diff --git a/terraform/0rng.one.tf b/terraform/0rng.one.tf
index f1fd2b5..137496f 100644
--- a/terraform/0rng.one.tf
+++ b/terraform/0rng.one.tf
@@ -5,10 +5,10 @@ resource "gandi_livedns_domain" "orngone" {
 resource "gandi_livedns_record" "orngone_apex" {
   zone = gandi_livedns_domain.orngone.id
   name = "@"
-  type = "A"
+  type = "ALIAS" # Gandi doesn't support CNAME-flattening
   ttl  = 3600
   values = [
-    linode_instance.casey.ip_address
+    cloudflare_record.sys_domain_pve.hostname
   ]
 }
 
diff --git a/terraform/casey_vps.tf b/terraform/casey_vps.tf
index 24714ad..a3cfa41 100644
--- a/terraform/casey_vps.tf
+++ b/terraform/casey_vps.tf
@@ -77,10 +77,10 @@ resource "linode_firewall" "casey" {
 
 resource "linode_rdns" "casey_reverse_ipv4" {
   address = linode_instance.casey.ip_address
-  rdns    = "casey.sys.theorangeone.net"
+  rdns    = cloudflare_record.sys_domain_casey.hostname
 }
 
 resource "linode_rdns" "casey_reverse_ipv6" {
   address = split("/", linode_instance.casey.ipv6)[0]
-  rdns    = "casey.sys.theorangeone.net"
+  rdns    = cloudflare_record.sys_domain_casey.hostname
 }
diff --git a/terraform/jakehoward.tech.tf b/terraform/jakehoward.tech.tf
index b88a689..b8ac4e4 100644
--- a/terraform/jakehoward.tech.tf
+++ b/terraform/jakehoward.tech.tf
@@ -63,96 +63,96 @@ resource "cloudflare_record" "jakehowardtech_dmarc" {
 resource "cloudflare_record" "jakehowardtech_wallabag" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "wallabag"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_ttrss" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "tt-rss"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_speed" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "speed"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_quassel" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "quassel"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_media" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "media"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_matrix" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "matrix"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_intersect" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "intersect"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_calibre" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "calibre"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_homeassistant" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "homeassistant"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_grafana" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "grafana"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_vaultwarden" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "vaultwarden"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_tandoor" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "recipes"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
@@ -183,8 +183,8 @@ resource "cloudflare_record" "jakehowardtech_mailgun_dmarc" {
 resource "cloudflare_record" "jakehowardtech_matrix_admin" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "synapse-admin"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
@@ -200,48 +200,48 @@ resource "cloudflare_record" "jakehowardtech_apex" {
 resource "cloudflare_record" "jakehowardtech_collabora" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "collabora"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_tasks" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "tasks"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_auth" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "auth"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_minio" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "minio"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_s3" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "s3"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "jakehowardtech_ntfy" {
   zone_id = cloudflare_zone.jakehowardtech.id
   name    = "ntfy"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
diff --git a/terraform/sys_domains.tf b/terraform/sys_domains.tf
index 23e8657..a9f6acd 100644
--- a/terraform/sys_domains.tf
+++ b/terraform/sys_domains.tf
@@ -29,3 +29,11 @@ resource "cloudflare_record" "sys_domain_walker_v6" {
   type    = "AAAA"
   ttl     = 1
 }
+
+resource "cloudflare_record" "sys_domain_pve" {
+  zone_id = cloudflare_zone.theorangeonenet.id
+  name    = "pve.sys"
+  value   = cloudflare_record.sys_domain_casey.hostname
+  type    = "CNAME"
+  ttl     = 1
+}
diff --git a/terraform/theorangeone.net.tf b/terraform/theorangeone.net.tf
index 26c4271..c7e769c 100644
--- a/terraform/theorangeone.net.tf
+++ b/terraform/theorangeone.net.tf
@@ -5,16 +5,16 @@ resource "cloudflare_zone" "theorangeonenet" {
 resource "cloudflare_record" "theorangeonenet_git" {
   zone_id = cloudflare_zone.theorangeonenet.id
   name    = "git"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "theorangeonenet_whoami" {
   zone_id = cloudflare_zone.theorangeonenet.id
   name    = "whoami"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
@@ -109,7 +109,7 @@ resource "cloudflare_record" "theorangeonenet_srv_matrix" {
   data = {
     service  = "_matrix"
     proto    = "_tcp"
-    name     = "theorangeone.net"
+    name     = cloudflare_zone.theorangeonenet.zone
     priority = 10
     weight   = 0
     port     = 8448
@@ -120,8 +120,8 @@ resource "cloudflare_record" "theorangeonenet_srv_matrix" {
 resource "cloudflare_record" "theorangeonenet_matrix" {
   zone_id = cloudflare_zone.theorangeonenet.id
   name    = "matrix"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
@@ -152,16 +152,16 @@ resource "cloudflare_record" "theorangeonenet_notes" {
 resource "cloudflare_record" "theorangeonenet_privatebin" {
   zone_id = cloudflare_zone.theorangeonenet.id
   name    = "bin"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
 resource "cloudflare_record" "theorangeonenet_dokku" {
   zone_id = cloudflare_zone.theorangeonenet.id
   name    = "d"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
@@ -224,8 +224,8 @@ resource "cloudflare_record" "theorangeonenet_mailgun_dmarc" {
 resource "cloudflare_record" "theorangeonenet_mastodon" {
   zone_id = cloudflare_zone.theorangeonenet.id
   name    = "mastodon"
-  value   = linode_instance.casey.ip_address
-  type    = "A"
+  value   = cloudflare_record.sys_domain_pve.hostname
+  type    = "CNAME"
   ttl     = 1
 }
 
diff --git a/terraform/walker_vps.tf b/terraform/walker_vps.tf
index 2dc8116..d5fb40a 100644
--- a/terraform/walker_vps.tf
+++ b/terraform/walker_vps.tf
@@ -18,11 +18,11 @@ resource "vultr_instance" "walker" {
 resource "vultr_reverse_ipv4" "walker_reverse_ipv4" {
   instance_id = vultr_instance.walker.id
   ip          = vultr_instance.walker.main_ip
-  reverse     = "walker.sys.theorangeone.net"
+  reverse     = cloudflare_record.sys_domain_walker.hostname
 }
 
 resource "vultr_reverse_ipv6" "walker_reverse_ipv6" {
   instance_id = vultr_instance.walker.id
   ip          = vultr_instance.walker.v6_main_ip
-  reverse     = "walker.sys.theorangeone.net"
+  reverse     = cloudflare_record.sys_domain_walker.hostname
 }