It became apparent to me in code review that we don't sort wildcards to the bottom in cloudflared configuration. In my playing with https://github.com/cyclingwithelephants/cloudflare-gateway-controller I had the same problem and came up with https://github.com/cyclingwithelephants/cloudflare-gateway-controller/blob/f4b424488aa5e67eee5ec4bb9e082d26208da8ee/internal/clients/cf/tunnel_config_file.go#L68-L101
I wonder if it's worth implement this or something like it to make behaviour more stable when using wildcards