diff --git a/README.md b/README.md
index 7ecfcff..a95a43c 100644
--- a/README.md
+++ b/README.md
@@ -35,6 +35,7 @@ No modules.
 | [cloudflare_zero_trust_access_application.grafana_alerts](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource |
 | [cloudflare_zero_trust_access_application.k3s](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource |
 | [cloudflare_zero_trust_access_application.mcp_gateway](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource |
+| [cloudflare_zero_trust_access_application.mcp_gateway_backends](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource |
 | [cloudflare_zero_trust_access_application.warp](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) | resource |
 | [cloudflare_zero_trust_access_group.admins](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_group) | resource |
 | [cloudflare_zero_trust_access_identity_provider.github](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_identity_provider) | resource |
diff --git a/cf-access-mcp.tf b/cf-access-mcp.tf
index ab2b5ca..81bb0ad 100644
--- a/cf-access-mcp.tf
+++ b/cf-access-mcp.tf
@@ -42,3 +42,41 @@ resource "cloudflare_zero_trust_access_application" "mcp_gateway" {
     }
   ]
 }
+
+# Per-backend MCP endpoints (<name>.mcp.makeitwork.cloud) terminate on the
+# same toolhive proxyrunners behind the same tunnel. Wildcard application so
+# each integration gets its own FQDN without a new Access app per backend;
+# same service-token + admins policies as the aggregate gateway above.
+resource "cloudflare_zero_trust_access_application" "mcp_gateway_backends" {
+  account_id       = local.account_id
+  name             = "MCP Gateway Backends"
+  type             = "self_hosted"
+  domain           = "*.mcp.makeitwork.cloud"
+  session_duration = "24h"
+
+  allowed_idps = [
+    cloudflare_zero_trust_access_identity_provider.github.id,
+  ]
+
+  policies = [
+    {
+      name     = "mcp-gateway-clients"
+      decision = "non_identity"
+      include = [{
+        service_token = {
+          token_id = cloudflare_zero_trust_access_service_token.mcp_gateway.id
+        }
+      }]
+    },
+    {
+      name             = "makeitworkcloud-admins"
+      decision         = "allow"
+      session_duration = "24h"
+      include = [{
+        group = {
+          id = cloudflare_zero_trust_access_group.admins.id
+        }
+      }]
+    }
+  ]
+}
diff --git a/cf-tunnels.tf b/cf-tunnels.tf
index 2692666..2a5c299 100644
--- a/cf-tunnels.tf
+++ b/cf-tunnels.tf
@@ -23,6 +23,17 @@ locals {
     "grafana",
     "k3s",
     "mcp",
+    # Per-backend MCP endpoints (toolhive proxyrunners); the aggregate
+    # VirtualMCPServer stays at the bare "mcp" hostname above.
+    "apify.mcp",
+    "argocd-makeitwork.mcp",
+    "aws-docs.mcp",
+    "context7.mcp",
+    "github.mcp",
+    "grafana-makeitwork.mcp",
+    "kubernetes.mcp",
+    "parallel-search.mcp",
+    "terraform-docs.mcp",
     "opencode",
     "status",
     "alertmanager",