diff --git a/infrastructure/inventory/group_vars/pihole.yml b/infrastructure/inventory/group_vars/pihole.yml
index 77acafa..b548154 100644
--- a/infrastructure/inventory/group_vars/pihole.yml
+++ b/infrastructure/inventory/group_vars/pihole.yml
@@ -11,3 +11,20 @@ lan_reverse_zone: "0.0.10.in-addr.arpa"
 # Performance/resilience knobs
 pihole_dns_forward_max: 300
 pihole_sqlite_busy_timeout: 5000
+
+# knoe.dev GKE service records — resolved on the LAN via dnsmasq address= directives.
+# These bypass split-horizon Samba DNS which only knows prole.org, not knoe.dev.
+# GCE LB IPs are stable (manually assigned via GCP static IP reservation).
+#
+# To update: change the IP below and re-run the pihole_dns role.
+# Source of truth: `kubectl get ingress -A` on the knoe-dev-0 cluster.
+knoe_dev_dns_records:
+  # knoe-mcp: company knowledge MCP  (GCE LB: knoe-mcp-knoeledge-mcp)
+  - { name: "mcp.0.knoe.dev",    ip: "8.232.93.14"  }
+  # knoe-auth: identity / OIDC / Kerberos token exchange  (GCE LB: knoe-auth)
+  - { name: "auth.0.knoe.dev",   ip: "34.36.71.141"  }
+  # supabase kong: API gateway + DB proxy  (GCE LB: supabase-kong)
+  - { name: "api.0.knoe.dev",    ip: "34.120.221.5"  }
+  - { name: "db.0.knoe.dev",     ip: "34.120.221.5"  }
+  # Knoey web app
+  - { name: "app.0.knoe.dev",    ip: "34.120.221.5"  }
diff --git a/infrastructure/roles/pihole_dns/tasks/main.yml b/infrastructure/roles/pihole_dns/tasks/main.yml
index 4fb0283..47e58c9 100644
--- a/infrastructure/roles/pihole_dns/tasks/main.yml
+++ b/infrastructure/roles/pihole_dns/tasks/main.yml
@@ -23,6 +23,15 @@
     mode: "0644"
   notify: restart pihole-FTL
 
+- name: Configure knoe.dev GKE service records (LAN split-horizon)
+  ansible.builtin.template:
+    src: 06-knoe-dev.conf.j2
+    dest: /etc/dnsmasq.d/06-knoe-dev.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart pihole-FTL
+
 - name: Read current Pi-hole FTL DB journal mode (WAL?)
   ansible.builtin.command: sqlite3 /etc/pihole/pihole-FTL.db "PRAGMA journal_mode;"
   register: pihole_journal
diff --git a/infrastructure/roles/pihole_dns/templates/06-knoe-dev.conf.j2 b/infrastructure/roles/pihole_dns/templates/06-knoe-dev.conf.j2
new file mode 100644
index 0000000..135e3da
--- /dev/null
+++ b/infrastructure/roles/pihole_dns/templates/06-knoe-dev.conf.j2
@@ -0,0 +1,11 @@
+# knoe.dev GKE service records
+# Injected by Ansible pihole_dns role — do not edit manually.
+#
+# GKE app cluster (knoe-dev-0) LB endpoints:
+#   mcp.*       → 8.232.93.14   (knoe-mcp GCE LB)
+#   auth.*      → 34.36.71.141  (knoe-auth GCE LB)
+#   api.*, db.* → 34.120.221.5  (supabase-kong GCE LB)
+
+{% for record in knoe_dev_dns_records %}
+address=/{{ record.name }}/{{ record.ip }}
+{% endfor %}