diff --git a/webtop/SETUP.md b/webtop/SETUP.md
index 37366eb..ead4ab0 100644
--- a/webtop/SETUP.md
+++ b/webtop/SETUP.md
@@ -62,3 +62,19 @@ If you are routing `webtop.chengs.uk` through a Cloudflare Tunnel, follow these
 6. Save the application. 
 
 Now, when you visit `webtop.chengs.uk`, you will be intercepted by a Cloudflare login screen. Cloudflare will email you a one-time pin, verifying your identity before you are allowed to reach the Webtop desktop.
+
+## 6. Access: Connect the Cloudflare Tunnel
+Now that the door is locked via the Access Policy, you can safely create the DNS record and route traffic to your NAS.
+
+1. In the **Cloudflare Zero Trust** Dashboard, go to **Networks** -> **Tunnels**.
+2. Click on your active NAS tunnel (e.g., `nas-tunnel`) and select **Configure**.
+3. Go to the **Public Hostname** tab.
+4. Click **Add a public hostname**.
+5. **Configuration**:
+   - **Subdomain**: `webtop`
+   - **Domain**: `chengs.uk`
+   - **Service Type**: `HTTP` (The Cloudflare daemon handles the external HTTPS encryption).
+   - **Service URL**: `[YOUR_NAS_LOCAL_IP]:3030` (e.g., `192.168.1.100:3030`).
+6. Click **Save hostname**.
+
+Cloudflare will automatically create the DNS record for `webtop.chengs.uk`. You can now navigate to that URL from anywhere in the world to securely access your personal cloud desktop!