diff --git a/cdn.tf b/cdn.tf
index 8a950f5..fe1b25f 100644
--- a/cdn.tf
+++ b/cdn.tf
@@ -52,6 +52,29 @@
 
 ### cran.rpkgs.com
 
+# The edge middleware that resolves the bare cran.rpkgs.com form to an
+# <arch>/<os> slot and routes PACKAGES* to the per-R-minor slot. The source of
+# truth is edge/rpkgs-router.ts; `tofu apply` publishes a new release.
+#
+# The script pre-dates this configuration, so it is adopted rather than created:
+#   tofu import bunnynet_compute_script.rpkgs_router 29277
+resource "bunnynet_compute_script" "rpkgs_router" {
+  type    = "middleware"
+  name    = "rpkgs-router"
+  content = file("${path.module}/edge/rpkgs-router.ts")
+}
+
+# Slots ("<arch>/<os>", comma separated) whose per-minor index bincraft has
+# already republished as a union of the per-minor and flat slots. Routing to a
+# slot that is not listed here would hide every package the per-minor index does
+# not carry, so this stays empty until a slot has been backfilled.
+resource "bunnynet_compute_script_variable" "rpkgs_router_union_slots" {
+  script        = bunnynet_compute_script.rpkgs_router.id
+  name          = "UNION_SLOTS"
+  default_value = ""
+  required      = false
+}
+
 resource "bunnynet_pullzone" "cran_rpkgs_com" {
   name = "cran-rpkgs"
 
@@ -64,7 +87,7 @@ resource "bunnynet_pullzone" "cran_rpkgs_com" {
   origin {
     type              = "OriginUrl"
     url               = "https://devxy-rpkgs-binaries.s3.eu-central-003.backblazeb2.com"
-    middleware_script = 29277
+    middleware_script = bunnynet_compute_script.rpkgs_router.id
   }
 
   routing {