diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4de1eaec..66717521 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,11 +11,13 @@ This version includes **multiple breaking changes**. If you are upgrading from v
 ## Changed
 
 ## Fixed
-- Do not include port number when constructing HTTP base URLs.
+- Reverse proxy issues.
 - OSS builds.
-- Cloudflare DNS updater: 
-  - Fix `CAA` record updates.
-  - Check zone subdomains when finding zones
+- DNS Updater:
+  - RFC2136: TSIG secret not base64 decoded.
+  - Cloudflare: 
+    - Fix `CAA` record updates.
+    - Check zone subdomains when finding zones
 
 
 ## [0.16.0] - 2026-04-20
diff --git a/crates/common/src/network/dns/update.rs b/crates/common/src/network/dns/update.rs
index 27d7d202..eb233d52 100644
--- a/crates/common/src/network/dns/update.rs
+++ b/crates/common/src/network/dns/update.rs
@@ -5,6 +5,7 @@
  */
 
 use crate::{Core, Server};
+use base64::{Engine, engine::general_purpose};
 use dns_update::{
     Algorithm, DnsRecord, DnsRecordType, TsigAlgorithm,
     dnssec::{
@@ -61,7 +62,9 @@ impl DnsUpdater {
                         )),
                     },
                     server.key_name,
-                    server.key.secret().await?.into_owned().into_bytes(),
+                    general_purpose::STANDARD
+                        .decode(server.key.secret().await?.as_bytes())
+                        .map_err(|err| format!("Failed to base64 decode TSIG key: {err}"))?,
                     match server.tsig_algorithm {
                         enums::TsigAlgorithm::HmacMd5 => TsigAlgorithm::HmacMd5,
                         enums::TsigAlgorithm::Gss => TsigAlgorithm::Gss,