diff --git a/apps/base/bind-internal/authoritative/kustomization.yaml b/apps/base/bind-internal/authoritative/kustomization.yaml
index 2116a01..2e56dd4 100644
--- a/apps/base/bind-internal/authoritative/kustomization.yaml
+++ b/apps/base/bind-internal/authoritative/kustomization.yaml
@@ -6,4 +6,5 @@ resources:
   - cluster.yaml
   - tsigkey.yaml
   - zones.yaml
+  - records.yaml
   - acls.yaml
diff --git a/apps/base/bind-internal/authoritative/records.yaml b/apps/base/bind-internal/authoritative/records.yaml
new file mode 100644
index 0000000..d4bb741
--- /dev/null
+++ b/apps/base/bind-internal/authoritative/records.yaml
@@ -0,0 +1,21 @@
+# Individually-managed authoritative records for the unkin.net zone.
+# DNSRecords must live in the same namespace as their BindZone (the operator
+# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
+# these sit alongside the zone in bind-internal, not in the app namespace.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  # "internal" in the name distinguishes this from the external DNS that
+  # Authentik will manage its own records from later.
+  name: identity-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: identity
+  type: A
+  ttl: 600
+  values:
+    # traefik-internal gateway VIP; the authentik Gateway serves the
+    # identity.unkin.net hostname there.
+    - 198.18.200.4