@@ -8,7 +8,7 @@ Keep one password-manager entry for this platform. Paste the saved values into t
 
 | Credential                             | Created by                       | Why the platform needs it                                                                |
 | -------------------------------------- | -------------------------------- | ---------------------------------------------------------------------------------------- |
-| Management API token                   | You, in Cloudflare               | Lets the CLI change DNS and Access for a domain installation or Access setup.            |
+| Management API token                   | You, in Cloudflare               | Lets the CLI create a zone, change DNS, and set up Access.                               |
 | Runtime API token                      | You, in Cloudflare               | Stored as a Worker secret so the platform can deploy apps after you close your terminal. |
 | PostgreSQL URL                         | You, with your database provider | Stores platform users, projects, and deployments.                                        |
 | Login provider client ID and secret    | You, or Void for Access login    | Signs people in to the platform.                                                         |
@@ -20,11 +20,13 @@ Keep one password-manager entry for this platform. Paste the saved values into t
 
 ## Cloudflare API Tokens {#runtime-token-permissions}
 
-For a domain installation or Cloudflare Access setup, the installer guides you through creating separate management and runtime tokens using Cloudflare's [API token setup](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). Its links preselect the permissions and suggest names based on your platform's display name, but Cloudflare's form cannot preselect a zone: for a domain installation, change the zone policy from **All Domains** to **Specified Domains** and select your zone. If Void will create the zone, keep **All Domains** on both tokens: the zone does not exist yet, and the runtime token needs it to purge cache. Save the tokens in your password manager and paste them into the masked CLI prompts.
+For a domain installation or Cloudflare Access setup, the installer guides you through creating tokens using Cloudflare's [API token setup](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/): a runtime token, and a separate management token when the installation creates the zone or its wildcard DNS record, or sets up Access. Its links preselect the permissions and suggest names based on your platform's display name, but Cloudflare's form cannot preselect a zone: for a domain installation, change the zone policy from **All Domains** to **Specified Domains** and select your zone. If Void will create the zone, keep **All Domains** on both tokens: the zone does not exist yet, and the runtime token needs it to purge cache. Save the tokens in your password manager and paste them into the masked CLI prompts.
 
 For workers.dev testing with the default API hostname, browser login can authorize
-infrastructure setup. Void also checks account-wide Access requirements; if the
-current credential cannot read them, the installer asks for a scoped Access token.
+infrastructure setup. So can a domain installation on an existing zone whose
+`*.<application domain>` record is already proxied. Void also checks account-wide
+Access requirements; if the current credential cannot read them, the installer
+asks for a scoped Access token.
 Protected apps and public apps under Default-Deny need an ongoing app-management
 token, stored encrypted. Access setup requires a management token even on
 workers.dev. Skip zone permissions until you add a domain.
 
@@ -12,7 +12,7 @@ For workers.dev testing, start the interactive install and choose your login met
 void platform install --workers-dev
 ```
 
-For a domain installation or Access setup, Void guides you to create a management API token and paste it into a masked prompt. Browser login can preview DNS, but cannot change it or configure Access. The token-creation link preselects the permissions for your choices. When using an existing domain, change the zone policy from **All Domains** to **Specified Domains** and select your zone, as the CLI prompt describes. No shell environment variable is needed for interactive installation.
+When a domain installation creates the zone or its wildcard DNS record, or you set up Access, Void guides you to create a management API token and paste it into a masked prompt. Browser login can preview DNS and use an existing proxied `*.<application domain>` record, but cannot change DNS or configure Access. The token-creation link preselects the permissions for your choices. When using an existing domain, change the zone policy from **All Domains** to **Specified Domains** and select your zone, as the CLI prompt describes. No shell environment variable is needed for interactive installation.
 
 ::: details Use an existing management token from the shell
 
 
@@ -4,6 +4,7 @@ import {
   type CloudflareAccount,
   type PlatformCloudflareClient,
 } from './platform-cloudflare.ts';
+import { planCreatesZone, planWritesDns } from './platform-plan-writes.ts';
 import type { PlatformInstallPlan } from './platform-plan.ts';
 
 export type PlatformCloudflareCredential = Readonly<{
@@ -152,14 +153,6 @@ export function platformOperatorNeedsManagementToken(
   );
 }
 
-function planCreatesZone(plan: Pick<PlatformInstallPlan, 'actions'>): boolean {
-  return plan.actions.some((action) => action.kind === 'zone' && action.action === 'create');
-}
-
-function planWritesDns(plan: Pick<PlatformInstallPlan, 'actions'>): boolean {
-  return plan.actions.some((action) => action.kind === 'dns-record' && action.action !== 'reuse');
-}
-
 export async function resolvePlatformCloudflareCredential(
   dependencies: PlatformCloudflareAuthDependencies = {},
 ): Promise<PlatformCloudflareCredential> {
 
@@ -0,0 +1,19 @@
+import type { PlatformInstallPlan } from './platform-plan.ts';
+
+// Type-only imports keep this module cheap to load from the setup prompts.
+
+export function planCreatesZone(plan: Pick<PlatformInstallPlan, 'actions'>): boolean {
+  return plan.actions.some((action) => action.kind === 'zone' && action.action === 'create');
+}
+
+/**
+ * Whether applying the plan writes a DNS record, which needs Zone → DNS → Edit.
+ * 'reuse' changes nothing and 'adopt' only records an existing record in the
+ * manifest; only 'create' calls the DNS API.
+ */
+export function planWritesDns(plan: Pick<PlatformInstallPlan, 'actions'>): boolean {
+  return plan.actions.some(
+    (action) =>
+      action.kind === 'dns-record' && action.action !== 'reuse' && action.action !== 'adopt',
+  );
+}
@@ -3,6 +3,7 @@ import { type CANCEL_SYMBOL, isCancel, log } from '@voidzero-dev/vite-plus-promp
 import { openBrowser } from './auth.ts';
 import { formatLink, pc } from './output.ts';
 import type { PlatformManagementAccess } from './platform-auth.ts';
+import { planCreatesZone, planWritesDns } from './platform-plan-writes.ts';
 import type { PlatformInstallPlan } from './platform-plan.ts';
 
 type PlatformSetupPage = Readonly<{
@@ -244,11 +245,7 @@ export function formatPlatformSetupPlan(
   plan: PlatformInstallPlan,
   options: { managementToken?: boolean; managementAccess?: boolean } = {},
 ): string {
-  const writesDns = plan.actions.some(
-    (action) =>
-      (action.kind === 'zone' && action.action === 'create') ||
-      (action.kind === 'dns-record' && action.action !== 'reuse'),
-  );
+  const writesDns = planCreatesZone(plan) || planWritesDns(plan);
   const credentials = [
     ...(options.managementToken
       ? [
 
@@ -165,16 +165,16 @@ describe('platform Cloudflare authentication', () => {
       expect(request.mock.calls.every((call) => call.length === 1)).toBe(true);
     },
   );
-  it('requires an API token before browser OAuth applies zone or DNS writes', () => {
-    const action = (kind: 'dns-record' | 'zone', action: 'create' | 'reuse') => ({
-      action,
-      id: action === 'reuse' ? `${kind}-id` : null,
-      key: kind,
-      kind,
-      name: 'example.com',
-      reason: 'test',
-    });
+  const action = (kind: 'dns-record' | 'zone', action: 'adopt' | 'create' | 'reuse') => ({
+    action,
+    id: action === 'create' ? null : `${kind}-id`,
+    key: kind,
+    kind,
+    name: 'example.com',
+    reason: 'test',
+  });
 
+  it('requires an API token before browser OAuth applies zone or DNS writes', () => {
     expect(() =>
       assertPlatformOperatorCredentialCanApplyPlan(
         { source: 'oauth', token: 'browser-token' },
@@ -195,6 +195,26 @@ describe('platform Cloudflare authentication', () => {
     ).not.toThrow();
   });
 
+  it('does not require an API token for a DNS record the install only adopts', () => {
+    const oauth = { source: 'oauth' as const, token: 'browser-token' };
+
+    const adopt = { actions: [action('zone', 'reuse'), action('dns-record', 'adopt')] };
+    expect(platformOperatorNeedsManagementToken(oauth, adopt)).toBe(false);
+    expect(() => assertPlatformOperatorCredentialCanApplyPlan(oauth, adopt)).not.toThrow();
+    const create = { actions: [action('zone', 'reuse'), action('dns-record', 'create')] };
+    expect(platformOperatorNeedsManagementToken(oauth, create)).toBe(true);
+    expect(() => assertPlatformOperatorCredentialCanApplyPlan(oauth, create)).toThrow(
+      'Zone → DNS → Edit',
+    );
+    const reuse = { actions: [action('zone', 'reuse'), action('dns-record', 'reuse')] };
+    expect(platformOperatorNeedsManagementToken(oauth, reuse)).toBe(false);
+    const zone = { actions: [action('zone', 'create'), action('dns-record', 'adopt')] };
+    expect(platformOperatorNeedsManagementToken(oauth, zone)).toBe(true);
+    expect(() => assertPlatformOperatorCredentialCanApplyPlan(oauth, zone)).toThrow(
+      'Account → Zone → Edit',
+    );
+  });
+
   it.each([false, true])(
     'uses saved management authority before browser login (interactive: %s)',
     async (interactive) => {
 
@@ -338,10 +338,10 @@ function requireManagementToken() {
       }),
       actions: [
         {
-          action: 'adopt',
+          action: 'create',
           kind: 'dns-record',
           key: 'wildcard-dns',
-          id: 'dns-id',
+          id: null,
           name: '*.example.com',
           reason: 'test',
         },
 
@@ -450,6 +450,25 @@ describe('platform credential setup links', () => {
     expect(formatPlatformSetupPlan(plan())).not.toContain('management API token');
     expect(formatPlatformSetupPlan(plan())).not.toContain('Access application');
   });
+  it('does not list DNS changes when the plan only adopts or reuses DNS records', () => {
+    const original = plan('example.com');
+    const record = (action: 'adopt' | 'reuse' | 'create') =>
+      ({
+        kind: 'dns-record',
+        action,
+        name: '*.example.com',
+      }) as unknown as PlatformInstallPlan['actions'][number];
+    const preview = (action: 'adopt' | 'reuse' | 'create') =>
+      formatPlatformSetupPlan(
+        { ...original, actions: [record(action)] },
+        { managementToken: true, managementAccess: true },
+      );
+    expect(preview('adopt')).toContain('Cloudflare management API token for Access setup');
+    expect(preview('reuse')).toContain('Cloudflare management API token for Access setup');
+    expect(preview('create')).toContain(
+      'Cloudflare management API token for DNS changes and Access setup',
+    );
+  });
   it('includes zone permissions only for an application domain', () => {
     const page = platformSetupPages(plan('example.com')).runtime;
     expect(permissionGroupKeys(page.url)).toContainEqual({ key: 'cache', type: 'purge' });