diff --git a/manifests/deployment.yaml b/manifests/deployment.yaml
index 63c52c8..b313170 100644
--- a/manifests/deployment.yaml
+++ b/manifests/deployment.yaml
@@ -31,56 +31,6 @@ spec:
                   --gateway-port 18789 --gateway-bind lan \
                   --skip-daemon --skip-channels --skip-skills --skip-health --skip-ui
               fi
-<<<<<<< HEAD
-              # Patch tokens from OCP secrets into openclaw.json if not already set (idempotent)
-              node -e "
-                const fs = require('fs');
-                const d = JSON.parse(fs.readFileSync(process.env.HOME + '/.openclaw/openclaw.json', 'utf8'));
-
-                // Gateway token — must be in gateway.auth.token for channel auth to work
-                if (!d.gateway) d.gateway = {};
-                if (!d.gateway.auth) d.gateway.auth = {};
-                if (!d.gateway.auth.token) d.gateway.auth.token = process.env.OPENCLAW_GATEWAY_TOKEN;
-
-                // Hooks token
-                if (!d.hooks) d.hooks = {};
-                if (!d.hooks.token) {
-                  d.hooks.token = process.env.HOOKS_TOKEN;
-                  d.hooks.enabled = true;
-                  d.hooks.path = '/hooks';
-                  d.hooks.allowRequestSessionKey = false;
-                  d.hooks.mappings = d.hooks.mappings || [];
-                  if (!d.hooks.mappings.find(m => m.id === 'ocp-alerts')) {
-                    d.hooks.mappings.push({
-                      id: 'ocp-alerts',
-                      match: { path: '/ocp-alerts' },
-                      action: 'agent',
-                      name: 'OCP Alerts',
-                      sessionKey: 'hook:ocp-alerts',
-                      messageTemplate: 'You are an OCP cluster alert analyst for a Single Node OpenShift lab. An alert has fired. Compose a brief narrative notification and reply with ONLY the notification text \u2014 no preamble, no markdown, no tool calls.\n\nAlert details:\n- Name: {{groupLabels.alertname}}\n- Namespace: {{commonLabels.namespace}}\n- Severity: {{commonLabels.severity}}\n- Status: {{status}}\n- Summary: {{commonAnnotations.summary}}\n\nRules:\n1. If alertname contains \'Watchdog\': reply NO_REPLY and nothing else.\n2. Classify and write one of:\n  - ACTIONABLE firing: \"\ud83d\udfe1 [pod/component] is [what\'s wrong] in [namespace]. [One sentence likely cause]. Would you like me to take action?\"\n  - RESOLVED: \"\u2705 Good news \u2014 [what] in [namespace] has resolved.\"\n  - INFORMATIONAL: \"\u2139\ufe0f Heads up \u2014 [brief narrative].\"\n3. Plain text only. No bullet points. No markdown. Under 3 sentences.',
-                      deliver: true,
-                      allowUnsafeExternalContent: true,
-                      channel: 'telegram',
-                      to: '6479169830',
-                      model: 'haiku',
-                      timeoutSeconds: 60
-                    });
-                  }
-                }
-
-                // Telegram bot token
-                d.channels = d.channels || {};
-                d.channels.telegram = d.channels.telegram || {};
-                if (!d.channels.telegram.botToken) {
-                  d.channels.telegram.botToken = process.env.TELEGRAM_BOT_TOKEN;
-                }
-
-                fs.writeFileSync(process.env.HOME + '/.openclaw/openclaw.json', JSON.stringify(d, null, 2));
-                console.log('Tokens patched from OCP env vars');
-              "
-=======
-              # Run the gateway
->>>>>>> cc0bb81 (rolled back minimax's madness)
               exec node /app/openclaw.mjs gateway --port 18789 --bind lan
           ports:
             - name: gateway
@@ -126,6 +76,11 @@ spec:
                 secretKeyRef:
                   name: telegram-bot-token
                   key: token
+            - name: ZAI_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: zai
+                  key: token
           volumeMounts:
             - name: home
               mountPath: /home/node