diff --git a/.env.sample b/.env.sample
index 304f3d1..8e84b0c 100644
--- a/.env.sample
+++ b/.env.sample
@@ -25,3 +25,6 @@ ENABLE_DERP=false
 # See https://git.coopcloud.tech/coop-cloud/backup-bot-two
 ENABLE_BACKUPS=true
 
+## allow cron updater
+#COMPOSE_FILE="$COMPOSE_FILE:compose.dns.yml"
+#DNS_REPO=owner/repo
\ No newline at end of file
diff --git a/abra.sh b/abra.sh
index 048c100..c212437 100755
--- a/abra.sh
+++ b/abra.sh
@@ -1,3 +1,5 @@
 # Set any config versions here
 # Docs: https://docs.coopcloud.tech/maintainers/handbook/#manage-configs
-export CONFIG_YAML_VERSION=v4
+export CONFIG_YAML_VERSION=v5
+export EXTRA_RECORDS_VERSION=v1
+export DNS_DOWNLOADER_VERSION=v1
diff --git a/compose.dns.yml b/compose.dns.yml
new file mode 100644
index 0000000..0e3bf0d
--- /dev/null
+++ b/compose.dns.yml
@@ -0,0 +1,24 @@
+---
+services:
+  cron:
+    image: alpine:3.23.3
+    volumes:
+      - data:/data
+    configs:
+      - source: extra_dns_downloader
+        target: /entrypoint.sh
+    entrypoint: ["/entrypoint.sh"]
+    deploy:
+      mode: replicated
+      replicas: 0
+      labels:
+        - "swarm.cronjob.enable=true"
+        - "swarm.cronjob.schedule=0 * * * *"
+      restart_policy:
+        condition: none
+
+configs:
+  extra_dns_downloader:
+    name: ${STACK_NAME}_dns_downloader_${DNS_DOWNLOADER_VERSION}
+    file: extra-downloader.sh
+    template_driver: golang
diff --git a/compose.yml b/compose.yml
index d4b745d..6b95902 100644
--- a/compose.yml
+++ b/compose.yml
@@ -11,6 +11,8 @@ services:
     configs:
       - source: config_yaml
         target: /etc/headscale/config.yaml
+      - source: extra_dns_records
+        target: /var/lib/headscale/extra-records.json
     deploy:
       restart_policy:
         condition: on-failure
@@ -43,6 +45,7 @@ services:
     networks:
       - proxy
 
+
 networks:
   proxy:
     external: true
@@ -55,3 +58,7 @@ configs:
     name: ${STACK_NAME}_config_yaml_${CONFIG_YAML_VERSION}
     file: config.yaml.tmpl
     template_driver: golang
+  extra_dns_records:
+    name: ${STACK_NAME}_extra_records_${EXTRA_RECORDS_VERSION}
+    file: extra-records.json
+
diff --git a/config.yaml.tmpl b/config.yaml.tmpl
index 24c0da2..68cca40 100644
--- a/config.yaml.tmpl
+++ b/config.yaml.tmpl
@@ -308,7 +308,7 @@ dns:
   # Extra DNS records
   # so far only A and AAAA records are supported (on the tailscale side)
   # See: docs/ref/dns.md
-  extra_records: []
+  # extra_records: []
   #   - name: "grafana.myvpn.example.com"
   #     type: "A"
   #     value: "100.64.0.3"
@@ -318,7 +318,7 @@ dns:
   #
   # Alternatively, extra DNS records can be loaded from a JSON file.
   # Headscale processes this file on each change.
-  # extra_records_path: /var/lib/headscale/extra-records.json
+  extra_records_path: /var/lib/headscale/extra-records.json
 
 # Unix socket used for the CLI to connect without authentication
 # Note: for production you will want to set this to something like:
diff --git a/extra-downloader.sh b/extra-downloader.sh
new file mode 100755
index 0000000..477a121
--- /dev/null
+++ b/extra-downloader.sh
@@ -0,0 +1,6 @@
+apk add --no-cache --quiet wget
+apk add --no-cache --quiet curl
+apk add --no-cache --quiet jq
+
+version=$(curl https://git.coopcloud.tech/api/v1/repos/{{ env "DNS_REPO" }}/tags | jq -r '.[0].name')
+wget https://git.coopcloud.tech/{{ env "DNS_REPO" }}/raw/tag/$version/headscale-records.json -O /data/extra-records.json
diff --git a/extra-records.json b/extra-records.json
new file mode 100644
index 0000000..fe51488
--- /dev/null
+++ b/extra-records.json
@@ -0,0 +1 @@
+[]