diff --git a/apps/base/bind-internal/authoritative/records.yaml b/apps/base/bind-internal/authoritative/records.yaml
index d4bb741..32e1cfa 100644
--- a/apps/base/bind-internal/authoritative/records.yaml
+++ b/apps/base/bind-internal/authoritative/records.yaml
@@ -19,3 +19,18 @@ spec:
     # traefik-internal gateway VIP; the authentik Gateway serves the
     # identity.unkin.net hostname there.
     - 198.18.200.4
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: s3-ceph-cname
+  namespace: bind-internal
+spec:
+  zoneRef: ceph-unkin-net
+  name: s3
+  type: CNAME
+  ttl: 600
+  values:
+    # radosgw S3 endpoint. Points at the Consul service for now; the real
+    # target will be changed later.
+    - radosgw.service.consul.