diff --git a/manifests/deployment.yaml b/manifests/deployment.yaml
index 32f39f3..e488823 100644
--- a/manifests/deployment.yaml
+++ b/manifests/deployment.yaml
@@ -17,15 +17,26 @@ spec:
     spec:
       serviceAccountName: openclaw
 
-      # Debug mode (early bring-up): keep the pod running so we can exec in.
-      # We'll switch back to `openclaw gateway ...` once we confirm where the binary lives
-      # and how first-run config should be initialized.
       containers:
         - name: openclaw
           image: default-route-openshift-image-registry.apps.lab.apilab.us/openclaw/openclaw:latest
           imagePullPolicy: Always
-          command: ["/bin/sh","-lc"]
-          args: ["sleep infinity"]
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              set -e
+              # Bootstrap if config doesn't exist
+              if [ ! -f ~/.openclaw/openclaw.json ]; then
+                node /app/openclaw.mjs onboard --non-interactive --accept-risk \
+                  --gateway-port 18789 --gateway-bind custom \
+                  --skip-daemon --skip-channels --skip-skills --skip-health --skip-ui
+              fi
+              # Run the gateway
+              exec node /app/openclaw.mjs gateway --port 18789 --bind 0.0.0.0
+          ports:
+            - name: gateway
+              containerPort: 18789
+              protocol: TCP
           env:
             - name: HOME
               value: /home/node