diff --git a/apps/base/bind-internal/externaldns/tsigkey.yaml b/apps/base/bind-internal/externaldns/tsigkey.yaml
index 33ec5ce..1913a9d 100644
--- a/apps/base/bind-internal/externaldns/tsigkey.yaml
+++ b/apps/base/bind-internal/externaldns/tsigkey.yaml
@@ -1,6 +1,10 @@
 ---
 # Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
-# updates to the primary. The operator generates the material into a Secret.
+# updates to the primary. The operator generates the material into a Secret
+# (externaldns-key-tsig) in this namespace. secretTemplate stamps emberstack
+# reflector hints onto that Secret so it is mirrored into the externaldns
+# namespace, where the external-dns controller reads it -- guaranteeing
+# external-dns presents exactly the key the primary's allow-update accepts.
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindTSIGKey
 metadata:
@@ -9,3 +13,9 @@ metadata:
 spec:
   clusterRef: bind-externaldns
   algorithm: hmac-sha256
+  secretTemplate:
+    annotations:
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "externaldns"
+      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "externaldns"
diff --git a/schemas/bind.unkin.net/bindtsigkey_v1alpha1.json b/schemas/bind.unkin.net/bindtsigkey_v1alpha1.json
index 2b3ae33..affd4fd 100644
--- a/schemas/bind.unkin.net/bindtsigkey_v1alpha1.json
+++ b/schemas/bind.unkin.net/bindtsigkey_v1alpha1.json
@@ -35,6 +35,23 @@
         },
         "secretName": {
           "type": "string"
+        },
+        "secretTemplate": {
+          "properties": {
+            "annotations": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            "labels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
         }
       },
       "type": "object"