diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0f3d6cf..f58926d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.0.12] - 2026-05-07
+
+### Added
+
+- `--existing-n <N>` index offset flag in `scripts/setup/dns-ingresses.sh` and `scripts/setup/dns-httproutes.sh`, so additional batches can be appended without colliding with existing `test-{i}.{domain}` hostnames (objects are numbered `(existing-n+1)..(existing-n+count)`)
+
+### Changed
+
+- Setup DNS scripts now stream the generated multi-document YAML to a unique `mktemp -t dns-{ingresses,httproutes}.XXXXXX.yaml` file under `$TMPDIR` and apply it with a single `kubectl apply --server-side -f`, instead of building the manifest in memory and piping it into `kubectl`
+
 ## [0.0.11] - 2026-04-23
 
 ### Added
diff --git a/CLAUDE.md b/CLAUDE.md
index eff20b5..580b41d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -121,7 +121,7 @@ The validation workflow runs on PRs to main. The `test-scenarios` job uses a mat
 
 ### DNS test scripts
 
-`scripts/setup/dns-ingresses.sh`, `scripts/setup/dns-httproutes.sh`, `scripts/cleanup/dns-ingresses.sh`, and `scripts/cleanup/dns-httproutes.sh` bulk-create or delete N `Ingress` / `HTTPRoute` resources (each with a unique `test-{i}.{domain}` hostname, all labeled `dns-test=true`) for external-DNS reconciliation testing in downstream telescope pipelines (app-routing-nginx, app-routing-istio). They are intentionally **not** wired into `master.sh` — that script remains RPS-focused. The httproutes setup script requires an existing parent `Gateway`; the ingresses setup script requires an existing backend `Service`. Defaults: namespace `default`, service/gateway `server`, port `8080`. Cleanup uses label selector `dns-test=true` with `--wait=false --ignore-not-found` and leaves the parent Gateway intact.
+`scripts/setup/dns-ingresses.sh`, `scripts/setup/dns-httproutes.sh`, `scripts/cleanup/dns-ingresses.sh`, and `scripts/cleanup/dns-httproutes.sh` bulk-create or delete N `Ingress` / `HTTPRoute` resources (each with a unique `test-{i}.{domain}` hostname, all labeled `dns-test=true`) for external-DNS reconciliation testing in downstream telescope pipelines (app-routing-nginx, app-routing-istio). They are intentionally **not** wired into `master.sh` — that script remains RPS-focused. The httproutes setup script requires an existing parent `Gateway`; the ingresses setup script requires an existing backend `Service`. Defaults: namespace `default`, service/gateway `server`, port `8080`. Setup scripts accept `--existing-n <N>` to offset the index range (objects are numbered `(existing-n+1)..(existing-n+count)`) so additional batches can be appended without colliding with existing hostnames. Setup scripts stream the generated multi-document YAML to a unique `mktemp` file under `$TMPDIR` (path printed at the top of the run) and apply it with a single `kubectl apply --server-side -f`. Cleanup uses label selector `dns-test=true` with `--wait=false --ignore-not-found` and leaves the parent Gateway intact.
 
 ## Conventions
 
diff --git a/README.md b/README.md
index 70c4032..a281475 100644
--- a/README.md
+++ b/README.md
@@ -115,6 +115,8 @@ docker run <image> setup/ingress --ingress-class nginx --replica-count 3
 # Bulk-create dns-test Ingresses or HTTPRoutes (for external-DNS testing)
 docker run <image> setup/dns-ingresses --count 100 --domain extdns.telescope.test
 docker run <image> setup/dns-httproutes --count 100 --domain extdns.telescope.test
+# Append a second batch of 100 starting at index 101 (no hostname collisions)
+docker run <image> setup/dns-ingresses --count 100 --existing-n 100 --domain extdns.telescope.test
 docker run <image> cleanup/dns-ingresses
 docker run <image> cleanup/dns-httproutes
 
@@ -159,7 +161,7 @@ Note: all modules expect to be **run from the root directory of this project**.
 - `/install` — traffic controller install scripts (`nginx.sh`, `istio.sh`)
 - `/setup` — server deployment scripts with readiness checks (`ingress.sh`, `gateway.sh`)
 - `/scenarios` — load test scenario scripts. These assume the cluster, traffic controller, and server are already running. Their output is JSON so that consumers can decide on the final display format themselves.
-- `/setup/dns-ingresses.sh`, `/setup/dns-httproutes.sh` — bulk-create N `Ingress` or Gateway API `HTTPRoute` resources (each with a unique `test-{i}.{domain}` hostname, all labeled `dns-test=true`) for external-DNS reconciliation testing. Paired with `/cleanup/dns-ingresses.sh` and `/cleanup/dns-httproutes.sh`, which delete by label.
+- `/setup/dns-ingresses.sh`, `/setup/dns-httproutes.sh` — bulk-create N `Ingress` or Gateway API `HTTPRoute` resources (each with a unique `test-{i}.{domain}` hostname, all labeled `dns-test=true`) for external-DNS reconciliation testing. Use `--existing-n <N>` to offset the index range so additional batches can be appended without colliding with existing hostnames. The generated manifest is written to a unique `mktemp` file under `$TMPDIR` and applied with a single `kubectl apply --server-side -f`. Paired with `/cleanup/dns-ingresses.sh` and `/cleanup/dns-httproutes.sh`, which delete by label.
 
 ### /server