diff --git a/apps/base/bind-external/kustomization.yaml b/apps/base/bind-external/kustomization.yaml
index 1e3ed86..6d73342 100644
--- a/apps/base/bind-external/kustomization.yaml
+++ b/apps/base/bind-external/kustomization.yaml
@@ -7,4 +7,5 @@ resources:
   - cluster.yaml
   - tsigkey.yaml
   - zones.yaml
+  - records.yaml
   - agent-dns-rolebinding.yaml
diff --git a/apps/base/bind-external/records.yaml b/apps/base/bind-external/records.yaml
new file mode 100644
index 0000000..d37c45d
--- /dev/null
+++ b/apps/base/bind-external/records.yaml
@@ -0,0 +1,36 @@
+# Authoritative delegation records for acme.unkin.net. Without these the zone
+# only holds the operator's seed apex (NS ns1.acme.unkin.net glued to the
+# primary pod IP), which is unroutable off-cluster and goes stale on
+# reschedule. DNSRecords must live in the same namespace as their BindZone.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: acme-apex-ns
+  namespace: bind-external
+spec:
+  zoneRef: acme-unkin-net
+  # "@" is the zone apex.
+  name: "@"
+  type: NS
+  ttl: 3600
+  values:
+    # Matches the parent delegation in Google Cloud DNS. Out of zone, so the
+    # child needs no glue of its own.
+    - acme-ns1.unkin.net.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: acme-ns1-a
+  namespace: bind-external
+spec:
+  zoneRef: acme-unkin-net
+  name: ns1
+  type: A
+  ttl: 3600
+  values:
+    # Public address of this cluster's external BIND, same target as
+    # acme-ns1.unkin.net. Resolvers that cached the seeded ns1.acme.unkin.net
+    # NS name must still reach the zone.
+    - 103.216.191.185