diff --git a/agenix/hosts/argon/cfdyndns/apiToken.age b/agenix/hosts/argon/cfdyndns/apiToken.age
new file mode 100644
index 0000000..946f157
--- /dev/null
+++ b/agenix/hosts/argon/cfdyndns/apiToken.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 MtGp6g /DLwiLhRRDFSIal3aCmcedgK4K/5SIiiCw190YZwoUU
+etUNg5IVs3GnEUAy8CxKKaL317ZbdN9kUQ/H7zcpv5c
+-> ssh-ed25519 1fcLUQ LQAjiINwW1SeiDWbmjmlvaqLT7IDpY98Md607ExXfEI
+ByMQ5vF4A4BL8YtPUzLr4+0FBcyMaXYKNKleppMZ/4w
+--- h4IafmgjN7lxUBzJhadHNtfobrbiyOrprqEXbAZ/1jA
+p �r��8B��)�a����9�ٽ�m-�#�v�Xx�#F,<C��m]!�q�.%$��:�֢3&X�8G�
\ No newline at end of file
diff --git a/agenix/hosts/argon/config.nix b/agenix/hosts/argon/config.nix
index c8c73d3..2d28c68 100644
--- a/agenix/hosts/argon/config.nix
+++ b/agenix/hosts/argon/config.nix
@@ -10,6 +10,10 @@
       group = "acme";
     };
 
+    cfdyndns-api-token = {
+      file = ./cfdyndns/apiToken.age;
+    };
+
     tailscale-authkey = {
       file = ./tailscale/authkey.age;
     };
diff --git a/secret/hosts/argon.nix b/secret/hosts/argon.nix
index abeec16..218f1ca 100644
Binary files a/secret/hosts/argon.nix and b/secret/hosts/argon.nix differ
diff --git a/secrets.nix b/secrets.nix
index 3c72aa6..277ef82 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -92,6 +92,8 @@ in
 
   "agenix/hosts/argon/acme/credentials.age".publicKeys = argon;
 
+  "agenix/hosts/argon/cfdyndns/apiToken.age".publicKeys = argon;
+
   "agenix/hosts/argon/forgejo-actions/token.age".publicKeys = argon;
 
   "agenix/hosts/argon/tailscale/authkey.age".publicKeys = argon;
diff --git a/system/hosts/argon.nix b/system/hosts/argon.nix
index 7f1d379..5a22b62 100644
--- a/system/hosts/argon.nix
+++ b/system/hosts/argon.nix
@@ -20,6 +20,7 @@ in
     ../nixos/nginx-argon.nix
 
     (import ../nixos/adguardhome.nix (args // { inherit secret; }))
+    (import ../nixos/cfdyndns.nix (args // { inherit secret; }))
 
     ../nixos/attic.nix
 
diff --git a/system/nixos/cfdyndns.nix b/system/nixos/cfdyndns.nix
new file mode 100644
index 0000000..76c18d1
--- /dev/null
+++ b/system/nixos/cfdyndns.nix
@@ -0,0 +1,9 @@
+{ config, secret, ... }:
+
+{
+  services.cfdyndns = {
+    enable = true;
+    inherit (secret.cfdyndns) email records;
+    apiTokenFile = config.age.secrets.cfdyndns-api-token.path;
+  };
+}