diff --git a/flake.lock b/flake.lock
index 1b749a6..b327706 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1329,11 +1329,11 @@
         "tailwindcss-animated-src": "tailwindcss-animated-src"
       },
       "locked": {
-        "lastModified": 1787877278,
-        "narHash": "sha256-/5NUr8NU1zUySrAYrfsQ9RBJ/xFVaEMzmcHp3TXumUQ=",
+        "lastModified": 1788091139,
+        "narHash": "sha256-sHgNBF0maWA2LJNfs7AZd+IUF4LeBh+p5Bzd76b93tU=",
         "ref": "refs/heads/master",
-        "rev": "f5e00a1676782f254bcaf279a5b016992d38bc1b",
-        "revCount": 3167,
+        "rev": "681b358acc7a9d21ad1d2c1961c7eacba6943abd",
+        "revCount": 3176,
         "type": "git",
         "url": "https://knot1.tangled.sh/tangled.org/core"
       },
diff --git a/flake.nix b/flake.nix
index 9893ec6..e30ecd7 100644
--- a/flake.nix
+++ b/flake.nix
@@ -124,6 +124,7 @@
 
       hyd-eu-1 = {
         modules = [
+          ./hosts/hyd-eu-1/services/cloudflared.nix
           ./hosts/hyd-eu-1/services/hydrant.nix
           ./hosts/hyd-eu-1/services/nginx.nix
         ];
diff --git a/hosts/hyd-eu-1/services/cloudflared.nix b/hosts/hyd-eu-1/services/cloudflared.nix
new file mode 100644
index 0000000..c559a7c
--- /dev/null
+++ b/hosts/hyd-eu-1/services/cloudflared.nix
@@ -0,0 +1,38 @@
+{pkgs, ...}: {
+  systemd.services.cloudflared-hyd-eu-1 = {
+    description = "Cloudflare Tunnel connector for hyd-eu-1";
+    wantedBy = ["multi-user.target"];
+    wants = ["network-online.target" "hydrant.service"];
+    after = ["network-online.target" "hydrant.service"];
+
+    serviceConfig = {
+      Type = "simple";
+      LoadCredential = ["token:/etc/secrets/cloudflared-hyd-eu-1.token"];
+      ExecStart = "${pkgs.cloudflared}/bin/cloudflared tunnel --no-autoupdate --protocol quic run --token-file %d/token";
+      Restart = "on-failure";
+      RestartSec = "5s";
+      DynamicUser = true;
+      NoNewPrivileges = true;
+      CapabilityBoundingSet = "";
+      DevicePolicy = "closed";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectSystem = "strict";
+      RestrictAddressFamilies = ["AF_INET" "AF_INET6"];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      UMask = "0077";
+    };
+  };
+}