diff --git a/apps/base/bind-internal/resolvers/forward-zones.yaml b/apps/base/bind-internal/resolvers/forward-zones.yaml
index 5e18a34..9afb3e4 100644
--- a/apps/base/bind-internal/resolvers/forward-zones.yaml
+++ b/apps/base/bind-internal/resolvers/forward-zones.yaml
@@ -1,12 +1,9 @@
 # Conditional forward zones, from the puppet openforwarder view.
-# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.19.14.
-# k8s -> TEMPORARY: the existing external external-dns bind service anycast
-#   198.18.19.20 (puppet roles::infra::dns::externaldns, ausyd1nxvm2127 + slaves),
-#   NOT the in-cluster bind-externaldns 198.18.200.8. The external service still
-#   holds the working k8s.syd1.au.unkin.net records; the in-cluster one is not
-#   reliably serving them yet, so forwarding there returns NXDOMAIN (which
-#   currently breaks Gitea's CI webhook: it cannot resolve the k8s CI host).
-#   Revert to 198.18.200.8 once external-dns publishes to the in-cluster service.
+# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.19.14,
+#   k8s 198.18.200.8 (in-cluster bind-externaldns VIP).
+# k8s -> in-cluster bind-externaldns 198.18.200.8 for both the forward zone
+#   k8s.syd1.au.unkin.net and the reverse zone 200.18.198.in-addr.arpa, which
+#   external-dns now publishes to (see the external-dns migration PRs).
 # (Zones that forwarded to 10.10.16.x were dropped; consul left as-is.)
 ---
 apiVersion: bind.unkin.net/v1alpha1
@@ -63,10 +60,23 @@ spec:
   type: forward
   catalog: false
   forwarders:
-    # TEMPORARY: existing external external-dns bind service anycast, which
-    # currently holds the k8s.syd1.au.unkin.net records. Revert to 198.18.200.8
-    # (in-cluster bind-externaldns) once external-dns publishes there.
-    - 198.18.19.20
+    - 198.18.200.8
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-200-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 200.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    # Reverse zone for the k8s LB range, published by external-dns to the
+    # in-cluster bind-externaldns alongside k8s.syd1.au.unkin.net.
+    - 198.18.200.8
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone