diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index 76facd8..7dba2af 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -19,6 +19,7 @@ permissions:
   contents: read
 
 env:
+  TZ: Asia/Shanghai
   BUILDKIT_PROGRESS: "plain" # Full logs for CI build.
   REGISTRY_SRC: ${{ vars.REGISTRY_SRC || 'docker.io' }} # For BASE_NAMESPACE of images: where to pull base images from, docker.io or other source registry URL.
   REGISTRY_DST: ${{ vars.REGISTRY_DST || 'docker.io' }} # For tags of built images: where to push images to, docker.io or other destination registry URL.
@@ -29,7 +30,6 @@ env:
   DOCKER_MIRROR_REGISTRY_USERNAME: ${{ vars.DOCKER_MIRROR_REGISTRY_USERNAME }}
   DOCKER_MIRROR_REGISTRY_PASSWORD: ${{ secrets.DOCKER_MIRROR_REGISTRY_PASSWORD }}
   CI_PROJECT_NAME: ${{ vars.CI_PROJECT_NAME || 'LabNow/lab-dev' }}
-  TZ: Asia/Shanghai
 
 jobs:
   ## Clash
@@ -217,7 +217,7 @@ jobs:
           alias_image cuda-dev latest full-cuda latest && push_image dev
 
   ## Sync all images in this build (listed by "names") to mirror registry.
-  sync_images:
+  job-sync-images:
     needs:
       [
         "job-cuda-dev",
diff --git a/docker_openclaw/work/script-setup-openclaw.sh b/docker_openclaw/work/script-setup-openclaw.sh
index 4209da2..cf5de62 100644
--- a/docker_openclaw/work/script-setup-openclaw.sh
+++ b/docker_openclaw/work/script-setup-openclaw.sh
@@ -2,42 +2,6 @@
 set -eu
 
 
-init_config() {
-  if [ ! -f "$OPENCLAW_CONFIG_PATH" ]; then
-    mkdir -p "$(dirname "$OPENCLAW_CONFIG_PATH")"
-
-    local auth_mode="${OPENCLAW_GATEWAY_AUTH_MODE:-none}"
-    local token="${OPENCLAW_GATEWAY_TOKEN:-openclaw}"
-    local trusted_proxies="${OPENCLAW_GATEWAY_TRUSTED_PROXIES:-[\"127.0.0.1\", \"10.0.0.0/8\", \"172.16.0.0/12\", \"192.168.0.0/16\"]}"
-    local user_header="${OPENCLAW_GATEWAY_USER_HEADER:-x-auth-request-email}"
-
-    jq -n \
-      --argjson plugin_paths "[\"$OPENCLAW_PLUGINS_ROOT\"]" \
-      --arg mode "$auth_mode" \
-      --arg token "$token" \
-      --argjson trusted_proxies "$trusted_proxies" \
-      --arg user_header "$user_header" \
-      '{
-        plugins: {
-          load: { paths: $plugin_paths },
-          entries: {}
-        },
-        gateway: {
-          controlUi: {
-            dangerouslyAllowHostHeaderOriginFallback: true,
-            dangerouslyDisableDeviceAuth: true
-          },
-          trustedProxies: $trusted_proxies,
-          auth: {
-            mode: $mode,
-            token: (if $mode == "token" then $token else null end),
-            trustedProxy: (if $mode == "trusted-proxy" then { userHeader: $user_header } else null end)
-          }
-        }
-      } | del(.. | select(. == null))' > "$OPENCLAW_CONFIG_PATH"
-  fi
-}
-
 list_downloaded_plugins() {
   local plugins=()
 
@@ -53,19 +17,23 @@ list_downloaded_plugins() {
     fi
   done
 
-  printf '%s\n' "${plugins[@]}" | jq -R . | jq -s .
+  if [ ${#plugins[@]} -eq 0 ]; then
+    echo "[]"
+  else
+    printf '%s\n' "${plugins[@]}" | jq -R . | jq -s .
+  fi
 }
 
 verify_plugin_manifest() {
   local dest="$1"
-  echo "[INFO] Verifying plugin manifest in $dest ..."
+  echo "[INFO] Verifying plugin manifest in $dest ..." >&2
   if [ ! -f "$dest/openclaw.plugin.json" ]; then
     if ! node -e "const p=require('$dest/package.json'); process.exit(p.openclaw ? 0 : 1)" 2>/dev/null; then
       echo "[ERROR] $dest has neither openclaw.plugin.json nor openclaw field in package.json!" >&2
       return 1
     fi
   fi
-  echo "[OK] Manifest verified at $dest"
+  echo "[OK] Manifest verified at $dest" >&2
 }
 
 add_plugin() {  
diff --git a/docker_openclaw/work/start-openclaw.sh b/docker_openclaw/work/start-openclaw.sh
index 5b96e13..720a575 100644
--- a/docker_openclaw/work/start-openclaw.sh
+++ b/docker_openclaw/work/start-openclaw.sh
@@ -3,44 +3,100 @@ set -eu
 
 export OPENCLAW_HIDE_BANNER=${OPENCLAW_HIDE_BANNER:-1}
 
-mkdir -pv ${OPENCLAW_STATE_DIR}
+mkdir -pv "${OPENCLAW_STATE_DIR}"
+
+# Source helper functions.
+. /opt/openclaw/script-setup-openclaw.sh
 
 bootstrap() {
-  . /opt/openclaw/script-setup-openclaw.sh
+    mkdir -p "$(dirname "$OPENCLAW_CONFIG_PATH")"
+
+    jq -n \
+        --arg plugin_root "$OPENCLAW_PLUGINS_ROOT" \
+        '{
+            plugins: {
+                load: {
+                    paths: [$plugin_root]
+                }
+            },
+            gateway: {
+                controlUi: {
+                    dangerouslyAllowHostHeaderOriginFallback: true,
+                    dangerouslyDisableDeviceAuth: true
+                }
+            }
+        }' > "$OPENCLAW_CONFIG_PATH"
+}
+
+update_config() {
+    local plugins_json
+    local use_trusted_proxy
+    local gateway_token
+    local default_proxies
+    local trusted_proxies
+    local tmp
+
+    plugins_json="$(list_downloaded_plugins)"
+    plugins_json="${plugins_json:-[]}"
+
+    use_trusted_proxy="${OPENCLAW_USE_TRUSTED_PROXY_AUTH:-$( [ -n "${URL_PREFIX:-}" ] && echo true || echo false )}"
+    gateway_token="${OPENCLAW_GATEWAY_TOKEN:-openclaw}"
 
-  init_config
+    default_proxies='["0.0.0.0/0","::/0"]'
+    trusted_proxies="${OPENCLAW_GATEWAY_TRUSTED_PROXIES:-$default_proxies}"
 
-  local plugins_json
-  plugins_json=$(list_downloaded_plugins)
-  plugins_json=${plugins_json:-"[]"}
+    tmp="$(mktemp "${OPENCLAW_CONFIG_PATH}.XXXXXX")"
 
-  jq \
-    --argjson plugins "$plugins_json" \
-    '
-    def build_entries:
-      reduce $plugins[] as $p ({}; .[$p] = {enabled: true});
-    .plugins.entries = build_entries
-    ' "$OPENCLAW_CONFIG_PATH" > "${OPENCLAW_CONFIG_PATH}.tmp" \
-    && mv "${OPENCLAW_CONFIG_PATH}.tmp" "$OPENCLAW_CONFIG_PATH"
+    jq \
+        --argjson plugins "$plugins_json" \
+        --arg token "$gateway_token" \
+        --arg use_proxy "$use_trusted_proxy" \
+        --argjson trusted_proxies "$trusted_proxies" \
+        '
+        def plugin_entries:
+            reduce $plugins[] as $p ({}; .[$p] = {enabled: true});
 
-  echo "[OK] Plugins entries updated"
+        .gateway.mode //= "local"
+        | .plugins.entries |= ((. // {}) + plugin_entries)
+        | .gateway.trustedProxies = $trusted_proxies
+        | if $use_proxy == "true" then
+            .gateway.auth.mode = "trusted-proxy"
+            | .gateway.auth.trustedProxy.userHeader = "x-auth-request-user"
+            | .gateway.auth.trustedProxy.requiredHeaders = []
+            | .gateway.auth.trustedProxy.allowLoopback = true
+            | del(.gateway.auth.token, .gateway.auth.password)
+          else
+            .gateway.auth.mode = "token"
+            | .gateway.auth.token = $token
+            | del(.gateway.auth.trustedProxy, .gateway.auth.password)
+          end
+        ' \
+        "$OPENCLAW_CONFIG_PATH" > "$tmp"
+
+    mv "$tmp" "$OPENCLAW_CONFIG_PATH"
+
+    echo "[OK] Configuration synchronized"
 }
 
-/opt/utils/script-localize.sh "${PROFILE_LOCALIZE:-default}"
-[ ! -f "$OPENCLAW_CONFIG_PATH" ] && bootstrap
+ /opt/utils/script-localize.sh "${PROFILE_LOCALIZE:-default}"
+
+[ -f "$OPENCLAW_CONFIG_PATH" ] || bootstrap
+
+update_config
 
-# If no arguments are passed, use the default gateway startup command
 if [ $# -eq 0 ]; then
-    set -- gateway --allow-unconfigured
+    set -- gateway
 fi
 
-# If the first argument is an executable in PATH (like bash, sh, or openclaw itself), execute it directly
 if command -v "$1" >/dev/null 2>&1; then
     exec "$@"
+elif [ "$1" = "gateway" ]; then
+    shift
+    exec openclaw gateway \
+        --bind "${OPENCLAW_GATEWAY_BIND:-lan}" \
+        --port "${OPENCLAW_GATEWAY_PORT:-18789}" \
+        --allow-unconfigured \
+        "$@"
+else
+    exec openclaw "$@"
 fi
-
-# Otherwise, prepend default bind and port parameters and pass arguments to openclaw CLI
-exec openclaw \
-    --bind "${OPENCLAW_GATEWAY_BIND:-lan}" \
-    --port "${OPENCLAW_GATEWAY_PORT:-18789}" \
-    "$@"