diff --git a/app/Provisioning/Steps/Customer/ConfigureDnsAndTls.php b/app/Provisioning/Steps/Customer/ConfigureDnsAndTls.php
index f64d4d0..f60d699 100644
--- a/app/Provisioning/Steps/Customer/ConfigureDnsAndTls.php
+++ b/app/Provisioning/Steps/Customer/ConfigureDnsAndTls.php
@@ -31,13 +31,14 @@ class ConfigureDnsAndTls extends CustomerStep
         $host = $instance->host;
         $fqdn = $instance->subdomain.'.'.config('provisioning.dns.zone');
 
-        // DNS — persist the record id [E] before anything downstream.
+        // DNS — provider upsert is idempotent; the local row uses firstOrCreate on
+        // the record id and is written BEFORE the breadcrumb (the short-circuit guard).
         if (! $this->hasResource($run, 'dns_record_id')) {
             $recordId = $this->dns->upsertRecord($fqdn, 'A', $host->public_ip);
-            $instance->dnsRecords()->create([
-                'provider' => 'hetzner', 'record_id' => $recordId,
-                'fqdn' => $fqdn, 'type' => 'A', 'value' => $host->public_ip,
-            ]);
+            $instance->dnsRecords()->firstOrCreate(
+                ['record_id' => $recordId],
+                ['provider' => 'hetzner', 'fqdn' => $fqdn, 'type' => 'A', 'value' => $host->public_ip],
+            );
             $this->recordResource($run, $host, 'dns_record_id', $recordId);
         }