diff --git a/inventories/chaosknoten/host_vars/auth-dns.sops.yaml b/inventories/chaosknoten/host_vars/auth-dns.sops.yaml
index fbf06b66..49dc4880 100644
--- a/inventories/chaosknoten/host_vars/auth-dns.sops.yaml
+++ b/inventories/chaosknoten/host_vars/auth-dns.sops.yaml
@@ -3,6 +3,9 @@ knot__keys:
   - id: ENC[AES256_GCM,data:ff7Z1SHmKVseX4hguwcfrqLKyDKu3Imw1Q==,iv:Ds5T3cvi2XYAa3C8mbgYjN8AHM4FsKR2RTPvykWgy2E=,tag:7Gveno0zsLf3bDOYgkQkbw==,type:str]
     secret: ENC[AES256_GCM,data:dJcVnqQ6hlA/xp4NQ5s9by+z9cm5oWD7KAlPX+kDsvSJn33YiZ/A/wf0jfT+FeVLaBerQ6WipxZs90rp8rD+dg==,iv:JVby6vORdqChps6cRx1EJPNBC7+M0Vgp1ji1nQtv3K4=,tag:X0KggJahlTOAowTNnpPs2g==,type:str]
     algorithm: ENC[AES256_GCM,data:r7uojDN+o1yYgaY=,iv:KBWKZbd+5qZstuMh6gseq/vC86UB/l9m4wVZpA4usPk=,tag:gfU3asmwOIgxJQsqPG712g==,type:str]
+  - id: ENC[AES256_GCM,data:Dulyfbyd0yrEX2gUm/YA,iv:VmSUtH5aryl7Vhq8TDj7anRASqNZaN77usVI+Rd8SVc=,tag:1ZJmSHHufQr1+DcnKYyY9w==,type:str]
+    secret: ENC[AES256_GCM,data:zlEdYedWmlW8mTLu+cUejyjlqLcx14Bz4D20pPa21UagtCH7GYeCldmC5sM=,iv:+TvHyfRgCscza04CtLGuRIkt30KLVRx01GKEq0Dqkvw=,tag:mX/MrOePWjJ9JwiGP6TQQw==,type:str]
+    algorithm: ENC[AES256_GCM,data:r7uojDN+o1yYgaY=,iv:KBWKZbd+5qZstuMh6gseq/vC86UB/l9m4wVZpA4usPk=,tag:gfU3asmwOIgxJQsqPG712g==,type:str]
 sops:
   age:
     - enc: |
@@ -14,8 +17,8 @@ sops:
         Hgb8MQ6i9FlhAN/P8onBsqvbh0ttBEFQ6aRJj5njKs/MMfKUk9Q25g==
         -----END AGE ENCRYPTED FILE-----
       recipient: age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve
-  lastmodified: "2026-09-11T08:40:23Z"
-  mac: ENC[AES256_GCM,data:UrncHXwMWUzs5pciDVUGJ885EBsPfrOFswzDOej2pQOTrp6+YomluHivy/L5niSYb05HaGy+9puw35+d+9SXQbgoI5WbwYo2LQ2MggMWSchnnZoy3O5S6LLjBhcvebDv4/1JGvftyBS1LnU7mmJaMekV5KASXaGyuwKumsdTojA=,iv:HJqCXtqQErP/50tR7LL2eAN574NkVO/3QfYsK1q9tt4=,tag:BniLURhadzSliPYz0cRgkA==,type:str]
+  lastmodified: "2026-09-11T08:41:08Z"
+  mac: ENC[AES256_GCM,data:Kp+FNfKFSD1SGgHS7xc51CGqugyAQlTHqI1bxQxuGLht7dTdbltu8llyyGSwYuToAeUAgBKi+Nv4OQ7qM3nQ/1I3IjUJ6t3G3LNbOfOe6h4cF5wb2pV8NnpzjpwEgOMVI6dzCbW/hRqND8JrgSgnkPjM4WyOtiz8+N7evY8qAOs=,iv:kOkxsVfuVO5/XJBmnQKZm8mFVoQlUZKT51TUUAGij/8=,tag:8i59H3tvwUvSBU0LWLsdbg==,type:str]
   pgp:
     - created_at: "2026-05-20T02:08:47Z"
       enc: |-
diff --git a/inventories/chaosknoten/host_vars/auth-dns.yaml b/inventories/chaosknoten/host_vars/auth-dns.yaml
index 035e0328..e481a4e6 100644
--- a/inventories/chaosknoten/host_vars/auth-dns.yaml
+++ b/inventories/chaosknoten/host_vars/auth-dns.yaml
@@ -10,8 +10,10 @@ knot__remotes:
   - id: ns.vie.ccc.de
     address: [ "2a02:1b8:10:31::228", "146.255.57.228" ]
     via: [ "2a00:14b0:4200:3000:124::1", "212.12.48.124" ]
-  # - id: cccfr-de-hidden-primary
-  #   address: [ "89.163.204.252" ]
+  - id: cccfr-de-hidden-primary
+    address: [ "89.163.204.252" ]
+    via: [ "2a00:14b0:4200:3000:124::1", "212.12.48.124" ]
+    key: "xfr-ccchh-cccfr"
 
 knot__catalog_zones:
   - domain: "hamburg.ccc.de.catalog."
@@ -52,6 +54,6 @@ knot__primary_zones:
     notify_targets: [ "erfadns.ber.ccc.de" ]
     content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/auth-dns/zones/3.2.0.0.0.0.0.f.0.b.4.1.0.0.a.2.ip6.arpa.zone') }}"
 
-# knot__catalog_secondary_zones:
-#   - domain: "cccfr.catalog.invalid"
-#     primary: "cccfr-de-hidden-primary"
+knot__catalog_secondary_zones:
+  - domain: "cccfr.catalog.invalid"
+    primary: "cccfr-de-hidden-primary"