diff --git a/secrets/cloudflare-api-tokens.age b/secrets/cloudflare-api-tokens.age
new file mode 100644
index 0000000..57e68b8
--- /dev/null
+++ b/secrets/cloudflare-api-tokens.age
@@ -0,0 +1,17 @@
+age-encryption.org/v1
+-> ssh-rsa /AagBw
+hD7PDjueXimBVI/rjcYxN77LHV2eGytKcUbmh17aSL1CNM+eriURFao3tj52Hiaz
+3VMB6FxWUk9kzgjMPvf5WZukuZ2WbpPH8xlDV+6ZH7e/IzmjIfx8Ny14Mr1IF/Rx
+TBiCIAM19/1/mR9MiIBW85bb+Bb/waWIZAgxW3N1RpqH5+vAVqx0iY3XRF5+0gOq
+blP3yEw3QaL6FuY0+a+d/TnCsrz2Gi1Rba9oCUmkzOP96TsJYdN58Ut6nrHFkURK
+mShL2xBMLmfA8Z5ep+D8ueyQbcYpeU3KHcIcRM6dRTwQKvWXAVkRt1nUGasKrO9Y
+oJT9BrcxjtqgF/xhHRjWpamjFSI3mlJnJNEbruddDwQUccrJOvEzvqZ7GK0WoFX2
+HmhdDOiocMGWFeBPAKlNtU3+QmtZvhvOIgbjKhNxmCt1A/qxfvRk7Y2IDIBo+CFo
+sKMrT1tCo4UYaJdZYl64XYNCQb3C2EfO7Exrq3d2urNidzUbr9OBx7CCI1nu375c
+Qol9Kr28fLtxRuSZlrqIe9vKVYyLDPznrRlh6TmgqmMLIW70Y8cZwMtT8L8sOkcm
+A8MoxpWFzK4BKo0Iqmw6eZ3nx/0LAzkz005ZEwrmi2W/XxOWJgBiaLmu7YwnoGq0
+gzwwvA5V5MT6Iy7FzkQpMi0h/H4MZ0mcbihKdPun85Q
+-> ssh-ed25519 +vdRnA 23Gviu8hfWCEBPHP7xYIaOx34kFsxJJgJ/BNUDlb9Cg
+ROiMY2gw/rpNBmJnlRVb7Qhi5+8TY3Velj8gEZcaedI
+--- dhmvfQoCjuRUJtvXNI/eCjH0W+IeJm8bFRvYk1JihD0
+qMC�,݈�ԝ��9-\�K�J��]���J��(�Sn��.�Qp�~Z$�e�"�픒\��'rS�l��u�
+UD�<�Սv����]|
/g[�	W_��>-fl��8|w��ي�l�����B�[\��.k(W�{=w 3N}�qG�-w�Mb^��Q{
\ No newline at end of file
diff --git a/secrets/cloudflare-dyndns-api-token.age b/secrets/cloudflare-dyndns-api-token.age
index 57e68b8..6f09f52 100644
Binary files a/secrets/cloudflare-dyndns-api-token.age and b/secrets/cloudflare-dyndns-api-token.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 8724ce7..7b341b1 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -92,6 +92,10 @@ with keys.users;
     deltaflyer
     pike
   ];
+  "cloudflare-api-tokens.age".publicKeys = [
+    ccr-ssh
+    sisko
+  ];
   "cloudflare-dyndns-api-token.age".publicKeys = [
     ccr-ssh
     sisko