diff --git a/eight/octodns-config.nix b/eight/octodns-config.nix
index 6cef98a..1777dc9 100644
--- a/eight/octodns-config.nix
+++ b/eight/octodns-config.nix
@@ -4,10 +4,11 @@ in {
   config-directory = let
     generated = builtins.fromJSON (builtins.readFile ./../exports/jupiter/generated.json);
     atproto-handles-all-domains = builtins.fromTOML (builtins.readFile ./per-domain/atproto-handles.toml);
-    # Given a mapping of atproto handles to dids, converts it into a mapping of octodns atproto subdomains to TXT records
+    # Given a mapping of atproto handles to dids, converts it into a mapping of octodns atproto subdomains to TXT records.
+    # The empty handle "" is the zone apex, whose record is `_atproto` (no trailing label).
     handles-to-records = lib.mapAttrs' # mapAttrs' :: (String -> Any -> { name :: String; value :: Any; }) -> AttrSet -> AttrSet
       (handle: did: lib.nameValuePair
-        ("_atproto.${handle}")
+        (if handle == "" then "_atproto" else "_atproto.${handle}")
         ({
           octodns.cloudflare = {
             auto-ttl = true;
diff --git a/eight/per-domain/atproto-handles.toml b/eight/per-domain/atproto-handles.toml
index d7d66f2..3376f1c 100644
--- a/eight/per-domain/atproto-handles.toml
+++ b/eight/per-domain/atproto-handles.toml
@@ -1,2 +1,4 @@
 ["andref.app"]
+# Empty key = the zone apex, i.e. the handle `andref.app` itself (_atproto.andref.app).
+"" = "did=did:plc:wtll3pvlzt33iidpolfe7p54"
 starptr = "did=did:plc:vmdvpnvlmvtd7sih6yalawnr"
\ No newline at end of file