diff --git a/scripts/github-actions/run-cloudflare-svc-plus-dns-playbook.sh b/scripts/github-actions/run-cloudflare-svc-plus-dns-playbook.sh
index 985a25a..7b6f63c 100755
--- a/scripts/github-actions/run-cloudflare-svc-plus-dns-playbook.sh
+++ b/scripts/github-actions/run-cloudflare-svc-plus-dns-playbook.sh
@@ -3,13 +3,20 @@ set -euo pipefail
 
 target_host="${TARGET_HOST:?TARGET_HOST is required}"
 run_apply="${RUN_APPLY:?RUN_APPLY is required}"
+cloudflare_zone_id="${CLOUDFLARE_ZONE_TAG:?CLOUDFLARE_ZONE_TAG is required}"
+cloudflare_dns_token="${CLOUDFLARE_DNS_API_TOKEN:-${CLOUDFLARE_API_TOKEN:-}}"
+
+if [[ -z "${cloudflare_dns_token}" ]]; then
+  echo "CLOUDFLARE_DNS_API_TOKEN or CLOUDFLARE_API_TOKEN is required" >&2
+  exit 1
+fi
 
 ansible_args=(
   -i inventory.ini
   update_cloudflare_svc_plus_dns.yml
   -e "{\"cloudflare_dns_source_hosts\":[\"${target_host}\"]}"
-  -e "CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN:?CLOUDFLARE_API_TOKEN is required}"
-  -e "CLOUDFLARE_DNS_API_TOKEN=${CLOUDFLARE_DNS_API_TOKEN:?CLOUDFLARE_DNS_API_TOKEN is required}"
+  -e "cloudflare_dns_zone_id=${cloudflare_zone_id}"
+  -e "CLOUDFLARE_DNS_API_TOKEN=${cloudflare_dns_token}"
 )
 
 if [[ "${run_apply}" != "true" ]]; then