diff --git a/stacks/platform/main.tf b/stacks/platform/main.tf
index 85f7237c..e96d1156 100644
--- a/stacks/platform/main.tf
+++ b/stacks/platform/main.tf
@@ -71,7 +71,7 @@ locals {
 
   # User domains from namespace-owners for DNS/Cloudflare
   user_domains = flatten([
-    for name, user in local.k8s_users : user.domains
+    for name, user in local.k8s_users : lookup(user, "domains", [])
     if user.role == "namespace-owner"
   ])
 }
@@ -383,7 +383,7 @@ module "cloudflared" {
   cloudflare_zone_id           = var.cloudflare_zone_id
   cloudflare_tunnel_id         = var.cloudflare_tunnel_id
   public_ip                    = var.public_ip
-  cloudflare_proxied_names     = concat(var.cloudflare_proxied_names, local.user_domains)
+  cloudflare_proxied_names     = concat(var.cloudflare_proxied_names, nonsensitive(local.user_domains))
   cloudflare_non_proxied_names = var.cloudflare_non_proxied_names
   cloudflare_tunnel_token      = data.vault_kv_secret_v2.secrets.data["cloudflare_tunnel_token"]
 }