diff --git a/dns/README.md b/dns/README.md
index ebab34a..a84a277 100644
--- a/dns/README.md
+++ b/dns/README.md
@@ -5,8 +5,17 @@ DNSControl configuration for the Cloudflare zones. One directory per zone, each
 - `rubyci.org/` — the CI hosts. Every rubyci host is resolved through DNS rather than `~/.ssh/config`, so a new host needs its record here before `bin/hocho apply`. The apex uses Cloudflare's CNAME flattening, which DNSControl expresses as `ALIAS`.
 - `ruby-lang.org/` — the project zone.
 
+## Credentials
+
 The API tokens are zone-scoped and therefore different per zone, so each `creds.json` reads an environment variable named after its zone. `rubyci.org/creds.json` reads `CLOUDFLARE_API_TOKEN_RUBYCI` and `ruby-lang.org/creds.json` reads `CLOUDFLARE_API_TOKEN_RUBY_LANG_ORG`.
 
+No token is stored here, so that variable has to be in the environment before `dnscontrol` runs. Export it, or inject it from whichever secret store holds it. With 1Password, wrap the commands below in `op run` with the env file for the zone:
+
+```
+cd dns/rubyci.org
+op run --env-file ~/.config/credentials/cloudflare-rubyci.org.env -- dnscontrol preview --creds creds.json
+```
+
 ## rubyci.org
 
 Applied from CI by `.github/workflows/dns.yml`: a pull request runs `dnscontrol preview`, and merging to `master` runs `dnscontrol push`. The token comes from the repository secret `CLOUDFLARE_API_TOKEN_RUBYCI`.
@@ -14,7 +23,6 @@ Applied from CI by `.github/workflows/dns.yml`: a pull request runs `dnscontrol
 To preview locally:
 
 ```
-source ~/.config/cloudflare/rubyci.org/token.sh
 cd dns/rubyci.org
 dnscontrol preview --creds creds.json
 ```
@@ -24,7 +32,6 @@ dnscontrol preview --creds creds.json
 Not applied from CI. The zone is shared with other maintainers, so `push` is run by hand after the change is reviewed:
 
 ```
-source ~/.config/cloudflare/ruby-lang.org/token.sh
 cd dns/ruby-lang.org
 dnscontrol preview --creds creds.json
 dnscontrol push --creds creds.json
diff --git a/dns/rubyci.org/dnsconfig.js b/dns/rubyci.org/dnsconfig.js
index 8207d66..68e1bd2 100644
--- a/dns/rubyci.org/dnsconfig.js
+++ b/dns/rubyci.org/dnsconfig.js
@@ -7,7 +7,6 @@ D("rubyci.org", REG_NONE,
 	A("amazon2023", "35.72.97.116"),
 	A("arch", "35.72.171.27"),
 	A("crossruby", "54.65.185.15"),
-	A("debian11", "54.178.164.239"),
 	A("debian12", "18.177.243.215"),
 	A("debian13", "35.72.238.43"),
 	A("debian", "35.73.95.28"),
diff --git a/hosts.yml b/hosts.yml
index d4be6a2..77f66ea 100644
--- a/hosts.yml
+++ b/hosts.yml
@@ -48,13 +48,6 @@ rhel8.rubyci.org:
     run_list:
       - recipes/default.rb
 
-debian11.rubyci.org:
-  properties:
-    nopasswd_sudo: true
-    compress: false
-    run_list:
-      - recipes/default.rb
-
 openbsd.rubyci.org:
   properties:
     attributes: