diff --git a/cluster/applications/minecraft/service.yaml b/cluster/applications/minecraft/service.yaml
index c9a10f2..dd9cfe6 100644
--- a/cluster/applications/minecraft/service.yaml
+++ b/cluster/applications/minecraft/service.yaml
@@ -12,8 +12,13 @@ metadata:
     app.kubernetes.io/component: papermc
   annotations:
     # Internal DNS via ExternalDNS + Technitium
-    external-dns.alpha.kubernetes.io/hostname: journey-into-imagination.local.mk-labs.cloud
+    external-dns.alpha.kubernetes.io/hostname: "journey-into-imagination.local.mk-labs.cloud,journey-into-imagination.mk-labs.cloud"
     # Non-standard external port 10182 → internal 25565 (via ingress-nginx tcp forwarding)
+    # Public DNS via ExternalDNS + Cloudflare
+    # Cloudflare proxy MUST be off — TCP (non-HTTP) traffic cannot be proxied
+    external-dns.alpha.kubernetes.io/public: "true"
+    external-dns.alpha.kubernetes.io/target: "ingress.mk-labs.cloud"
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
 spec:
   type: ClusterIP
   selector: