diff --git a/modules/homelab/network/caddy/default.nix b/modules/homelab/network/caddy/default.nix
index 691c350..d07cddb 100644
--- a/modules/homelab/network/caddy/default.nix
+++ b/modules/homelab/network/caddy/default.nix
@@ -54,11 +54,24 @@ in {
       user = service;
       group = service;
       dataDir = cfg.data_dir;
+      package = pkgs.caddy.withPlugins {
+        plugins = [
+          "github.com/caddy-dns/cloudflare"
+        ];
+        hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+        # Replace with the hash from the build error the first time you build.
+      };
       email = "me@blakedheld.xyz";
       globalConfig = ''
         auto_https ignore_loaded_certs
+        acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
       '';
 
+      # make cloudflare token readable
+      systemd.services.caddy.serviceConfig = {
+        EnvironmentFile = sec."cloudflare/api_token_caddy".path;
+      };
+
       # static page for hosting key files
       virtualHosts = {
         "keys.${homelab.base_domain}" = lib.mkIf cfg.keys {
@@ -97,6 +110,10 @@ in {
         group = "caddy";
         path = "/etc/ssl/blakedheld.xyz.key";
       };
+      "cloudflare/api_token_caddy" = {
+        owner = "caddy";
+        group = "caddy";
+      };
       "klefki_pub.asc" = {
         owner = "caddy";
         group = "caddy";
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index a8d7426..56575d6 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -11,6 +11,7 @@ lifeboat_rsync: ENC[AES256_GCM,data:OaijbFFpu8RM3gcWu2XbAHeuUhTIjFNO8aYcA8TJmNxM
 #ENC[AES256_GCM,data:NbXyRroLF2uxHjROnBg9OLQ=,iv:W9Nse9yamov3rflDKBeISO+miQkjH7QfBUZdsDmDM4I=,tag:/RmH3JyriXFxf0hEh9/iRQ==,type:comment]
 cloudflare:
     api_token: ENC[AES256_GCM,data:VuRwfZe1cdnQLvxlp9GCDOt9Ijhz4fh2yOev2wLOdLV+zw91blA3Zis2BRyI/ZwN4y+IhiqlpBzXCsoFqw==,iv:6Bt11zz1/slvszh9ZGQ0ov5ts0jAZIAMx3G2AimKIs4=,tag:tyEVhsKCGrJWm6yn+GUlUQ==,type:str]
+    api_token_caddy: ENC[AES256_GCM,data:L1PMeI4zOCPbWuWrczM1aSYl/qk/MW8xLtxr/PL+a3zfDA+USP8Yw4liYnn1qwTxs+oLMHhpBR58kHPr8Q==,iv:NNVBPANwQ9koAKTQD4ikhtwFjCpMLMXEm9scj9jIDFo=,tag:SXt1Y+04BuSsjDhu5ykwLA==,type:str]
 #ENC[AES256_GCM,data:3Nnp9ASh+BPPwSOa+Xx3YEqKnh48oW6sWCQCXy9iZ61qGv9Ubjeaccr+Bh0bD9s=,iv:LwbptKdbhO2yki2BIK+6uPMqe14FNC4EcIwO6HS5xAc=,tag:38P0kwfAFVEps6MnMU8XeA==,type:comment]
 email_pass: ENC[AES256_GCM,data:T4heTFuvD3rUJUInDpJnIhwECw==,iv:uDOk6FKtfYjedE/I3zh9Tl7QuYz/OBe/3tlrTitf2DY=,tag:a80RoPPHMSETAbk5pqGfiQ==,type:str]
 #ENC[AES256_GCM,data:ztRwuY0mTMDmwV5HqVR7Dmc+dCWcrVRtWZGEL1abE/WUcA==,iv:mmaWfHRiENJUGNhyUBFo1z7PdzVPH1OUZrVhkce6KV0=,tag:GKEvT0qkzTtimQXDueKPdw==,type:comment]
@@ -83,7 +84,7 @@ sops:
             PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14gfh682a7m7jfp3qrulql03x5rs7yedwmxwksxrrmgjsunstyuksqx93pz
-    lastmodified: "2026-06-22T20:37:37Z"
-    mac: ENC[AES256_GCM,data:UQOsQF+ixV+B9dWFySz8osRV24clDTvyI4niCnwU2LWVMlW6XSTkAyKxyLHoEl9aCOgJ4hCEuNXu7IWBWY2a4padtILs4I//K6+JhWb/++53JMjtZ8K+QzdvhcPL1632ANnXZlJLzW/h6nLD2Zoa9hemaTD9ybffXBDF1sVGij4=,iv:R7cr3V3KS63F8XYgbGKvFZhC4558LN4dnGqDn0zM/bo=,tag:mRTvPIiyRHTV36RymZ2ZZQ==,type:str]
+    lastmodified: "2026-07-28T14:33:14Z"
+    mac: ENC[AES256_GCM,data:bEcpoMFzXbK4WCs94Y4I5CDo9JDC4/6iRMfgc41m1o8/qJhKyJUWWZcPhJSaRSituTYyPjSe8aB6k2Vwpgcd+hk41JC2Op09mnjBWfDQz6Ts0YbZAnZ/dV4IrzdxYRtM91EXmJnROeiTftGgYN/6Awa8I+ie3UFBl8u6/5UoD7o=,iv:MIhnNS9RGFWKJ0LI7Ae9gTEcGzfKwQB4bg4oSAs8/Go=,tag:W/zfVpxn+sRa+FOrR9fKyA==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.2