diff --git a/apps/base/bind-internal/authoritative/records.yaml b/apps/base/bind-internal/authoritative/records.yaml
index 32e1cfa..6ef0599 100644
--- a/apps/base/bind-internal/authoritative/records.yaml
+++ b/apps/base/bind-internal/authoritative/records.yaml
@@ -34,3 +34,31 @@ spec:
     # radosgw S3 endpoint. Points at the Consul service for now; the real
     # target will be changed later.
     - radosgw.service.consul.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: dashboard-ceph-cname
+  namespace: bind-internal
+spec:
+  zoneRef: ceph-unkin-net
+  name: dashboard
+  type: CNAME
+  ttl: 600
+  values:
+    # Ceph mgr dashboard, reached via lb1. Lets in-cluster clients (the
+    # cephrgw-operator) resolve dashboard.ceph.unkin.net.
+    - lb1.unkin.net.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: lb1-unkin-net
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: lb1
+  type: A
+  ttl: 600
+  values:
+    - 103.216.191.185