diff --git a/net/cloudflared/Makefile b/net/cloudflared/Makefile
index 3920dc9639..a964bcb82b 100644
--- a/net/cloudflared/Makefile
+++ b/net/cloudflared/Makefile
@@ -6,7 +6,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=cloudflared
 PKG_VERSION:=2025.10.1
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/cloudflare/cloudflared/tar.gz/$(PKG_VERSION)?
diff --git a/net/cloudflared/files/cloudflared.init b/net/cloudflared/files/cloudflared.init
index a22964df7a..2e61f5a66d 100755
--- a/net/cloudflared/files/cloudflared.init
+++ b/net/cloudflared/files/cloudflared.init
@@ -28,16 +28,6 @@ start_service() {
 	procd_append_param command "--no-autoupdate"
 	procd_append_param command "run"
 
-	config_get token "config" "token"
-	if [ -n "$token" ]; then
-		# Remotely-managed tunnel (recommended by Cloudflare)
-		procd_append_param command "--token" "$token"
-	else
-		# Locally-managed tunnels
-		append_param_arg "config" "/etc/cloudflared/config.yml"
-		append_param_arg "origincert" "/etc/cloudflared/cert.pem"
-	fi
-
 	append_param_arg "edge_bind_address"
 	append_param_arg "edge_ip_version"
 	append_param_arg "grace_period"
@@ -49,6 +39,20 @@ start_service() {
 	append_param_arg "loglevel"
 	append_param_arg "logfile"
 
+	config_get token "config" "token"
+	if [ -z "$token" ]; then
+		# Locally-managed tunnels
+		append_param_arg "config" "/etc/cloudflared/config.yml"
+		append_param_arg "origincert" "/etc/cloudflared/cert.pem"
+	fi
+
+	procd_append_param command "run"
+
+	if [ -n "$token" ]; then
+		# Remotely-managed tunnel (recommended by Cloudflare)
+		procd_append_param command "--token" "$token"
+	fi
+
 	procd_set_param respawn
 	procd_set_param stderr 1