diff --git a/AGENTS.md b/AGENTS.md
index 1942fcd..7131cae 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -560,6 +560,8 @@ Estado atual:
 - `secrets/matrix_android_firebase_service_account.age`
 - `secrets/matrix_android_google_services.age`
 - `secrets/matrix_android_commander_credentials.age`
+- `secrets/cloudflare_worker_api_token.age`
+- `secrets/cloudflare_dns_api_token.age`
 - `secrets/minecraft_rcon_password.age`
 - `secrets/wireguard_private_key.age`
 
@@ -593,6 +595,14 @@ Estado atual:
 - O helper `matrix-android-secrets [project-dir]` cria symlinks desses tres arquivos para `/run/agenix`; por default usa o diretorio atual.
 - Nao migre `local.properties`, debug keystores, `.gradle`, `.wrangler` ou caches locais do `matrix-android` para este repo sem um motivo explicito.
 
+### Cloudflare
+
+- `secrets/cloudflare_worker_api_token.age` contem um token para deploy de Workers no account local.
+- `secrets/cloudflare_dns_api_token.age` contem um token para DNS/Zone Read.
+- `cloudflare-worker-env <comando>` exporta `CLOUDFLARE_API_TOKEN` apenas para o comando filho usando o token de Workers.
+- `cloudflare-dns-env <comando>` exporta `CLOUDFLARE_API_TOKEN` apenas para o comando filho usando o token de DNS.
+- O token bootstrap usado para criar outros tokens e temporario; nao mantenha `cloudflare_bootstrap_api_token.age` no repo depois de revogar o token na Cloudflare.
+
 ## Dependencias implicitas e pontos de atencao
 
 Itens que um agente deve verificar antes de mexer:
diff --git a/hosts/Nixos/configuration.nix b/hosts/Nixos/configuration.nix
index 77fc2d1..fd912ec 100644
--- a/hosts/Nixos/configuration.nix
+++ b/hosts/Nixos/configuration.nix
@@ -77,6 +77,27 @@ let
     link_secret /run/agenix/matrix_android_google_services "$project_dir/app/google-services.json"
     link_secret /run/agenix/matrix_android_commander_credentials "$project_dir/.mc/credentials.json"
   '';
+  cloudflareEnv = name: secret: pkgs.writeShellScriptBin name ''
+    set -eu
+
+    secret_path=/run/agenix/${secret}
+    if [ ! -r "$secret_path" ]; then
+      echo "Missing readable Cloudflare token: $secret_path" >&2
+      exit 1
+    fi
+
+    export CLOUDFLARE_API_TOKEN="$(${pkgs.coreutils}/bin/cat "$secret_path")"
+
+    if [ "$#" -eq 0 ]; then
+      echo "Cloudflare API token environment is ready."
+      exit 0
+    fi
+
+    exec "$@"
+  '';
+  cloudflareWorkerEnv =
+    cloudflareEnv "cloudflare-worker-env" "cloudflare_worker_api_token";
+  cloudflareDnsEnv = cloudflareEnv "cloudflare-dns-env" "cloudflare_dns_api_token";
   haAirConditioner = "climate.ar";
   haLaundryDryingToggle = "input_boolean.secar_roupas";
   haClimateAction = action: data: {
@@ -297,6 +318,22 @@ in {
           mode = "0400";
         };
       } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/cloudflare_worker_api_token.age) {
+        cloudflare_worker_api_token = {
+          file = ../../secrets/cloudflare_worker_api_token.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/cloudflare_dns_api_token.age) {
+        cloudflare_dns_api_token = {
+          file = ../../secrets/cloudflare_dns_api_token.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
       (builtins.pathExists ../../secrets/minecraft_rcon_password.age) {
         minecraft_rcon_password.file =
           ../../secrets/minecraft_rcon_password.age;
@@ -1499,6 +1536,8 @@ in {
     fishPlugins.z
     androidSigningEnv
     matrixAndroidSecrets
+    cloudflareWorkerEnv
+    cloudflareDnsEnv
   ];
 
   # environment.loginShellInit = ''
diff --git a/secrets/cloudflare_dns_api_token.age b/secrets/cloudflare_dns_api_token.age
new file mode 100644
index 0000000..bae5877
Binary files /dev/null and b/secrets/cloudflare_dns_api_token.age differ
diff --git a/secrets/cloudflare_worker_api_token.age b/secrets/cloudflare_worker_api_token.age
new file mode 100644
index 0000000..cdd3f98
Binary files /dev/null and b/secrets/cloudflare_worker_api_token.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index cd93163..c3ae664 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -16,7 +16,8 @@ in {
   "secrets/matrix_android_firebase_service_account.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/matrix_android_google_services.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/matrix_android_commander_credentials.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
-  "secrets/cloudflare_bootstrap_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/cloudflare_worker_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/cloudflare_dns_api_token.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/minecraft_rcon_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/wireguard_private_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];