diff --git a/nixos/arion-openclaw/arion-compose.nix b/nixos/arion-openclaw/arion-compose.nix
index b8c72ad..1c42853 100644
--- a/nixos/arion-openclaw/arion-compose.nix
+++ b/nixos/arion-openclaw/arion-compose.nix
@@ -2,23 +2,46 @@
 {
   project.name = "openclaw";
 
-  networks.openclaw.external = false;
-
   services = {
+    gateway = {
+      service = {
+        image = "node:22-alpine";
+        container_name = "openclaw-gateway";
+        restart = "unless-stopped";
+        network_mode = "host";
+        volumes = [
+          "/var/openclaw/gateway:/app"
+          "/root/.openclaw:/root/.openclaw"
+        ];
+        environment = {
+          OPENCLAW_HOME = "/root/.openclaw";
+        };
+        command = [
+          "sh" "-c"
+          ''
+            set -e
+            if [ ! -f /app/node_modules/.bin/openclaw ]; then
+              cd /app && npm install openclaw@latest
+            fi
+            exec /app/node_modules/.bin/openclaw gateway --port 18789
+          ''
+        ];
+      };
+    };
+
     app = {
       service = {
-        image = "node:lts-alpine";
+        image = "node:22-alpine";
         container_name = "openclaw";
         restart = "unless-stopped";
-        networks = [ "openclaw" ];
+        network_mode = "host";
         volumes = [
           "/var/openclaw/app:/app"
           "/root/.openclaw:/root/.openclaw:ro"
         ];
-        ports = [ "127.0.0.1:4310:4310" ];
         environment = {
           PORT = "4310";
-          UI_BIND_ADDRESS = "0.0.0.0";
+          UI_BIND_ADDRESS = "127.0.0.1";
           OPENCLAW_HOME = "/root/.openclaw";
         };
         command = [
diff --git a/nixos/linux.nix b/nixos/linux.nix
index 296ef77..7ab2c87 100644
--- a/nixos/linux.nix
+++ b/nixos/linux.nix
@@ -243,6 +243,7 @@ in {
     "d /var/paperless/postgres 0755 root root"
     "d /var/paperless/redis 0755 root root"
     "d /var/openclaw/app 0755 root root"
+    "d /var/openclaw/gateway 0755 root root"
     "d /var/riverside/files 0755 root root"
     "d /var/riverside/postgres 0755 root root"
     "d /var/lib/gitea-runner/ubuntu 0755 gitea-runner gitea-runner"