${{ needs.set-release-target.outputs.release_cible }}
-    secrets: inherit
+    secrets: inherit
\ No newline at end of file
diff --git a/cmd/dhcp/main.go b/cmd/dhcp/main.go
deleted file mode 100644
index b2ce08d..0000000
--- a/cmd/dhcp/main.go
+++ /dev/null
@@ -1,64 +0,0 @@
-package main
-
-import (
-	"flag"
-	"fmt"
-	"net"
-	"os"
-
-	"git.g3e.fr/syonad/two/internal/dhcp"
-	"git.g3e.fr/syonad/two/pkg/systemd"
-)
-
-func main() {
-	subnet := flag.String("subnet", "", "Subnet CIDR (e.g. 10.10.10.0/24)")
-	name := flag.String("name", "", "Config name (e.g. vpc1_br-00002)")
-	gateway := flag.String("gateway", "", "Gateway IP (e.g. 10.10.10.1)")
-	confDir := flag.String("confdir", "/etc/dnsmasq.d", "dnsmasq config directory")
-	flag.Parse()
-
-	if *subnet == "" || *name == "" || *gateway == "" {
-		flag.Usage()
-		os.Exit(1)
-	}
-
-	_, network, err := net.ParseCIDR(*subnet)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "invalid subnet: %v\n", err)
-		os.Exit(1)
-	}
-
-	gw := net.ParseIP(*gateway)
-	if gw == nil {
-		fmt.Fprintf(os.Stderr, "invalid gateway IP: %q\n", *gateway)
-		os.Exit(1)
-	}
-
-	conf := dhcp.Config{
-		Network: network,
-		Gateway: gw,
-		Name:    *name,
-		ConfDir: *confDir,
-	}
-
-	confPath, err := dhcp.GenerateConfig(conf)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "error generating config: %v\n", err)
-		os.Exit(1)
-	}
-	fmt.Printf("dnsmasq config written to %s\n", confPath)
-
-	svc, err := systemd.New()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "error connecting to systemd: %v\n", err)
-		os.Exit(1)
-	}
-	defer svc.Close()
-
-	unit := "dnsmasq@" + *name + ".service"
-	if err := svc.Start(unit); err != nil {
-		fmt.Fprintf(os.Stderr, "error starting %s: %v\n", unit, err)
-		os.Exit(1)
-	}
-	fmt.Printf("started %s\n", unit)
-}
diff --git a/internal/dhcp/generate.go b/internal/dhcp/generate.go
deleted file mode 100644
index 01bfe20..0000000
--- a/internal/dhcp/generate.go
+++ /dev/null
@@ -1,47 +0,0 @@
-package dhcp
-
-import (
-	"fmt"
-	"net"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-func GenerateConfig(c Config) (string, error) {
-	mask := fmt.Sprintf("%d.%d.%d.%d", c.Network.Mask[0], c.Network.Mask[1], c.Network.Mask[2], c.Network.Mask[3])
-
-	var sb strings.Builder
-	fmt.Fprintf(&sb, "no-resolv\n")
-	fmt.Fprintf(&sb, "dhcp-range=%s,static,%s,12h\n", c.Network.IP.String(), mask)
-	fmt.Fprintf(&sb, "dhcp-option=3,%s\n", c.Gateway.String())
-	fmt.Fprintf(&sb, "dhcp-option=6,1.1.1.1,8.8.8.8\n\n")
-
-	i := 0
-	for ip := cloneIP(c.Network.IP); c.Network.Contains(ip); incrementIP(ip) {
-		fmt.Fprintf(&sb, "dhcp-host=00:22:33:%02X:%02X:%02X,%s\n",
-			(i>>16)&0xFF, (i>>8)&0xFF, i&0xFF, ip)
-		i++
-	}
-
-	outPath := filepath.Join(c.ConfDir, c.Name+".conf")
-	if err := os.MkdirAll(c.ConfDir, 0755); err != nil {
-		return "", err
-	}
-	return outPath, os.WriteFile(outPath, []byte(sb.String()), 0644)
-}
-
-func incrementIP(ip net.IP) {
-	for j := len(ip) - 1; j >= 0; j-- {
-		ip[j]++
-		if ip[j] != 0 {
-			break
-		}
-	}
-}
-
-func cloneIP(ip net.IP) net.IP {
-	clone := make(net.IP, len(ip))
-	copy(clone, ip)
-	return clone
-}
diff --git a/internal/dhcp/struct.go b/internal/dhcp/struct.go
deleted file mode 100644
index 4c69b9c..0000000
--- a/internal/dhcp/struct.go
+++ /dev/null
@@ -1,12 +0,0 @@
-package dhcp
-
-import (
-	"net"
-)
-
-type Config struct {
-	Network *net.IPNet
-	Gateway net.IP
-	Name    string
-	ConfDir string
-}
diff --git a/scripts/run-dnsmasq-in-netns.sh b/scripts/run-dnsmasq-in-netns.sh
deleted file mode 100644
index c0f9253..0000000
--- a/scripts/run-dnsmasq-in-netns.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/bash
-set -e
-
-# Expects one argument: netns_bridge (e.g. vpc-00003_br-00002 or vpc1_br0)
-arg="$1"
-NETNS="${arg%%_*}"
-BRIDGE="${arg#*_}"
-
-echo "start dnsmasq ${NETNS} ${BRIDGE}"
-
-exec ip netns exec "${NETNS}" \
-  dnsmasq \
-    --no-daemon \
-    --interface="${BRIDGE}" \
-    --bind-interfaces \
-    --pid-file="/run/dnsmasq-$arg.pid" \
-    --conf-file="/etc/dnsmasq.d/$arg.conf" \
-    --no-hosts \
-    --no-resolv \
-    --log-facility="/var/log/dnsmasq-$arg.log" \
-    --no-daemon -p0
diff --git a/systemd/dnsmasq@.service b/systemd/dnsmasq@.service
deleted file mode 100644
index 8d5e732..0000000
--- a/systemd/dnsmasq@.service
+++ /dev/null
@@ -1,11 +0,0 @@
-[Unit]
-Description=dnsmasq in netns %i
-After=network.target
-
-[Service]
-Type=simple
-ExecStart=/usr/local/bin/run-dnsmasq-in-netns.sh %i
-ExecStopPost=/bin/rm -f /run/dnsmasq-%i.pid
-
-[Install]
-WantedBy=multi-user.target