HOWTO: Secure Cloudflare Tunnels remote access

I followed this guide along with

https://community.home-assistant.io/t/how-to-connect-google-assistant-using-the-cloudflare-tunnel/545574

I can get the integration to work by adding the public host name under Tunnels but as soon as I add an entry to Applications with up-to-date Google IPs voice control breaks. any ideas? I currently have two applications set up. One that I use for remotely accessing HA which works fine with email login policy but the second one I created strictly for Google Home breaks functionality.