diff --git a/apps/base/bind-internal/resolvers/forward-zones.yaml b/apps/base/bind-internal/resolvers/forward-zones.yaml
index 6c23c1b..3572960 100644
--- a/apps/base/bind-internal/resolvers/forward-zones.yaml
+++ b/apps/base/bind-internal/resolvers/forward-zones.yaml
@@ -1,5 +1,6 @@
 # Conditional forward zones, from the puppet openforwarder view.
-# Upstreams: unkin authoritative 198.18.19.15, consul 198.18.19.14, k8s 198.18.19.20.
+# Upstreams: unkin authoritative 198.18.19.15, consul 198.18.19.14, k8s 198.18.200.8.
+# k8s -> in-cluster bind-externaldns 198.18.200.8.
 # (Zones that forwarded to 10.10.16.x were dropped; consul left as-is.)
 ---
 apiVersion: bind.unkin.net/v1alpha1
@@ -56,7 +57,7 @@ spec:
   type: forward
   catalog: false
   forwarders:
-    - 198.18.19.20
+    - 198.18.200.8
 ---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone