diff --git a/deployments/dns/bind.yaml b/deployments/dns/bind.yaml
index 8724eba..defa798 100644
--- a/deployments/dns/bind.yaml
+++ b/deployments/dns/bind.yaml
@@ -15,6 +15,8 @@ data:
       10.42.0.0/16;
     };
 
+    include "/etc/bind/externaldns-key.conf";
+
     options {
         directory "/var/cache/bind";
 
@@ -31,7 +33,6 @@ data:
         allow-transfer { "slaves"; };
 
         dnssec-validation auto;
-        include "/etc/bind/externaldns-key.conf";
     };
 
     zone "." IN {