diff --git a/apps/overlays/au-syd1/externaldns/values.yaml b/apps/overlays/au-syd1/externaldns/values.yaml
index 7205050..3bc5e48 100644
--- a/apps/overlays/au-syd1/externaldns/values.yaml
+++ b/apps/overlays/au-syd1/externaldns/values.yaml
@@ -27,24 +27,22 @@ sources:
   - gateway-httproute
   - gateway-grpcroute
 
-# TSIG secret + algorithm. The bind operator generates this key in
-# bind-internal (BindTSIGKey externaldns-key) and the emberstack reflector
-# mirrors the Secret into this namespace as externaldns-key-tsig.
+# Environment variables for TSIG secret and algorithm from Vault
 env:
   - name: EXTERNAL_DNS_RFC2136_TSIG_SECRET
     valueFrom:
       secretKeyRef:
-        name: externaldns-key-tsig
+        name: externaldns-tsig
         key: secret
   - name: EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM
     valueFrom:
       secretKeyRef:
-        name: externaldns-key-tsig
+        name: externaldns-tsig
         key: algorithm
 
 # RFC2136 configuration as arguments
 extraArgs:
-  - --rfc2136-host=bind-externaldns-primary.bind-internal.svc.cluster.local
+  - --rfc2136-host=ausyd1nxvm2127.main.unkin.net
   - --rfc2136-port=53
   - --rfc2136-zone=k8s.syd1.au.unkin.net
   - --rfc2136-zone=200.18.198.in-addr.arpa