diff --git a/home/.chezmoi.yaml.tmpl b/home/.chezmoi.yaml.tmpl
index e8647412..8f83277c 100644
--- a/home/.chezmoi.yaml.tmpl
+++ b/home/.chezmoi.yaml.tmpl
@@ -1,16 +1,16 @@
 {{- $cloudflareR2AccountId := (default "84fa0d1b16ff8086dd958c468ce7fd59" (env "CLOUDFLARE_R2_ID")) -}}
-{{- $cloudflareUsername := (default "brian@megabyte.space" (env "CLOUDFLARE_USERNAME")) -}}
+{{- $cloudflareUsername := (default "blzalewski@gmail.com" (env "CLOUDFLARE_USERNAME")) -}}
 {{- $cloudflareTeamsOrg := (default "manhattan" (env "CLOUDFLARE_TEAMS_ORG")) -}}
 {{- $desktopSession := true -}}
 {{- $dockerHubUser := (default "professormanhattan" (env "DOCKERHUB_USER")) -}}
-{{- $domain := (default "lab.megabyte.space" (env "PUBLIC_SERVICES_DOMAIN")) -}}
+{{- $domain := (default "megabyte.space" (env "PUBLIC_SERVICES_DOMAIN")) -}}
 {{- $email := (default "brian@megabyte.space" (env "PRIMARY_EMAIL")) -}}
 {{- $gcloudCoreProject := (default "megabyte-labs" (env "CLOUDSDK_CORE_PROJECT"))}}
 {{- $gcloudEmail := (default "automation@megabyte-labs.iam.gserviceaccount.com" (env "GCE_SERVICE_ACCOUNT_EMAIL"))}}
 {{- $githubUsername := (default "ProfessorManhattan" (env "GITHUB_USERNAME")) -}}
 {{- $gmailAddress := (default "blzalewski@gmail.com" (env "GMAIL_ADDRESS")) -}}
 {{- $gpgKeyId := (default "0xF0A300E4199A1C33" (env "KEYID")) -}}
-{{- $hostname := (default (output "hostname" "-s") (env "HOST")) -}}
+{{- $hostname := (output "hostname" "-s") -}}
 {{- $locale := (default "en_US" (env "LANG")) }}
 {{- $name := (default "Brian Zalewski" (env "FULL_NAME")) -}}
 {{- $restricted := (default false (env "WORK_ENVIRONMENT")) -}}
diff --git a/home/.chezmoitemplates/secrets/CLOUDFLARE_API_TOKEN b/home/.chezmoitemplates/secrets/CLOUDFLARE_API_TOKEN
index a9c8ed97..1943515a 100644
--- a/home/.chezmoitemplates/secrets/CLOUDFLARE_API_TOKEN
+++ b/home/.chezmoitemplates/secrets/CLOUDFLARE_API_TOKEN
@@ -1,7 +1,7 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRaEoxNFRxb015U0d0R05Z
-WGZGSVgyeDJ2QUtDR2VxanRWTE1COVlJRUdzCjNuc3R1MytaQUN5cjlJVXpSNkpj
-c05Ta3NHb2ZpMlJhQ3h6K2E5bHFleU0KLS0tIEFhcURJUGRZeW9TNjVNY21QYTBG
-TnIvR0ptVXo5YmlTZFBFclZLK0tLWE0KCTd/BG2CGNx6gaQJ3xeP5MkuGjyom9C3
-udQnA+qcd07fgL49FVFXIMT1Wod7XQcZjin2aCH6hHBtVOysRim0YRSyEpm+o/wD
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPbU5paE9pNzU4WnZ2SGhp
+RUFENnpEYmgrNjlUcy8wS1VxdXNiQXVhaUF3CnJEMUI1aHlnWDZ1TWpsU3phNXJN
+L0V6TVJ3VjBYWSsva0ZkSW5lODhaQ2sKLS0tIFdvenlCR2lHYWVRSXJhSFRyc0FN
+aTRsQWFNdWlIcU9rL2hvMkt1QmU2NW8K50vMjSL2H8xxAiEj8DsfbpRccEzT0YGC
+wcQaXv0Uzf9TR3CcEutgaDNtKEm8PjRASd0YeUhk7H5ly2oT+nvLRgUwTE9zRo56
 -----END AGE ENCRYPTED FILE-----
\ No newline at end of file
diff --git a/home/dot_config/lexicon/private_lexicon.yml.tmpl b/home/dot_config/lexicon/private_lexicon.yml.tmpl
new file mode 100644
index 00000000..dc7f536f
--- /dev/null
+++ b/home/dot_config/lexicon/private_lexicon.yml.tmpl
@@ -0,0 +1,4 @@
+---
+cloudflare:
+  auth_token: "{{ if (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_API_TOKEN")) }}{{ includeTemplate "secrets/CLOUDFLARE_API_TOKEN" | decrypt | trim }}{{ else }}{{ env "CLOUDFLARE_API_TOKEN" }}{{ end }}"
+  zone: {{ .host.domain }}
\ No newline at end of file
diff --git a/home/dot_config/shell/exports.sh.tmpl b/home/dot_config/shell/exports.sh.tmpl
index fc335b09..0ed4d8a0 100644
--- a/home/dot_config/shell/exports.sh.tmpl
+++ b/home/dot_config/shell/exports.sh.tmpl
@@ -305,6 +305,10 @@ export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"
 ### Kube
 export KUBECONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/kube"
 
+### Lexicon
+export LEXICON_CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/lexicon"
+export TLDEXTRACT_CACHE_PATH="${XDG_DATA_HOME:-$HOME/.local/share}/lexicon"
+
 ### MacPrefs
 export MACPREFS_BACKUP_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/macprefs"
 
diff --git a/home/dot_config/shell/private_private.sh.tmpl b/home/dot_config/shell/private_private.sh.tmpl
index f126f106..2a045140 100644
--- a/home/dot_config/shell/private_private.sh.tmpl
+++ b/home/dot_config/shell/private_private.sh.tmpl
@@ -28,14 +28,14 @@ export GCE_CREDENTIALS_FILE="${XDG_CONFIG_HOME:-$HOME/.config}/gcloud/gcp.json"
 
 ### CloudFlare
 # Source: https://github.com/cloudflare/cf-terraforming
-export CLOUDFLARE_API_TOKEN='Hzsq3Vub-7Y-hSTlAaLH3Jq_YfTUOCcgf22_Fs-j'
+export CLOUDFLARE_API_TOKEN="{{ if (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_API_TOKEN")) }}{{ includeTemplate "secrets/CLOUDFLARE_API_TOKEN" | decrypt | trim }}{{ else }}{{ env "CLOUDFLARE_API_TOKEN" }}{{ end }}"
 # If using API Key
 # export CLOUDFLARE_EMAIL='user@example.com'
 # export CLOUDFLARE_API_KEY='1150bed3f45247b99f7db9696fffa17cbx9'
 # Specify zone ID
 # export CLOUDFLARE_ZONE_ID='81b06ss3228f488fh84e5e993c2dc17'
-export LEXICON_CLOUDFLARE_TOKEN=""
-export LEXICON_CLOUDFLARE_USERNAME="{{ .user.cloudflare.username }}"
+export LEXICON_CLOUDFLARE_TOKEN="{{ if (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "CLOUDFLARE_API_TOKEN")) }}{{ includeTemplate "secrets/CLOUDFLARE_API_TOKEN" | decrypt | trim }}{{ else }}{{ env "CLOUDFLARE_API_TOKEN" }}{{ end }}"
+export LEXICON_CLOUDFLARE_ZONE="{{ .host.domain }}"
 
 ### DockerHub
 export DOCKERHUB_TOKEN="{{ if (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "DOCKERHUB_TOKEN")) }}{{ includeTemplate "secrets/DOCKERHUB_TOKEN" | decrypt | trim }}{{ else }}{{ env "DOCKERHUB_TOKEN" }}{{ end }}"
diff --git a/software.yml b/software.yml
index 7d633c75..dc8dea9d 100644
--- a/software.yml
+++ b/software.yml
@@ -6814,8 +6814,11 @@ softwarePackages:
     _github: https://github.com/AnalogJ/lexicon
     _home: null
     _name: Lexicon
+    _post:pipx: |
+      #!/usr/bin/env bash
+      pipx inject dns-lexicon dns-lexicon[full]
     ansible: professormanhattan.lexicon
-    pipx: dns-lexicon[full]
+    pipx: dns-lexicon
   libimobiledevice:
     _bin: null
     _desc: null