diff --git a/java/google/registry/tools/CreateCdnsTld.java b/java/google/registry/tools/CreateCdnsTld.java
index 27b156920..58f35d89e 100644
--- a/java/google/registry/tools/CreateCdnsTld.java
+++ b/java/google/registry/tools/CreateCdnsTld.java
@@ -66,8 +66,10 @@ class CreateCdnsTld extends ConfirmingCommand {
     managedZone =
         new ManagedZone()
             .setDescription(description)
-            // TODO(b/67413698): allow parameterizing the nameserver set once it's safe to do so.
-            .setNameServerSet("cloud-dns-registry-test")
+            .setNameServerSet(
+                RegistryToolEnvironment.get() == RegistryToolEnvironment.PRODUCTION
+                ? "cloud-dns-registry"
+                : "cloud-dns-registry-test")
             .setDnsName(dnsName)
             .setName((name != null) ? name : dnsName)
             .setDnssecConfig(new ManagedZoneDnsSecConfig().setNonExistence("NSEC").setState("ON"));