diff --git a/apps/base/bind-internal/resolvers/cluster.yaml b/apps/base/bind-internal/resolvers/cluster.yaml
index 2fc2888..161a7bd 100644
--- a/apps/base/bind-internal/resolvers/cluster.yaml
+++ b/apps/base/bind-internal/resolvers/cluster.yaml
@@ -29,7 +29,7 @@ spec:
   # insecure so they are not validated. unkin.net covers all *.unkin.net
   # (incl. k8s.syd1.au.unkin.net); 18.198.in-addr.arpa covers every reverse zone.
   extraOptions:
-    - "validate-except { unkin.net; 18.198.in-addr.arpa; consul }"
+    - "validate-except { unkin.net; 18.198.in-addr.arpa; consul; }"
   resources:
     requests:
       cpu: 20m