diff --git a/infrastructure/coredns/manifests/coredns-configmap.yaml b/infrastructure/coredns/manifests/coredns-configmap.yaml
index a3dd028..186f0e7 100644
--- a/infrastructure/coredns/manifests/coredns-configmap.yaml
+++ b/infrastructure/coredns/manifests/coredns-configmap.yaml
@@ -44,12 +44,19 @@ data:
         # Multi-site active failover pilot (see
         # /home/scooby/.claude/plans/jiggly-snacking-iverson.md): home's
         # own pods resolving the floating pg-authentik.ha.huskypup.net
-        # record always go straight to the local CNPG -rw service instead
-        # of round-tripping out through the UniFi WAN port-forward and
-        # back in - this UniFi doesn't support NAT hairpin/loopback for
-        # its own forwarded ports (confirmed live 2026-08-20: DNS
-        # resolved fine, TCP connect failed).
-        rewrite name pg-authentik.ha.huskypup.net pg-authentik-rw.authentik.svc.cluster.local
+        # record always go straight to a local service instead of
+        # round-tripping out through the UniFi WAN port-forward and back
+        # in - this UniFi doesn't support NAT hairpin/loopback for its
+        # own forwarded ports (confirmed live 2026-08-20: DNS resolved
+        # fine, TCP connect failed). Points at ha-authentik-postgres, NOT
+        # CNPG's own pg-authentik-rw directly - rewrite only changes the
+        # resolved name, not the port a client then connects to, and the
+        # app tier is configured for port 61432 (matching the external
+        # floating hostname) - pg-authentik-rw only listens on 5432,
+        # ha-authentik-postgres additionally listens on 61432 (see
+        # infrastructure/authentik/manifests/ha-postgres-nodeport.yaml)
+        # specifically so this rewrite target actually has that port.
+        rewrite name pg-authentik.ha.huskypup.net ha-authentik-postgres.authentik.svc.cluster.local
 
         kubernetes cluster.local in-addr.arpa ip6.arpa {
             pods insecure