diff --git a/apps/fc-dns/fc-dns.yaml b/apps/fc-dns/fc-dns.yaml
index bfa72f4..6fe244d 100644
--- a/apps/fc-dns/fc-dns.yaml
+++ b/apps/fc-dns/fc-dns.yaml
@@ -172,6 +172,14 @@ spec:
                   name: dns-api-keys
                   key: api_key
                   optional: true
+            - name: FlowerCore__Mcp__ApiKey__Key
+              valueFrom:
+                secretKeyRef:
+                  name: dns-api-keys
+                  key: api_key
+                  optional: true
+            - name: FlowerCore__Mcp__ServiceName
+              value: flowercore.dns
             - name: FlowerCore__Auth__Enabled
               value: "true"
             - name: FlowerCore__Auth__Oidc__Enabled
diff --git a/tests/bluejay-infra-lint/FleetManifestLintTests.cs b/tests/bluejay-infra-lint/FleetManifestLintTests.cs
index 3fff626..7dc2a8f 100644
--- a/tests/bluejay-infra-lint/FleetManifestLintTests.cs
+++ b/tests/bluejay-infra-lint/FleetManifestLintTests.cs
@@ -934,6 +934,9 @@ public sealed class FleetManifestLintTests
         EnvSecretName(dnsWeb, "FlowerCore__Auth__ApiKey").Should().Be("dns-api-keys");
         EnvSecretKey(dnsWeb, "FlowerCore__Auth__ApiKey").Should().Be("api_key");
         EnvSecretOptional(dnsWeb, "FlowerCore__Auth__ApiKey").Should().Be("true");
+        EnvSecretName(dnsWeb, "FlowerCore__Mcp__ApiKey__Key").Should().Be("dns-api-keys");
+        EnvSecretKey(dnsWeb, "FlowerCore__Mcp__ApiKey__Key").Should().Be("api_key");
+        EnvSecretOptional(dnsWeb, "FlowerCore__Mcp__ApiKey__Key").Should().Be("true");
 
         var webhook = AppDocuments("fc-dns")
             .Single(document => document.Kind == "Deployment" && document.Name == "dns-acme-webhook")