diff --git a/dnsconfig.js b/dnsconfig.js
index e4c7ae7..7445119 100644
--- a/dnsconfig.js
+++ b/dnsconfig.js
@@ -37,6 +37,8 @@ DEFAULTS(
     issuemail: "none",
     issuemail_critical: true,
   }),
+  CNAME("openpgpkey", "wkd.keys.openpgp.org."),
+  TXT("@", "$argon2id$v=19$m=64,t=512,p=2$H4Bumsm+B/5AoPZg6ALhXA$CqmxBvGH0Qcl0sd3DP0ERQ"),
 );
 
 /* ****************************************************************************************************************** *\
@@ -131,6 +133,7 @@ cnames("arirex.me", rexcloud, [
   "OpenWebUI@ai",
   "Owncast@stream",
   "Pocket ID@id",
+  "Reactive Resume@resume",
   "SearXNG@search",
 ]);
 
diff --git a/flake.lock b/flake.lock
index 9448fe0..1493c53 100644
--- a/flake.lock
+++ b/flake.lock
@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1778443072,
-        "narHash": "sha256-zi7/fsqM/kFdNuED//4WOCUtezGtKKqRNORjMvfwjnA=",
+        "lastModified": 1786384358,
+        "narHash": "sha256-RzPPiWeUtuvymnpuEWsdtzli5w4kjZs49FqEs3/1u+I=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "da5ad661ba4e5ef59ba743f0d112cbc30e474f32",
+        "rev": "2fcb964de67fcf60b43471c55d5d99e61a9ccb5a",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 31d8833..93bb485 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,16 +11,7 @@
       in {
         devShells.default = pkgs.mkShell {
           buildInputs = with pkgs; [
-            (dnscontrol.overrideAttrs (oldAttrs: {
-              version = "4.38.0";
-              src = fetchFromGitHub {
-                owner = "DNSControl";
-                repo = "dnscontrol";
-                rev = "v${oldAttrs.version}";
-                sha256 = "sha256-lM+9xuNB88csciIC5eu2oRl0IBqZE7CCPCxf8BEZSz0=";
-              };
-              vendorHash = "sha256-pzdOW+L/w74ANaCKXWQviBMDlSTOfebAVE7Cdd+lZLo=";
-            }))
+            dnscontrol
             (git-crypt.overrideAttrs (oldAttrs: { src = fetchFromGitHub {
               owner = "narrowin";
               repo = "git-crypt";
diff --git a/types-dnscontrol.d.ts b/types-dnscontrol.d.ts
index 6d40c7d..233a8b3 100644
--- a/types-dnscontrol.d.ts
+++ b/types-dnscontrol.d.ts
@@ -1,7 +1,7 @@
 // This file was automatically generated by DNSControl. Do not edit it directly.
 // To update it, run `dnscontrol write-types`.
 
-// 4.38.0
+// 4.45.0
 // WARNING: These type definitions are experimental and subject to change in future releases.
 
 interface Domain {
@@ -31,7 +31,8 @@ type DomainModifier =
 
 type RecordModifier =
     | ((record: DNSRecord) => void)
-    | Partial<DNSRecord['meta']>;
+    | Partial<DNSRecord['meta']>
+    | RecordModifier[];
 
 type Duration =
     | `${number}${'s' | 'm' | 'h' | 'd' | 'w' | 'n' | 'y' | ''}`
@@ -545,21 +546,21 @@ declare function CAA(name: string, tag: "issue" | "issuewild" | "iodef" | "conta
  * ### Parameters
  *
  * * `label:` The label of the CAA record. (Optional. Default: `"@"`)
- * * `iodef:` Report all violation to configured mail address.
+ * * `iodef:` Report all violation to configured mail address. (Optional. Default: `""`)
  * * `iodef_critical:` This can be `true` or `false`. If enabled and CA does not support this record, then certificate issue will be refused. (Optional. Default: `false`)
- * * `issue:` An array of CAs which are allowed to issue certificates. (Use `"none"` to refuse all CAs)
+ * * `issue:` An array of CAs which are allowed to issue certificates. (Optional. Default: `[]`. Use `"none"` to refuse all CAs)
  * * `issue_critical:` This can be `true` or `false`. If enabled and CA does not support this record, then certificate issue will be refused. (Optional. Default: `false`)
- * * `issuewild:` An array of CAs which are allowed to issue wildcard certificates. (Can be simply `"none"` to refuse issuing wildcard certificates for all CAs)
+ * * `issuewild:` An array of CAs which are allowed to issue wildcard certificates. (Optional. Default: `[]`. Can be simply `"none"` to refuse issuing wildcard certificates for all CAs)
  * * `issuewild_critical:` This can be `true` or `false`. If enabled and CA does not support this record, then certificate issue will be refused. (Optional. Default: `false`)
- * * `issuevmc:` An array of CAs which are allowed to issue VMC certificates. (Use `"none"` to refuse all CAs)
+ * * `issuevmc:` An array of CAs which are allowed to issue VMC certificates. (Optional. Default: `[]`. Use `"none"` to refuse all CAs)
  * * `issuevmc_critical:` This can be `true` or `false`. If enabled and CA does not support this record, then certificate issue will be refused. (Optional. Default: `false`)
- * * `issuemail:` An array of CAs which are allowed to issue email certificates. (Use `"none"` to refuse all CAs)
+ * * `issuemail:` An array of CAs which are allowed to issue email certificates. (Optional. Default: `[]`. Use `"none"` to refuse all CAs)
  * * `issuemail_critical:` This can be `true` or `false`. If enabled and CA does not support this record, then certificate issue will be refused. (Optional. Default: `false`)
  * * `ttl:` Input for `TTL` method (optional)
  *
  * @see https://docs.dnscontrol.org/language-reference/domain-modifiers/caa_builder
  */
-declare function CAA_BUILDER(opts: { label?: string; iodef: string; iodef_critical?: boolean; issue: string[]|string; issue_critical?: boolean; issuewild: string[]|string; issuewild_critical?: boolean; issuevmc: string[]|string; issuevmc_critical?: boolean; issuemail: string[]|string; issuemail_critical?: boolean; ttl?: Duration }): DomainModifier;
+declare function CAA_BUILDER(opts: { label?: string; iodef?: string; iodef_critical?: boolean; issue?: string[]|'none'; issue_critical?: boolean; issuewild?: string[]|'none'; issuewild_critical?: boolean; issuevmc?: string[]|'none'; issuevmc_critical?: boolean; issuemail?: string[]|'none'; issuemail_critical?: boolean; ttl?: Duration }): DomainModifier;
 
 /**
  * **WARNING:** Cloudflare is removing this feature and replacing it with a new
@@ -3130,7 +3131,7 @@ declare const PURGE: DomainModifier;
  *
  * @see https://docs.dnscontrol.org/language-reference/domain-modifiers/service-provider-specific/amazon-route-53/r53_alias
  */
-declare function R53_ALIAS(name: string, target: string, zone_idModifier: DomainModifier & RecordModifier, evaluatetargethealthModifier: RecordModifier): DomainModifier;
+declare function R53_ALIAS(name: string, type: "SOA" | "A" | "TXT" | "CNAME" | "MX" | "NAPTR" | "PTR" | "SRV" | "SPF" | "AAAA" | "CAA" | "DS" | "TLSA" | "SSHFP" | "SVCB" | "HTTPS", target: string, ...modifiers: RecordModifier[]): DomainModifier;
 
 /**
  * `R53_EVALUATE_TARGET_HEALTH` lets you enable target health evaluation for a [`R53_ALIAS()`](../domain-modifiers/R53_ALIAS.md) record. Omitting `R53_EVALUATE_TARGET_HEALTH()` from `R53_ALIAS()` set the behavior to false.