diff --git a/cdn.tf b/cdn.tf
index ea1ab2a..c41fdb4 100644
--- a/cdn.tf
+++ b/cdn.tf
@@ -32,9 +32,7 @@ resource "bunnynet_pullzone" "devxy-r-binaries" {
   cache_stale           = ["offline", "updating"]
   use_background_update = true
 
-  block_ips = [
-    "185.172.53.0"
-  ]
+  block_ips = var.cdn_block_ips
 
   # 50 TB
   limit_bandwidth = 50000000000000
@@ -86,9 +84,7 @@ resource "bunnynet_pullzone" "cran_rpkgs_com" {
   cache_stale           = ["offline", "updating"]
   use_background_update = true
 
-  block_ips = [
-    "185.172.53.0"
-  ]
+  block_ips = var.cdn_block_ips
 
   # 50 TB
   limit_bandwidth = 50000000000000
diff --git a/vars.tf b/vars.tf
index aad56ff..b831269 100644
--- a/vars.tf
+++ b/vars.tf
@@ -17,3 +17,11 @@ variable "B2_S3_SECRET_KEY" {
   type      = string
   sensitive = true
 }
+
+variable "cdn_block_ips" {
+  description = "IP addresses to block at the BunnyCDN pullzones (cran.devxy.io, cran.rpkgs.com)."
+  type        = list(string)
+  default = [
+    "185.172.53.0",
+  ]
+}