diff --git a/zones/supported.systems.zone b/zones/supported.systems.zone
index d7e5111..69430f2 100644
--- a/zones/supported.systems.zone
+++ b/zones/supported.systems.zone
@@ -3,7 +3,7 @@
 $ORIGIN supported.systems.
 $TTL 3600
 @ 3600 IN SOA ns1.he.net. admin.supported.systems. (
-    2026052102  ; serial — bump per change (SERIAL=YYYYMMDDNN make prep)
+    2026052103  ; serial — bump per change (CalVer YYYYMMDDNN; bumped manually post-retirement of make prep)
     300         ; refresh (5 min) — slaves poll us this often;
                 ;   tightened from 3600 to nudge HE's internal
                 ;   puller→anycast replication
@@ -26,12 +26,12 @@ ns	300	IN	AAAA	2001:19f0:5c00:4daa:5400:06ff:fe2d:38fa
 ns	300	IN	A	64.177.113.227
 mail	300	IN	A	155.138.160.10
 old-mailu	300	IN	A	66.42.75.247
-ssh	300	IN	A	45.77.1.152
+ssh	300	IN	A	149.28.207.111
 git	300	IN	CNAME	git.supportedsystems.net.
 *	60	IN	A	108.61.23.129
 up	300	IN	A	45.63.92.95
-vpn	300	IN	A	45.77.1.152
-web-bmh-servicedesk.bmh	300	IN	A	45.77.1.152
+vpn	300	IN	CNAME	ssh.supported.systems.
+web-bmh-servicedesk.bmh	300	IN	CNAME	ssh.supported.systems.
 cdn	300	IN	A	155.138.192.181
 server1	300	IN	A	45.76.231.166
 docker-1	300	IN	A	108.61.229.209