diff --git a/apps/base/bind-external/zones.yaml b/apps/base/bind-external/zones.yaml
index 05ece86..d252a60 100644
--- a/apps/base/bind-external/zones.yaml
+++ b/apps/base/bind-external/zones.yaml
@@ -17,3 +17,14 @@ spec:
   updateKeyRef: certmanager
   allowTransfer:
     - key certmanager
+  # Published apex NS. acme-ns1 is what the parent delegates to and glues; ns1 is
+  # in-zone, so its address is declared below or a reseed would glue it to the
+  # primary pod IP.
+  nameservers:
+    - acme-ns1.unkin.net.
+    - ns1.acme.unkin.net.
+  records:
+    - name: ns1
+      type: A
+      ttl: 3600
+      values: ["103.216.191.185"]