diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index 5fd3b9223..40cb4205c 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -13,6 +13,7 @@ Plugin Changelog
 Added:
 * Add Simply.com DNS API (#2888)
 * Add Active24 challenge type (#3049)
+* Add support for Zone ID in Cloudflare challenge type (#2973)
 
 Fixed:
 * Re-order function parameters due to PHP8 deprecation notice (#3043)
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index ee96f9000..0d6d449c5 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -263,6 +263,12 @@
         <type>password</type>
         <help>The token needs "Read" access to Zone.Zone and "Edit" access to Zone.DNS across all zones from an account.</help>
     </field>
+    <field>
+        <id>validation.dns_cf_zone_id</id>
+        <label>CF Zone ID (Optional)</label>
+        <type>text</type>
+        <help>Note that specifying a Zone ID will limit this configuration to a single domain.</help>
+    </field>
     <field>
         <label>ClouDNS</label>
         <type>header</type>
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsCf.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsCf.php
index 3f6f735e0..107a09f6e 100644
--- a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsCf.php
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsCf.php
@@ -45,5 +45,9 @@ class DnsCf extends Base implements LeValidationInterface
         // Restricted API token (recommended)
         $this->acme_env['CF_Token'] = (string)$this->config->dns_cf_token;
         $this->acme_env['CF_Account_ID'] = (string)$this->config->dns_cf_account_id;
+        // Optional Zone ID
+        if (!empty((string)$this->config->dns_cf_zone_id)) {
+            $this->acme_env['CF_Zone_ID'] = (string)$this->config->dns_cf_zone_id;
+        }
     }
 }
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 4b01dfa58..19e5cd911 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -560,6 +560,9 @@
                 <dns_cf_account_id type="TextField">
                     <Required>N</Required>
                 </dns_cf_account_id>
+                <dns_cf_zone_id type="TextField">
+                    <Required>N</Required>
+                </dns_cf_zone_id>
                 <dns_cloudns_auth_id type="TextField">
                     <Required>N</Required>
                 </dns_cloudns_auth_id>