diff --git a/terraform/main.tf b/terraform/main.tf
index 3670b89..8d9b1b4 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -51,6 +51,10 @@ resource "local_file" "controlplane_configs" {
     zone                = each.value.zone
     allow_scheduling    = each.value.allow_scheduling
 
+    # Cloudflare Tunnel cert SANs (talos :50000 and kube-apiserver :6443)
+    cloudflare_talos_sans     = each.value.cloudflare_talos_sans
+    cloudflare_apiserver_sans = each.value.cloudflare_apiserver_sans
+
     # Cluster config
     cluster_id      = var.cluster_id
     cluster_secret  = var.cluster_secret
diff --git a/terraform/templates/controlplane.tftpl b/terraform/templates/controlplane.tftpl
index 5dbcdaf..170cd4b 100644
--- a/terraform/templates/controlplane.tftpl
+++ b/terraform/templates/controlplane.tftpl
@@ -13,6 +13,9 @@ machine:
 %{ if wg0_ip != null ~}
     - ${wg0_ip}
 %{ endif ~}
+%{ for san in cloudflare_talos_sans ~}
+    - ${san}
+%{ endfor ~}
   network:
     hostname: ${hostname}
     interfaces:
@@ -145,6 +148,9 @@ cluster:
       - ${wg0_ip}
 %{ endif ~}
       - ${lan_ip}
+%{ for san in cloudflare_apiserver_sans ~}
+      - ${san}
+%{ endfor ~}
     image: ${kube_apiserver_img}
     admissionControl:
       - name: PodSecurity
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 1e18da5..68dee00 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -130,6 +130,10 @@ variable "controlplane_configs" {
     }))
     zone             = string
     allow_scheduling = bool
+    # Extra cert SANs for this node — e.g. Cloudflare Tunnel public hostnames so
+    # remote talosctl/kubectl over the tunnel pass TLS verification.
+    cloudflare_talos_sans     = optional(list(string), [])
+    cloudflare_apiserver_sans = optional(list(string), [])
   }))
   description = "Control plane machine configurations, keyed by node"
 }