diff --git a/02-manage-providers-programmatically/aws/us-east-1/vpc/main/_terramate_generated_providers.tf b/02-manage-providers-programmatically/aws/us-east-1/vpc/main/_terramate_generated_providers.tf
index 103cd60..aa58462 100644
--- a/02-manage-providers-programmatically/aws/us-east-1/vpc/main/_terramate_generated_providers.tf
+++ b/02-manage-providers-programmatically/aws/us-east-1/vpc/main/_terramate_generated_providers.tf
@@ -9,6 +9,10 @@ terraform {
       source  = "hashicorp/aws"
       version = "~> 5.0"
     }
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 4.29"
+    }
     random = {
       source  = "hashicorp/random"
       version = "~> 4.0"
@@ -18,6 +22,11 @@ terraform {
 provider "aws" {
   region = "us-east-1"
 }
+provider "cloudflare" {
+  api_key     = data.sops_file.secrets.data.CLOUDFLARE_API_KEY
+  email       = data.sops_file.secrets.data.CLOUDFLARE_EMAIL
+  some_config = true
+}
 provider "aws" {
   region = "us-west-1"
   alias  = "west-1"
diff --git a/02-manage-providers-programmatically/aws/us-west-1/vpc/main/_terramate_generated_providers.tf b/02-manage-providers-programmatically/aws/us-west-1/vpc/main/_terramate_generated_providers.tf
index 103cd60..aa58462 100644
--- a/02-manage-providers-programmatically/aws/us-west-1/vpc/main/_terramate_generated_providers.tf
+++ b/02-manage-providers-programmatically/aws/us-west-1/vpc/main/_terramate_generated_providers.tf
@@ -9,6 +9,10 @@ terraform {
       source  = "hashicorp/aws"
       version = "~> 5.0"
     }
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 4.29"
+    }
     random = {
       source  = "hashicorp/random"
       version = "~> 4.0"
@@ -18,6 +22,11 @@ terraform {
 provider "aws" {
   region = "us-east-1"
 }
+provider "cloudflare" {
+  api_key     = data.sops_file.secrets.data.CLOUDFLARE_API_KEY
+  email       = data.sops_file.secrets.data.CLOUDFLARE_EMAIL
+  some_config = true
+}
 provider "aws" {
   region = "us-west-1"
   alias  = "west-1"
diff --git a/02-manage-providers-programmatically/config.tm.hcl b/02-manage-providers-programmatically/config.tm.hcl
index 44c54f7..8399f33 100644
--- a/02-manage-providers-programmatically/config.tm.hcl
+++ b/02-manage-providers-programmatically/config.tm.hcl
@@ -9,3 +9,18 @@ globals "terraform" "providers" "random" {
   version = "~> 3.5"
   enabled = true
 }
+
+globals "terraform" "providers" "cloudflare" {
+  source  = "cloudflare/cloudflare"
+  version = "~> 4.29"
+  enabled = true
+  
+  config = {
+    some_config = true
+  }
+
+  config_partial = {
+    api_key = "data.sops_file.secrets.data.CLOUDFLARE_API_KEY"
+    email   = "data.sops_file.secrets.data.CLOUDFLARE_EMAIL"
+  }
+}
diff --git a/02-manage-providers-programmatically/gcp/europe-west1/vpc/main-vpc/_terramate_generated_providers.tf b/02-manage-providers-programmatically/gcp/europe-west1/vpc/main-vpc/_terramate_generated_providers.tf
index 2addc12..a8bee59 100644
--- a/02-manage-providers-programmatically/gcp/europe-west1/vpc/main-vpc/_terramate_generated_providers.tf
+++ b/02-manage-providers-programmatically/gcp/europe-west1/vpc/main-vpc/_terramate_generated_providers.tf
@@ -5,6 +5,10 @@ terraform {
 }
 terraform {
   required_providers {
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 4.29"
+    }
     gcp = {
       source  = "hashicorp/google"
       version = "~> 5.6"
@@ -15,6 +19,11 @@ terraform {
     }
   }
 }
+provider "cloudflare" {
+  api_key     = data.sops_file.secrets.data.CLOUDFLARE_API_KEY
+  email       = data.sops_file.secrets.data.CLOUDFLARE_EMAIL
+  some_config = true
+}
 provider "gcp" {
   project = "my-project-id"
   region  = "europe-west1"
diff --git a/02-manage-providers-programmatically/imports/generate_providers.tm.hcl b/02-manage-providers-programmatically/imports/generate_providers.tm.hcl
index e848636..f18b8f3 100644
--- a/02-manage-providers-programmatically/imports/generate_providers.tm.hcl
+++ b/02-manage-providers-programmatically/imports/generate_providers.tm.hcl
@@ -12,10 +12,10 @@ generate_hcl "_terramate_generated_providers.tf" {
     }
 
     providers = { for k, v in tm_try(global.terraform.providers, {}) :
-      k => v.config if tm_alltrue([
+      k => {config = tm_try(v.config, {}), config_partial = tm_try(v.config_partial, {})} if tm_alltrue([
         tm_length(tm_split(".", k)) == 1,
         tm_try(v.enabled, true),
-        tm_can(v.config)
+        tm_can(v.config) || tm_can(v.config_partial)
       ])
     }
 
@@ -23,7 +23,7 @@ generate_hcl "_terramate_generated_providers.tf" {
       k => v.config if tm_alltrue([
         tm_length(tm_split(".", k)) == 2,
         tm_try(v.enabled, true),
-        tm_can(v.config)
+        tm_can(v.config) || tm_can(v.config_partial)
       ])
     }
   }
@@ -45,7 +45,10 @@ generate_hcl "_terramate_generated_providers.tf" {
     tm_dynamic "provider" {
       for_each   = let.providers
       labels     = [provider.key]
-      attributes = provider.value
+      attributes = tm_merge(
+        tm_try(provider.value.config, {}),
+        tm_try({for k, v in provider.value.config_partial : k => tm_hcl_expression(v)}, {}),
+      )
     }
 
     # Provider aliases
diff --git a/03-terraform-outputs-across-stacks/stacks/vpc/ec2/_terramate_generated_dependencies.tf b/03-terraform-outputs-across-stacks/stacks/vpc/ec2/_terramate_generated_dependencies.tf
index 9082086..d68fbbd 100644
--- a/03-terraform-outputs-across-stacks/stacks/vpc/ec2/_terramate_generated_dependencies.tf
+++ b/03-terraform-outputs-across-stacks/stacks/vpc/ec2/_terramate_generated_dependencies.tf
@@ -4,9 +4,9 @@ data "terraform_remote_state" "vpc" {
   backend = "s3"
   config = {
     bucket  = "my-terraform-state-bucket"
+    encrypt = true
     key     = "terraform/states/by-id/c2c67b6a-5cc5-4129-b684-f471548781d5/terraform.state"
     region  = "us-west-2"
-    encrypt = true
   }
   depends_on = [
     null_resource.initial_deployment_trigger,