# chflags schg /etc/resolv.confJust keep in mind you have to go to single user mode to undo the above.
That's an interesting workaround I hadn't considered. The problem is that this setting must be deployed via an Ansible playbook, so single user mode is out.