diff --git a/apps/base/bind-internal/authoritative/acls.yaml b/apps/base/bind-internal/authoritative/acls.yaml
index d042b2a..009884f 100644
--- a/apps/base/bind-internal/authoritative/acls.yaml
+++ b/apps/base/bind-internal/authoritative/acls.yaml
@@ -24,3 +24,6 @@ spec:
     - 198.18.27.0/24
     - 198.18.28.0/24
     - 198.18.29.0/24
+    # Admin/management access (individual hosts, not whole subnets)
+    - 10.10.12.200/32   # benvin workstation (wireguard)
+    - 198.18.21.160/32  # benvin router