diff --git a/apps/base/bind-internal/authoritative/cluster.yaml b/apps/base/bind-internal/authoritative/cluster.yaml
index 3096cbd..de2a627 100644
--- a/apps/base/bind-internal/authoritative/cluster.yaml
+++ b/apps/base/bind-internal/authoritative/cluster.yaml
@@ -13,9 +13,11 @@ spec:
   storageSize: 2Gi
   # Restrict queries to internal networks (puppet acl-main.unkin.net).
   # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh
-  # from the primary during catalog replication.
+  # from the primary during catalog replication. localhost is required so the
+  # operator's in-pod `nsupdate` (sent to 127.0.0.1) passes query-authorization;
+  # without it every dynamic update is "denied due to allow-query".
   extraOptions:
-    - "allow-query { auth-acl-main; 10.42.0.0/16; }"
+    - "allow-query { localhost; auth-acl-main; 10.42.0.0/16; }"
   service:
     type: LoadBalancer
     externalTrafficPolicy: Local