diff --git a/README.md b/README.md
index 9cd5155..8dd5fe4 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,7 @@ script picks one based on the pod ordinal.
 
 | Kind | Purpose |
 |------|---------|
-| `BindCluster` | A set of BIND9 servers. `spec.mode`: `authoritative`, `resolver`, or `dynamic`. |
+| `BindCluster` | A set of BIND9 servers. `spec.mode`: `authoritative` or `resolver`. |
 | `BindZone` | A forward/reverse zone (`primary`/`secondary`/`forward`/`stub`), records inline, optional dynamic-update + DNSSEC + catalog membership. |
 | `DNSRecord` | A single record set applied via TSIG `nsupdate` — external-dns as a CRD. |
 | `BindView` | A split-horizon view (`match-clients`, ordering, per-view recursion). |
@@ -58,7 +58,7 @@ The three Puppet-managed BIND roles map onto three `BindCluster`s:
 |-------------|---------------|------|
 | 3× authoritative masters | `auth` | `authoritative` (pod-0 primary, 2 secondaries) |
 | 3× only-resolvers | `resolver` | `resolver` (3 identical recursive servers) |
-| 3× external-dns | `externaldns` | `dynamic` (RFC2136 TSIG updates on primary) |
+| 3× external-dns | `externaldns` | `authoritative` (zones set `dynamicUpdate` for RFC2136 TSIG updates) |
 
 ## Development
 
diff --git a/api/v1alpha1/bindcluster_types.go b/api/v1alpha1/bindcluster_types.go
index e6fc166..b224d51 100644
--- a/api/v1alpha1/bindcluster_types.go
+++ b/api/v1alpha1/bindcluster_types.go
@@ -7,20 +7,19 @@ import (
 
 // BindMode selects the behaviour of a BindCluster and maps onto a classic
 // BIND deployment role.
-//   - authoritative: serves signed/unsigned authoritative zones. Ordinal-0 is
-//     the primary that holds zone data; the remaining pods are secondaries that
-//     replicate via AXFR/IXFR + NOTIFY (optionally driven by a catalog zone).
+//   - authoritative: serves authoritative zones. Ordinal-0 is the primary that
+//     holds zone data; the remaining pods are secondaries that replicate via
+//     AXFR/IXFR + NOTIFY (optionally driven by a catalog zone). Zones that set
+//     spec.dynamicUpdate accept RFC2136 TSIG updates (the external-dns pattern),
+//     so no separate mode is needed for external-dns servers.
 //   - resolver: N identical recursive resolvers, no zone replication.
-//   - dynamic: like authoritative, but the primary accepts RFC2136 TSIG updates
-//     (the external-dns pattern); secondaries replicate the result.
 //
-// +kubebuilder:validation:Enum=authoritative;resolver;dynamic
+// +kubebuilder:validation:Enum=authoritative;resolver
 type BindMode string
 
 const (
 	ModeAuthoritative BindMode = "authoritative"
 	ModeResolver      BindMode = "resolver"
-	ModeDynamic       BindMode = "dynamic"
 )
 
 // ClusterServiceSpec controls how the cluster is exposed to clients.
diff --git a/config/crd/bases/bind.unkin.net_bindclusters.yaml b/config/crd/bases/bind.unkin.net_bindclusters.yaml
index 4485e70..c7d596e 100644
--- a/config/crd/bases/bind.unkin.net_bindclusters.yaml
+++ b/config/crd/bases/bind.unkin.net_bindclusters.yaml
@@ -1007,7 +1007,6 @@ spec:
                 enum:
                 - authoritative
                 - resolver
-                - dynamic
                 type: string
               nodeSelector:
                 additionalProperties:
diff --git a/config/samples/03-external-dns.yaml b/config/samples/03-external-dns.yaml
index 990acc5..ca467e7 100644
--- a/config/samples/03-external-dns.yaml
+++ b/config/samples/03-external-dns.yaml
@@ -1,13 +1,14 @@
 ---
-# external-dns role (replaces 3x Puppet external-dns servers). The primary
-# accepts RFC2136 TSIG updates from external-dns; secondaries replicate.
+# external-dns role (replaces 3x Puppet external-dns servers). This is an
+# ordinary authoritative cluster; external-dns writes to the zone below via
+# RFC2136 because the zone sets dynamicUpdate (allow-update { key ... }).
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindCluster
 metadata:
   name: externaldns
   namespace: bind-externaldns
 spec:
-  mode: dynamic
+  mode: authoritative
   replicas: 3
   service:
     type: LoadBalancer