diff --git a/apps/base/bind-internal/authoritative/acls.yaml b/apps/base/bind-internal/authoritative/acls.yaml
new file mode 100644
index 0000000..d042b2a
--- /dev/null
+++ b/apps/base/bind-internal/authoritative/acls.yaml
@@ -0,0 +1,26 @@
+---
+# Internal client networks allowed to query the authoritative servers,
+# mirrored from the puppet authoritative /etc/named/acls.conf
+# (acl-main.unkin.net). Named auth-acl-main because the resolver has its own,
+# differently-scoped acl-main.unkin.net in the same namespace.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindACL
+metadata:
+  name: auth-acl-main
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  entries:
+    - 198.18.13.0/24
+    - 198.18.14.0/24
+    - 198.18.15.0/24
+    - 198.18.16.0/24
+    - 198.18.17.0/24
+    - 198.18.19.0/24
+    - 198.18.20.0/24
+    - 198.18.24.0/24
+    - 198.18.25.0/24
+    - 198.18.26.0/24
+    - 198.18.27.0/24
+    - 198.18.28.0/24
+    - 198.18.29.0/24
diff --git a/apps/base/bind-internal/authoritative/cluster.yaml b/apps/base/bind-internal/authoritative/cluster.yaml
index 13307d3..ea08a66 100644
--- a/apps/base/bind-internal/authoritative/cluster.yaml
+++ b/apps/base/bind-internal/authoritative/cluster.yaml
@@ -11,6 +11,11 @@ spec:
   replicas: 3
   storageClassName: cephrbd-fast-delete
   storageSize: 2Gi
+  # Restrict queries to internal networks (puppet acl-main.unkin.net).
+  # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh
+  # from the primary during catalog replication.
+  extraOptions:
+    - "allow-query { auth-acl-main; 10.42.0.0/16; }"
   service:
     type: LoadBalancer
     annotations:
diff --git a/apps/base/bind-internal/authoritative/kustomization.yaml b/apps/base/bind-internal/authoritative/kustomization.yaml
index d69be1f..2116a01 100644
--- a/apps/base/bind-internal/authoritative/kustomization.yaml
+++ b/apps/base/bind-internal/authoritative/kustomization.yaml
@@ -6,3 +6,4 @@ resources:
   - cluster.yaml
   - tsigkey.yaml
   - zones.yaml
+  - acls.yaml