diff --git a/netinfra/dns-cluster-setup/remote-dns.sh b/netinfra/dns-cluster-setup/remote-dns.sh
index 39caa84..37ca801 100755
--- a/netinfra/dns-cluster-setup/remote-dns.sh
+++ b/netinfra/dns-cluster-setup/remote-dns.sh
@@ -11,12 +11,14 @@
 # script. Mirrors the pattern of tests/remote.sh.
 #
 # HOSTS (override IPs via env if needed):
-#   tsrouter       tailscale-router.knel.net  (PRODUCTION — READ-ONLY here)
 #   netinfra01     pfv-netinfra-01.knel.net   (Technitium primary target)
 #   netinfra02     pfv-netinfra-02.knel.net   (Technitium secondary target)
 #   netboot        pfv-netboot.knel.net       (reference / validation client)
 #   sandbox        sectestbed-sandbox.knel.net (validation client)
 #
+# NOTE: the former tsrouter alias (tailscale-router.knel.net) was removed
+# 2026-09-02 — that host is retired; subnet routing is now the netinfra pair.
+#
 # All hosts are accessed as $VM_USER (default: localuser) over SSH with key auth
 # and passwordless sudo.
 #
@@ -27,15 +29,13 @@
 #   remote-dns.sh <host-alias>-copy <local> <remote-dest>   copy a file to host
 #
 #   e.g.
-#   remote-dns.sh tsrouter 'hostname; whoami'
 #   remote-dns.sh netinfra01-root 'systemctl status dnsServer'
-#   remote-dns.sh tsrouter-file ./probe.sh
+#   remote-dns.sh netboot-file ./probe.sh
 #
 set -uo pipefail
 
 VM_USER="${VM_USER:-localuser}"
 # Hostname -> FQDN map. Override individual IPs via env if a host moves.
-TSROUTER_HOST="${TSROUTER_HOST:-tailscale-router.knel.net}"
 NETINFRA01_HOST="${NETINFRA01_HOST:-pfv-netinfra-01.knel.net}"
 NETINFRA02_HOST="${NETINFRA02_HOST:-pfv-netinfra-02.knel.net}"
 NETBOOT_HOST="${NETBOOT_HOST:-pfv-netboot.knel.net}"
@@ -47,7 +47,6 @@ die() { echo "remote-dns.sh: $*" >&2; exit 1; }
 
 host_fqdn() {
   case "$1" in
-    tsrouter)    printf '%s' "$TSROUTER_HOST" ;;
     netinfra01)  printf '%s' "$NETINFRA01_HOST" ;;
     netinfra02)  printf '%s' "$NETINFRA02_HOST" ;;
     netboot)     printf '%s' "$NETBOOT_HOST" ;;
@@ -79,7 +78,7 @@ case "$spec" in
   *-copy) mode="copy"; alias="${spec%-copy}" ;;
 esac
 
-fqdn="$(host_fqdn "$alias")" || die "unknown host alias '$alias' (try: tsrouter|netinfra01|netinfra02|netboot|sandbox)"
+fqdn="$(host_fqdn "$alias")" || die "unknown host alias '$alias' (try: netinfra01|netinfra02|netboot|sandbox)"
 
 case "$mode" in
   run)  _run "$fqdn" "$*" ;;
diff --git a/netinfra/dns-cluster-setup/setup.sh b/netinfra/dns-cluster-setup/setup.sh
index 34da163..9ff1e0a 100755
--- a/netinfra/dns-cluster-setup/setup.sh
+++ b/netinfra/dns-cluster-setup/setup.sh
@@ -2,12 +2,16 @@
 #
 # setup.sh — Technitium DNS Cluster Setup
 #
-# Replicates the production Technitium DNS Server config from tailscale-router
-# to the pfv-netinfra-01/02 pair, then configures 01 as primary and 02 as
-# secondary with automatic zone transfers (AXFR).
+# BOOTSTRAP (historical): originally exported the production config from the
+# retired tailscale-router host to the pfv-netinfra-01/02 pair. Since
+# 2026-09-02 (router retired) the export source is pfv-netinfra-01 itself,
+# the live primary and SoR for knel.net zones.
 #
-# PRODUCTION SAFETY: tailscale-router is accessed READ-ONLY. No file on it is
-# modified. The only operation is a docker cp (read) to export the config.
+# Configures 01 as primary and 02 as secondary with automatic zone
+# transfers (AXFR).
+#
+# PRODUCTION SAFETY: the export source is accessed READ-ONLY. No file on it
+# is modified. The only operation is a docker cp (read) to export the config.
 #
 # ARCHITECTURE AFTER SETUP:
 #
@@ -19,8 +23,6 @@
 #     Pi-hole (:53) → Technitium (:5300 inside container)
 #     All zones are Secondary; AXFR from 01 on changes
 #
-#   tailscale-router — PRODUCTION (untouched, read-only source of truth)
-#
 # CLUSTERING MECHANISM:
 #   Technitium primary/secondary via DNS zone transfers (AXFR/IXFR + NOTIFY).
 #   01 serves all zones as Primary. 02 fetches them as Secondary from
@@ -33,7 +35,7 @@
 #   all three servers.
 #
 # USAGE:
-#   ./setup.sh export     # Step 1: read-only export from tailscale-router
+#   ./setup.sh export     # Step 1: read-only export from primary (netinfra-01)
 #   ./setup.sh deploy01   # Step 2: deploy config to netinfra-01 (primary)
 #   ./setup.sh deploy02   # Step 3: deploy config to netinfra-02 (secondary)
 #   ./setup.sh cluster    # Step 4: configure clustering (01 primary, 02 secondary)
@@ -46,7 +48,7 @@ HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REMOTE="$HERE/remote-dns.sh"
 
 # Host aliases (defined in remote-dns.sh)
-PROD="tsrouter"        # tailscale-router (READ-ONLY)
+PROD="$PRIMARY"        # export source: primary (was tailscale-router, retired 2026-09-02)
 PRIMARY="netinfra01"   # pfv-netinfra-01
 SECONDARY="netinfra02" # pfv-netinfra-02
 
diff --git a/netinfra/dns-cluster-setup/verify.sh b/netinfra/dns-cluster-setup/verify.sh
index 6a1ad00..1f3dec3 100755
--- a/netinfra/dns-cluster-setup/verify.sh
+++ b/netinfra/dns-cluster-setup/verify.sh
@@ -13,7 +13,9 @@ REMOTE="$HERE/remote-dns.sh"
 
 PRIMARY="netinfra01"
 SECONDARY="netinfra02"
-PROD="tsrouter"
+# The retired tailscale-router was the old PROD comparison target; the
+# primary itself is production since 2026-09-02.
+PROD="$PRIMARY"
 
 PRIMARY_IP="${PRIMARY_IP:-192.168.3.252}"
 SECONDARY_IP="${SECONDARY_IP:-192.168.3.253}"
@@ -89,7 +91,7 @@ fi
 section "4. knel.net zone resolves identically on primary and secondary"
 
 # Query a known record on both servers directly via Technitium's port
-for name in pfv-netinfra-01 pfv-netinfra-02 tailscale-router tsys-cloudron tsys-nsm; do
+for name in pfv-netinfra-01 pfv-netinfra-02 tsys-cloudron tsys-siem tsys-wazuh; do
   fqdn="${name}.knel.net"
   # Query via dig against each Technitium instance (through Pi-hole on :53)
   pri_ans=$(run "$PRIMARY" "dig +short +time=3 +tries=1 @127.0.0.1 -p 53 $fqdn A 2>/dev/null | head -1" 2>/dev/null || true)