diff --git a/README.md b/README.md
index a75ab7a..778e404 100644
--- a/README.md
+++ b/README.md
@@ -38,6 +38,7 @@ No modules.
 | [cloudflare_zero_trust_access_application.k3s](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource |
 | [cloudflare_zero_trust_access_application.mcp_gateway](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource |
 | [cloudflare_zero_trust_access_application.mcp_gateway_backend](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource |
+| [cloudflare_zero_trust_access_application.openclaw](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource |
 | [cloudflare_zero_trust_access_application.warp](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource |
 | [cloudflare_zero_trust_access_group.admins](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_group) | resource |
 | [cloudflare_zero_trust_access_identity_provider.github](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_identity_provider) | resource |
diff --git a/cf-access-openclaw.tf b/cf-access-openclaw.tf
new file mode 100644
index 0000000..fe9bba4
--- /dev/null
+++ b/cf-access-openclaw.tf
@@ -0,0 +1,24 @@
+resource "cloudflare_zero_trust_access_application" "openclaw" {
+  account_id       = local.account_id
+  name             = "OpenClaw"
+  type             = "self_hosted"
+  domain           = "openclaw.makeitwork.cloud"
+  session_duration = "24h"
+
+  allowed_idps = [
+    cloudflare_zero_trust_access_identity_provider.github.id,
+  ]
+
+  policies = [
+    {
+      name             = "makeitworkcloud-admins"
+      decision         = "allow"
+      session_duration = "24h"
+      include = [{
+        group = {
+          id = cloudflare_zero_trust_access_group.admins.id
+        }
+      }]
+    }
+  ]
+}