diff --git a/.changeset/fast-seas-hunt.md b/.changeset/fast-seas-hunt.md
new file mode 100644
index 0000000000..0dcf8daf30
--- /dev/null
+++ b/.changeset/fast-seas-hunt.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-cloudflare-access-provider': patch
+---
+
+Use the email from `cfIdentity` instead of `claims` when constructing user profile in order to support Cloudflare Service Tokens.
diff --git a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts
index 678e513412..ea38bd5180 100644
--- a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts
+++ b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts
@@ -18,14 +18,14 @@ import { mockServices } from '@backstage/backend-test-utils';
 import { createCloudflareAccessAuthenticator } from './authenticator';
 
 describe('authenticator', () => {
-  it('createCloudflareAccessAuthenticator works', async () => {
+  it('works for normal users', async () => {
     const auth = createCloudflareAccessAuthenticator({
       cache: mockServices.cache.mock(),
     });
 
     const profile = await auth.defaultProfileTransform(
       {
-        cfIdentity: { name: 'Name' } as any,
+        cfIdentity: { name: 'Name', email: 'hello@example.com' } as any,
         claims: { email: 'hello@example.com' } as any,
         token: 'fake',
       },
@@ -38,4 +38,25 @@ describe('authenticator', () => {
       },
     });
   });
+
+  it('works for service tokens', async () => {
+    const auth = createCloudflareAccessAuthenticator({
+      cache: mockServices.cache.mock(),
+    });
+
+    const profile = await auth.defaultProfileTransform(
+      {
+        cfIdentity: { name: 'Name', email: 'hello@example.com' } as any,
+        claims: {} as any,
+        token: 'fake',
+      },
+      {} as any,
+    );
+    expect(profile).toEqual({
+      profile: {
+        displayName: 'Name',
+        email: 'hello@example.com',
+      },
+    });
+  });
 });
diff --git a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts
index c15a1a19a0..7b311a60f0 100644
--- a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts
+++ b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts
@@ -38,7 +38,7 @@ export function createCloudflareAccessAuthenticator(options?: {
     async defaultProfileTransform(result: CloudflareAccessResult) {
       return {
         profile: {
-          email: result.claims.email,
+          email: result.cfIdentity.email,
           displayName: result.cfIdentity.name,
         },
       };