diff --git a/.github/workflows/dns.yml b/.github/workflows/dns.yml
new file mode 100644
index 0000000..4576296
--- /dev/null
+++ b/.github/workflows/dns.yml
@@ -0,0 +1,44 @@
+name: dns
+
+on:
+  pull_request:
+    paths:
+      - "dns/**"
+      - ".github/workflows/dns.yml"
+  push:
+    branches:
+      - master
+    paths:
+      - "dns/**"
+      - ".github/workflows/dns.yml"
+
+permissions:
+  contents: read
+
+env:
+  DNSCONTROL_VERSION: 4.44.1
+
+jobs:
+  dns:
+    # Secrets are unavailable to fork PRs, so run only for same-repo events
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: dns
+    steps:
+      - uses: actions/checkout@v5
+      - name: Install dnscontrol
+        run: |
+          curl -fsSL "https://github.com/StackExchange/dnscontrol/releases/download/v${DNSCONTROL_VERSION}/dnscontrol_${DNSCONTROL_VERSION}_linux_amd64.tar.gz" | tar xz dnscontrol
+          sudo mv dnscontrol /usr/local/bin/dnscontrol
+      - name: Preview
+        if: github.event_name == 'pull_request'
+        run: dnscontrol preview --creds creds.json
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      - name: Push
+        if: github.event_name == 'push'
+        run: dnscontrol push --creds creds.json
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
diff --git a/dns/creds.json b/dns/creds.json
new file mode 100644
index 0000000..7d36fbf
--- /dev/null
+++ b/dns/creds.json
@@ -0,0 +1,6 @@
+{
+  "cloudflare": {
+    "TYPE": "CLOUDFLAREAPI",
+    "apitoken": "$CLOUDFLARE_API_TOKEN"
+  }
+}
diff --git a/dns/dnsconfig.js b/dns/dnsconfig.js
new file mode 100644
index 0000000..583c8ba
--- /dev/null
+++ b/dns/dnsconfig.js
@@ -0,0 +1,37 @@
+// generated by get-zones. This is 'a decent first draft' and requires editing.
+
+var DSP_CLOUDFLARE = NewDnsProvider("cloudflare", "CLOUDFLAREAPI");
+var REG_CHANGEME = NewRegistrar("none");
+
+D("rubyci.org", REG_CHANGEME,
+	DnsProvider(DSP_CLOUDFLARE),
+	DefaultTTL(1),
+	A("amazon2023", "35.72.97.116"),
+	A("arch", "35.72.171.27"),
+	A("crossruby", "54.65.185.15"),
+	A("debian11", "54.178.164.239"),
+	A("debian12", "18.177.243.215"),
+	A("debian13", "35.72.238.43"),
+	A("debian", "35.73.95.28"),
+	A("fedora44-arm", "18.176.170.223"),
+	A("fedora43", "54.249.168.246"),
+	A("freebsd14", "35.73.133.12"),
+	A("freebsd15-arm", "52.196.12.20"),
+	A("icc", "18.180.104.156"),
+	A("openbsd", "52.197.61.51"),
+	A("opensuseleap", "3.113.91.40"),
+	A("ppc64le", "140.211.168.162"),
+	A("rhel10", "35.76.91.191"),
+	A("rhel8", "35.73.137.17"),
+	A("rhel9", "18.177.224.191"),
+	A("riscv", "18.181.4.174"),
+	A("s390x", "148.100.84.245"),
+	A("ubuntu2204", "54.248.215.194"),
+	A("ubuntu2404", "18.180.242.9"),
+	A("ubuntu-arm", "18.178.229.119"),
+	A("ubuntu", "35.72.236.42"),
+	// Cloudflare flattens this apex CNAME; dnscontrol expresses it as ALIAS.
+	ALIAS("@", "rubyci.org.herokudns.com."),
+	CNAME("www", "www.rubyci.org.herokudns.com."),
+);
+
diff --git a/hosts.yml b/hosts.yml
index 9b78061..b7da450 100644
--- a/hosts.yml
+++ b/hosts.yml
@@ -82,13 +82,6 @@ s390x.rubyci.org: # z15
     run_list:
       - recipes/default.rb
 
-freebsd13.rubyci.org:
-  properties:
-    nopasswd_sudo: true
-    compress: false
-    run_list:
-      - recipes/default.rb
-
 gem-codesearch.dev.ruby-lang.org:
   properties:
     nopasswd_sudo: true
@@ -145,42 +138,42 @@ freebsd14.rubyci.org:
     run_list:
       - recipes/default.rb
 
-fedora42-arm.rubyci.org:
+ubuntu-arm.rubyci.org:
   properties:
     nopasswd_sudo: true
     compress: false
     run_list:
       - recipes/default.rb
 
-ubuntu-arm.rubyci.org:
+debian13.rubyci.org:
   properties:
     nopasswd_sudo: true
     compress: false
     run_list:
       - recipes/default.rb
 
-debian13.rubyci.org:
+rhel10.rubyci.org:
   properties:
     nopasswd_sudo: true
     compress: false
     run_list:
       - recipes/default.rb
 
-rhel10.rubyci.org:
+fedora43.rubyci.org:
   properties:
     nopasswd_sudo: true
     compress: false
     run_list:
       - recipes/default.rb
 
-fedora43.rubyci.org:
+freebsd15-arm.rubyci.org:
   properties:
     nopasswd_sudo: true
     compress: false
     run_list:
       - recipes/default.rb
 
-freebsd15-arm.rubyci.org:
+fedora44-arm.rubyci.org:
   properties:
     nopasswd_sudo: true
     compress: false