diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix
index e7e0818..d5e8764 100644
--- a/nix-system-configs/modules/system/traefik.nix
+++ b/nix-system-configs/modules/system/traefik.nix
@@ -768,22 +768,33 @@ in {
 
         # Wrapper: source env, map tokens, loop declared records and call the upstream single-run script
         if [ -f "${envFile}" ]; then
+          echo "DEBUG: Sourcing environment file: ${envFile}" >&2
           # shellcheck disable=SC1090
           source "${envFile}"
+          echo "DEBUG: After sourcing - CLOUDFLARE_DNS_API_TOKEN length: ''${#CLOUDFLARE_DNS_API_TOKEN:-0}, CLOUDFLARE_API_TOKEN length: ''${#CLOUDFLARE_API_TOKEN:-0}" >&2
+        else
+          echo "ERROR: Environment file not found: ${envFile}" >&2
+          exit 1
         fi
 
         # Map env variables from the env file into auth_key/auth_email used by the upstream script
         if [ -n "''${CLOUDFLARE_DNS_API_TOKEN:-}" ]; then
-          export auth_key="''${CLOUDFLARE_DNS_API_TOKEN:-}"
+          export auth_key="''${CLOUDFLARE_DNS_API_TOKEN}"
+          echo "DEBUG: Using CLOUDFLARE_DNS_API_TOKEN (length: ''${#auth_key})" >&2
         elif [ -n "''${CLOUDFLARE_API_TOKEN:-}" ]; then
-          export auth_key="''${CLOUDFLARE_API_TOKEN:-}"
+          export auth_key="''${CLOUDFLARE_API_TOKEN}"
+          echo "DEBUG: Using CLOUDFLARE_API_TOKEN (length: ''${#auth_key})" >&2
         else
           echo "ERROR: No Cloudflare API token found in environment file" >&2
+          echo "ERROR: Available variables: $(set | grep CLOUDFLARE || echo 'none')" >&2
           exit 1
         fi
 
         if [ -n "''${CLOUDFLARE_USERNAME:-}" ]; then
-          export auth_email="''${CLOUDFLARE_USERNAME:-}"
+          export auth_email="''${CLOUDFLARE_USERNAME}"
+          echo "DEBUG: Using CLOUDFLARE_USERNAME: '$auth_email'" >&2
+        else
+          echo "DEBUG: No CLOUDFLARE_USERNAME found, auth_email will be empty" >&2
         fi
 
         # Export auth_method for the single-run script