diff --git a/azure/README.md b/azure/README.md
index 681ff5c..53207ac 100644
--- a/azure/README.md
+++ b/azure/README.md
@@ -598,6 +598,12 @@ With it on you get the endpoint, the private DNS zone `privatelink.blob.core.win
 to this VNet, and the zone group that keeps the account's blob name resolving to the endpoint's
 address. All three go in the Network Watcher's resource group, beside the storage account.
 
+**The zone is shared, and that is deliberate.** Every landing pad in that resource group uses the
+one `privatelink.blob.core.windows.net`, because Azure resolves that name from a single zone and a
+second one would be ignored. Each pad adds its own link to it, named for the VNet and a hash of
+the VNet's id so two pads whose VNets share a name do not collide. If you already have that zone,
+this adopts it and changes none of its records. Nothing here ever deletes it.
+
 The subnet they need is separate, and it is carved as soon as you turn flow logs on, whether or
 not you ask for an endpoint. It takes the `/24` above the gateway range, it is empty until an
 endpoint lands in it, and Azure bills nothing for an empty subnet. The endpoint gets a subnet of
diff --git a/azure/arm/azuredeploy-flowlogs.json b/azure/arm/azuredeploy-flowlogs.json
index 0f901ee..316f9eb 100644
--- a/azure/arm/azuredeploy-flowlogs.json
+++ b/azure/arm/azuredeploy-flowlogs.json
@@ -52,7 +52,8 @@
     "storageAccountName": "[concat('flowlogs', uniqueString(parameters('vnetId')))]",
     "flowLogName": "[concat(last(split(parameters('vnetId'), '/')), '-', uniqueString(parameters('vnetId')))]",
     "privateEndpointName": "[concat(variables('storageAccountName'), '-pe')]",
-    "blobPrivateDnsZoneName": "privatelink.blob.core.windows.net"
+    "blobPrivateDnsZoneName": "privatelink.blob.core.windows.net",
+    "vnetLinkName": "[concat(last(split(parameters('vnetId'), '/')), '-', uniqueString(parameters('vnetId')))]"
   },
   "resources": [
     {
@@ -135,7 +136,7 @@
       "condition": "[parameters('createFlowLogPrivateEndpoint')]",
       "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
       "apiVersion": "2024-06-01",
-      "name": "[concat(variables('blobPrivateDnsZoneName'), '/', last(split(parameters('vnetId'), '/')))]",
+      "name": "[concat(variables('blobPrivateDnsZoneName'), '/', variables('vnetLinkName'))]",
       "location": "global",
       "dependsOn": [
         "[resourceId('Microsoft.Network/privateDnsZones', variables('blobPrivateDnsZoneName'))]"