diff --git a/hieradata/common.yaml b/hieradata/common.yaml
index 0b9a6fe..0524318 100644
--- a/hieradata/common.yaml
+++ b/hieradata/common.yaml
@@ -219,7 +219,13 @@ profiles::dns::master::basedir: '/var/named/sources'
 #                 profiles::dns::updater::key_secret: ENC[...]
 #               (must match the key the bind-authoritative zones allow-update
 #               with; algorithm hmac-sha256)
-profiles::dns::updater::manage_export: true
+# k8s is now authoritative: clients resolve via the k8s bind-resolvers
+# (profiles::dns::base::nameservers 198.18.200.7, since #490), which forward the
+# unkin.net/main.unkin.net/*.18.198.in-addr.arpa zones to the k8s
+# bind-authoritative cluster fed by the nsupdate path below. The legacy
+# exported-resources -> VM-master /var/named/sources files are no longer in any
+# client's resolution path, so stop exporting them. Rollback: set back to true.
+profiles::dns::updater::manage_export: false
 profiles::dns::updater::manage_nsupdate: true
 profiles::dns::updater::server: '198.18.200.9'
 profiles::dns::updater::key_name: 'client-update'