diff --git a/.github/workflows/opentofu.yml b/.github/workflows/opentofu.yml
index 7bc4169..20a96a7 100644
--- a/.github/workflows/opentofu.yml
+++ b/.github/workflows/opentofu.yml
@@ -38,6 +38,8 @@ on:
         required: false
       NAMECHEAP_API_KEY:
         required: false
+      CLOUDFLARE_API_TOKEN:
+        required: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -202,6 +204,7 @@ jobs:
         id: plan
         env:
           NAMECHEAP_API_KEY: ${{ secrets.NAMECHEAP_API_KEY }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
         run: |
           set -o pipefail
           export SHELLOPTS
@@ -289,4 +292,5 @@ jobs:
       - name: OpenTofu Apply
         env:
           NAMECHEAP_API_KEY: ${{ secrets.NAMECHEAP_API_KEY }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
         run: make apply
diff --git a/README.md b/README.md
index b421989..97ef7c3 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,21 @@ jobs:
 
 Do not add this mapping for consumers that do not use Namecheap.
 
+### Cloudflare
+
+Only repositories that manage Cloudflare resources should map their repository
+Actions secret into the reusable workflow secret:
+
+```yaml
+jobs:
+  opentofu:
+    uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
+    secrets:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+```
+
+Do not add this mapping for consumers that do not use Cloudflare.
+
 ## Available Workflows
 
 | Workflow | Description |