diff --git a/.github/workflows/terraform-apply.yml b/.github/workflows/terraform-apply.yml
index d0ba45c..c9dc3ea 100644
--- a/.github/workflows/terraform-apply.yml
+++ b/.github/workflows/terraform-apply.yml
@@ -49,11 +49,8 @@ on:
       aws-role-arn:
         description: 'IAM role ARN to assume via GitHub OIDC'
         required: true
-      cloudflare-api-key:
-        description: 'Cloudflare Global API Key (optional; required only when the terraform uses the Cloudflare provider)'
-        required: false
-      cloudflare-email:
-        description: 'Cloudflare API Email (optional; required only when the terraform uses the Cloudflare provider)'
+      cloudflare-api-token:
+        description: 'Scoped Cloudflare API token (optional; required only when Terraform uses Cloudflare)'
         required: false
     outputs:
       applied:
@@ -74,8 +71,7 @@ jobs:
       run:
         working-directory: ${{ inputs.terraform-path }}
     env:
-      CLOUDFLARE_API_KEY: ${{ secrets.cloudflare-api-key }}
-      CLOUDFLARE_EMAIL: ${{ secrets.cloudflare-email }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.cloudflare-api-token }}
     outputs:
       applied: ${{ steps.apply.outputs.applied }}
     steps:
diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml
index 97529aa..a56f438 100644
--- a/.github/workflows/terraform-plan.yml
+++ b/.github/workflows/terraform-plan.yml
@@ -68,11 +68,8 @@ on:
       infracost-api-key:
         description: 'Infracost API key (only used when cost-estimation=true)'
         required: false
-      cloudflare-api-key:
-        description: 'Cloudflare Global API Key (optional; required only when the terraform uses the Cloudflare provider)'
-        required: false
-      cloudflare-email:
-        description: 'Cloudflare API Email (optional; required only when the terraform uses the Cloudflare provider)'
+      cloudflare-api-token:
+        description: 'Scoped Cloudflare API token (optional; required only when Terraform uses Cloudflare)'
         required: false
     outputs:
       has-changes:
@@ -102,8 +99,7 @@ jobs:
         working-directory: ${{ inputs.terraform-path }}
     env:
       AWS_ROLE_ARN: ${{ secrets.aws-role-arn }}
-      CLOUDFLARE_API_KEY: ${{ secrets.cloudflare-api-key }}
-      CLOUDFLARE_EMAIL: ${{ secrets.cloudflare-email }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.cloudflare-api-token }}
     outputs:
       has-changes: ${{ steps.plan.outputs.has-changes }}
       destroy-count: ${{ steps.analyze.outputs.destroy-count }}