vpn on, leak test still showed cloudflare. turned out to be chrome

Was on public wifi with the laptop yesterday, VPN connected, ran a DNS leak test out of habit and it came back with Cloudflare servers instead of the VPN's. Spent way too long blaming the VPN before I found it: Chrome's secure DNS was set to Cloudflare, so the browser was doing its own lookups and skipping whatever the VPN had set up.

Went through a few providers' docs after that and they all handle DNS a bit differently. PIA gives you something like five DNS options in the app, including a local resolver, but "use existing DNS" sits right there in the same list and seems easy to pick without thinking. proton lets you set custom dns on pretty much every platform, but only on paid plans, and turning it on switches off their netshield blocker. x-vpn sends dns through its own private dns servers and their help page actually calls out the browser setting, though the fix they give is just setting chrome back to your current provider, which feels a bit backwards if you turned secure dns on on purpose.

so what do you all do on laptops, leave browser secure dns off whenever the vpn's on, or point it somewhere that plays nice with the vpn? and is there a setup that doesn't quietly break every time you switch networks