diff --git a/.env b/.env
index 213b32d3..e50a27e5 100644
--- a/.env
+++ b/.env
@@ -90,10 +90,3 @@ WAZUH_AGENT_GROUP
 Assigns the agent to one or more existing groups (separated by commas). See agent_groups.
 ENROLLMENT_DELAY
 Assigns the time that agentd should wait after a successful registration. See delay_after_enrollment.
-
-
-### ghorg
-GHORG_GITHUB_TOKEN
-
-export LEXICON_CLOUDFLARE_USERNAME="myusername@example.com"
-export LEXICON_CLOUDFLARE_TOKEN="cloudflare-api-token"
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoi.yaml.tmpl b/dotfiles/.local/share/chezmoi/home/.chezmoi.yaml.tmpl
index 2084a1b0..c77f489a 100644
--- a/dotfiles/.local/share/chezmoi/home/.chezmoi.yaml.tmpl
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoi.yaml.tmpl
@@ -5,8 +5,10 @@
 {{- $gmailAddress := "noreply@gmail.com" }}
 {{- $gmailAddressAppPassword := "" }}
 {{- $domain := "megabyte.space" }}
-{{- $githubToken := "" }}
-{{- $gitlabToken := "" }}
+{{- $cloudflareUsername := "noreply@megabyte.space" }}
+{{- $cloudflareToken := "" }}
+{{- $githubReadToken := "" }}
+{{- $gitlabReadToken := "" }}
 {{- $ngrokAuthToken := "" }}
 {{- $slackApiToken := "" }}
 {{- $tabbySyncToken := "" }}
@@ -90,6 +92,10 @@
 {{- end }}
 
 {{- $domain = promptStringOnce $data.user "domain" "Domain" $domain -}}
+{{- $cloudflareUsername = promptStringOnce $data.cloudflareUsername "cloudflareUsername" "CloudFlare E-Mail" $email -}}
+{{- $cloudflareToken = promptStringOnce $data.cloudflareToken "cloudflareToken" "CloudFlare API Token" $cloudflareToken -}}
+{{- $gitlabReadToken = promptStringOnce $data.gitlabReadToken "gitlabReadToken" "GitLab read-only token (See: https://github.com/gabrie30/ghorg#scm-provider-setup)" $gitlabReadToken }}
+{{- $githubReadToken = promptStringOnce $data.githubReadToken "githubReadToken" "GitHub read-only token (See: https://github.com/gabrie30/ghorg#scm-provider-setup)" $githubReadToken }}
 {{- $gmailAddress = promptStringOnce $data.user "gmailAddress" "G-mail address" $gmailAddress -}}
 {{- $gmailAddressAppPassword = promptStringOnce $data.user "gmailAddressAppPassword" "G-mail app password" $gmailAddressAppPassword -}}
 {{- $ngrokAuthToken = promptStringOnce $data.user "ngrokAuthToken" "Ngrok authentication token" $ngrokAuthToken -}}
@@ -132,8 +138,9 @@ data:
     gmailAddressAppPassword: "{{ $gmailAddressAppPassword }}"
     locale: "en_US"
     timezone: "America/New_York"
-    GITHUB_TOKEN: "{{ $githubToken }}"
-    GITLAB_TOKEN: "{{ $gitlabToken }}"
+    CLOUDFLARE_USERNAME: "{{ $cloudflareUsername }}"
+    GITHUB_READ_TOKEN: "{{ $githubReadToken }}"
+    GITLAB_READ_TOKEN: "{{ $gitlabReadToken }}"
     NGROK_AUTH_TOKEN: "{{ $ngrokAuthToken }}"
     SLACK_API_TOKEN: "{{ $slackApiToken }}"
     TABBY_SYNC_TOKEN: "{{ $tabbySyncToken }}"
@@ -143,6 +150,9 @@ diff:
 git:
   autoCommit: true
   autoPush: true
+scriptEnv:
+  LEXICON_CLOUDFLARE_USERNAME: "{{ $cloudflareUsername }}"
+  LEXICON_CLOUDFLARE_TOKEN: "{{ $cloudflareToken }}"
 textconv:
   - pattern: "**/*.plist"
     command: "plutil"
diff --git a/dotfiles/.local/share/chezmoi/home/private_dot_config/ghorg/conf.yaml.tmpl b/dotfiles/.local/share/chezmoi/home/private_dot_config/ghorg/conf.yaml.tmpl
index a43a12d9..cd11ba99 100644
--- a/dotfiles/.local/share/chezmoi/home/private_dot_config/ghorg/conf.yaml.tmpl
+++ b/dotfiles/.local/share/chezmoi/home/private_dot_config/ghorg/conf.yaml.tmpl
@@ -149,7 +149,7 @@ GHORG_EXIT_CODE_ON_CLONE_ISSUES: 1
 
 # Add your GitHub token
 # flag (--token, -t) eg: --token=bGVhdmUgYSBjb21tZW50IG9uIGlzc3VlIDY2
-GHORG_GITHUB_TOKEN: {{ .user.GITHUB_TOKEN }}
+GHORG_GITHUB_TOKEN: {{ .user.GITHUB_READ_TOKEN }}
 
 # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 # |G|I|T|L|A|B| |S|P|E|C|I|F|I|C|
@@ -157,7 +157,7 @@ GHORG_GITHUB_TOKEN: {{ .user.GITHUB_TOKEN }}
 
 # Add your GitLab token
 # flag (--token, -t) eg: --token=bGVhdmUgYSBjb21tZW50IG9uIGlzc3VlIDY2
-GHORG_GITLAB_TOKEN: {{ .user.GITLAB_TOKEN }}
+GHORG_GITLAB_TOKEN: {{ .user.GITLAB_READ_TOKEN }}
 
 # clones repos in a directory structure that matches gitlab namespaces eg company/unit/subunit/app would clone into ghorg/org/unit/subunit/app
 # flag (--preserve-dir)
diff --git a/dotfiles/.local/share/chezmoi/home/private_dot_config/shell/private_dot_private b/dotfiles/.local/share/chezmoi/home/private_dot_config/shell/private_dot_private
new file mode 100644
index 00000000..d1f56361
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/private_dot_config/shell/private_dot_private
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+export LEXICON_CLOUDFLARE_USERNAME={{ .user.CLOUDFLARE_USERNAME }}
+
+# TODO - Secure following:
+# export LEXICON_CLOUDFLARE_TOKEN=""