diff --git a/rust/crates/channel-gateway-core/src/unraid_template.rs b/rust/crates/channel-gateway-core/src/unraid_template.rs
index 118fd98..f2ea9af 100644
--- a/rust/crates/channel-gateway-core/src/unraid_template.rs
+++ b/rust/crates/channel-gateway-core/src/unraid_template.rs
@@ -204,8 +204,8 @@ impl UnraidTemplateSpec {
             category: "AI:Tools".to_string(),
             template_url: String::new(),
             icon: String::new(),
-            extra_params: String::new(),
-            post_args: String::new(),
+            extra_params: "--entrypoint claw-profile-worker".to_string(),
+            post_args: "serve".to_string(),
             cpu_set: String::new(),
             requires: String::new(),
             web_ui: None,
@@ -258,5 +258,7 @@ mod tests {
         assert!(xml.contains("Type=\"Variable\""));
         assert!(xml.contains("Mask=\"true\">secret</Config>"));
         assert!(xml.contains("Target=\"/state\""));
+        assert!(xml.contains("<ExtraParams>--entrypoint claw-profile-worker</ExtraParams>"));
+        assert!(xml.contains("<PostArgs>serve</PostArgs>"));
     }
 }
diff --git a/rust/crates/claw-telegram/assets/unraid/claw-telegram-gateway.xml b/rust/crates/claw-telegram/assets/unraid/claw-telegram-gateway.xml
index edab59e..8b655c2 100644
--- a/rust/crates/claw-telegram/assets/unraid/claw-telegram-gateway.xml
+++ b/rust/crates/claw-telegram/assets/unraid/claw-telegram-gateway.xml
@@ -14,8 +14,8 @@
   <WebUI></WebUI>
   <TemplateURL></TemplateURL>
   <Icon></Icon>
-  <ExtraParams></ExtraParams>
-  <PostArgs></PostArgs>
+  <ExtraParams>--entrypoint claw-telegram</ExtraParams>
+  <PostArgs>gateway serve</PostArgs>
   <CPUset></CPUset>
   <DateInstalled>0</DateInstalled>
   <DonateText></DonateText>
@@ -24,10 +24,13 @@
   <Config Name="Docker Socket" Target="/var/run/docker.sock" Default="/var/run/docker.sock" Mode="rw" Description="Docker socket for worker orchestration; this grants root-equivalent control of the host" Type="Path" Display="always" Required="true" Mask="false">/var/run/docker.sock</Config>
   <Config Name="Unraid Templates" Target="/unraid/templates-user" Default="/boot/config/plugins/dockerMan/templates-user" Mode="rw" Description="Unraid template directory" Type="Path" Display="always" Required="true" Mask="false">/boot/config/plugins/dockerMan/templates-user</Config>
   <Config Name="Gateway AppData" Target="/appdata" Default="/mnt/user/appdata/claw-telegram-gateway" Mode="rw" Description="Gateway state and manifest directory" Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/claw-telegram-gateway</Config>
-  <Config Name="CLAW_GATEWAY_TELEGRAM_BOT_TOKEN" Target="CLAW_GATEWAY_TELEGRAM_BOT_TOKEN" Default="" Mode="" Description="Telegram bot token" Type="Variable" Display="always" Required="true" Mask="true"></Config>
+  <Config Name="CLAW_GATEWAY_TELEGRAM_BOT_TOKEN" Target="CLAW_GATEWAY_TELEGRAM_BOT_TOKEN" Default="" Mode="" Description="Telegram bot token used by the gateway ingress" Type="Variable" Display="always" Required="true" Mask="true"></Config>
   <Config Name="CLAW_WORKER_AUTH_TOKEN" Target="CLAW_WORKER_AUTH_TOKEN" Default="" Mode="" Description="Shared bearer token for worker API calls" Type="Variable" Display="always" Required="true" Mask="true"></Config>
   <Config Name="CLAW_GATEWAY_WORKER_IMAGE" Target="CLAW_GATEWAY_WORKER_IMAGE" Default="git.wylab.me/wylab/claw-code-parity:latest" Mode="" Description="Worker image pulled by the gateway for per-profile containers" Type="Variable" Display="always" Required="true" Mask="false">git.wylab.me/wylab/claw-code-parity:latest</Config>
+  <Config Name="CLAW_GATEWAY_STATE_ROOT" Target="CLAW_GATEWAY_STATE_ROOT" Default="/appdata/state" Mode="" Description="Gateway runtime state root for offsets and downloaded files" Type="Variable" Display="advanced" Required="true" Mask="false">/appdata/state</Config>
   <Config Name="CLAW_GATEWAY_MANIFEST" Target="CLAW_GATEWAY_MANIFEST" Default="/appdata/profiles.json" Mode="" Description="Manifest path for channel identities and worker layout" Type="Variable" Display="advanced" Required="true" Mask="false">/appdata/profiles.json</Config>
+  <Config Name="CLAW_GATEWAY_DOCKER_SOCKET" Target="CLAW_GATEWAY_DOCKER_SOCKET" Default="/var/run/docker.sock" Mode="" Description="Docker socket path inside the gateway container" Type="Variable" Display="advanced" Required="true" Mask="false">/var/run/docker.sock</Config>
+  <Config Name="CLAW_GATEWAY_TEMPLATE_DIR" Target="CLAW_GATEWAY_TEMPLATE_DIR" Default="/unraid/templates-user" Mode="" Description="Unraid template directory path inside the gateway container" Type="Variable" Display="advanced" Required="true" Mask="false">/unraid/templates-user</Config>
   <Config Name="CLAW_GATEWAY_TEMPLATE_ARCHIVE_DIR" Target="CLAW_GATEWAY_TEMPLATE_ARCHIVE_DIR" Default="/appdata/template-archive" Mode="" Description="Archive location for removed worker templates" Type="Variable" Display="advanced" Required="true" Mask="false">/appdata/template-archive</Config>
   <Config Name="CLAW_GATEWAY_WORKER_NETWORK" Target="CLAW_GATEWAY_WORKER_NETWORK" Default="claw_gateway" Mode="" Description="Docker network name shared by the gateway and workers" Type="Variable" Display="advanced" Required="true" Mask="false">claw_gateway</Config>
   <Config Name="CLAW_GATEWAY_INHERITED_ENV" Target="CLAW_GATEWAY_INHERITED_ENV" Default="ANTHROPIC_AUTH_TOKEN" Mode="" Description="Comma-separated env vars copied from gateway into worker containers" Type="Variable" Display="advanced" Required="false" Mask="false">ANTHROPIC_AUTH_TOKEN</Config>
diff --git a/rust/crates/claw-telegram/src/unraid_template_manager.rs b/rust/crates/claw-telegram/src/unraid_template_manager.rs
index 91e08a3..ef72c61 100644
--- a/rust/crates/claw-telegram/src/unraid_template_manager.rs
+++ b/rust/crates/claw-telegram/src/unraid_template_manager.rs
@@ -115,7 +115,7 @@ impl UnraidTemplateManager {
         repository: &str,
     ) -> Result<(), TemplateError> {
         let xml = format!(
-            "<?xml version=\"1.0\"?>\n<Container version=\"2\">\n  <Name>claw-telegram-gateway</Name>\n  <Repository>{repository}</Repository>\n  <Registry></Registry>\n  <Network>claw_gateway</Network>\n  <MyIP></MyIP>\n  <Shell>sh</Shell>\n  <Privileged>false</Privileged>\n  <Support>https://git.wylab.me/wylab/claw-code-parity</Support>\n  <Project>claw-code-parity</Project>\n  <Overview>Telegram gateway with Docker-socket worker management. Warning: mounting the Docker socket grants the container root-equivalent control over the Unraid host.</Overview>\n  <Category>AI:Tools</Category>\n  <WebUI></WebUI>\n  <TemplateURL></TemplateURL>\n  <Icon></Icon>\n  <ExtraParams></ExtraParams>\n  <PostArgs></PostArgs>\n  <CPUset></CPUset>\n  <DateInstalled>{}</DateInstalled>\n  <DonateText></DonateText>\n  <DonateLink></DonateLink>\n  <Requires></Requires>\n  <Config Name=\"Docker Socket\" Target=\"/var/run/docker.sock\" Default=\"/var/run/docker.sock\" Mode=\"rw\" Description=\"Docker socket for worker orchestration; this grants root-equivalent control of the host\" Type=\"Path\" Display=\"always\" Required=\"true\" Mask=\"false\">/var/run/docker.sock</Config>\n  <Config Name=\"Unraid Templates\" Target=\"/unraid/templates-user\" Default=\"/boot/config/plugins/dockerMan/templates-user\" Mode=\"rw\" Description=\"Unraid template directory\" Type=\"Path\" Display=\"always\" Required=\"true\" Mask=\"false\">/boot/config/plugins/dockerMan/templates-user</Config>\n  <Config Name=\"Gateway AppData\" Target=\"/appdata\" Default=\"/mnt/user/appdata/claw-telegram-gateway\" Mode=\"rw\" Description=\"Gateway state and manifest directory\" Type=\"Path\" Display=\"always\" Required=\"true\" Mask=\"false\">/mnt/user/appdata/claw-telegram-gateway</Config>\n  <Config Name=\"CLAW_GATEWAY_TELEGRAM_BOT_TOKEN\" Target=\"CLAW_GATEWAY_TELEGRAM_BOT_TOKEN\" Default=\"\" Mode=\"\" Description=\"Telegram bot token\" Type=\"Variable\" Display=\"always\" Required=\"true\" Mask=\"true\"></Config>\n  <Config Name=\"CLAW_WORKER_AUTH_TOKEN\" Target=\"CLAW_WORKER_AUTH_TOKEN\" Default=\"\" Mode=\"\" Description=\"Shared bearer token for worker API calls\" Type=\"Variable\" Display=\"always\" Required=\"true\" Mask=\"true\"></Config>\n  <Config Name=\"CLAW_GATEWAY_INHERITED_ENV\" Target=\"CLAW_GATEWAY_INHERITED_ENV\" Default=\"ANTHROPIC_AUTH_TOKEN\" Mode=\"\" Description=\"Comma-separated env vars copied from gateway into worker containers\" Type=\"Variable\" Display=\"advanced\" Required=\"false\" Mask=\"false\">ANTHROPIC_AUTH_TOKEN</Config>\n  <Config Name=\"CLAW_GATEWAY_WORKER_READY_TIMEOUT_SECS\" Target=\"CLAW_GATEWAY_WORKER_READY_TIMEOUT_SECS\" Default=\"15\" Mode=\"\" Description=\"Seconds to wait for a worker container to pass its health check\" Type=\"Variable\" Display=\"advanced\" Required=\"false\" Mask=\"false\">15</Config>\n  <Config Name=\"ANTHROPIC_AUTH_TOKEN\" Target=\"ANTHROPIC_AUTH_TOKEN\" Default=\"\" Mode=\"\" Description=\"Anthropic OAuth bearer token inherited by worker containers\" Type=\"Variable\" Display=\"advanced\" Required=\"false\" Mask=\"true\"></Config>\n  <Config Name=\"ANTHROPIC_API_KEY\" Target=\"ANTHROPIC_API_KEY\" Default=\"\" Mode=\"\" Description=\"Optional legacy Anthropic API key if you do not use OAuth bearer auth\" Type=\"Variable\" Display=\"advanced\" Required=\"false\" Mask=\"true\"></Config>\n  <TailscaleStateDir></TailscaleStateDir>\n</Container>\n",
+            "<?xml version=\"1.0\"?>\n<Container version=\"2\">\n  <Name>claw-telegram-gateway</Name>\n  <Repository>{repository}</Repository>\n  <Registry></Registry>\n  <Network>claw_gateway</Network>\n  <MyIP></MyIP>\n  <Shell>sh</Shell>\n  <Privileged>false</Privileged>\n  <Support>https://git.wylab.me/wylab/claw-code-parity</Support>\n  <Project>claw-code-parity</Project>\n  <Overview>Telegram gateway with Docker-socket worker management. Warning: mounting the Docker socket grants the container root-equivalent control over the Unraid host.</Overview>\n  <Category>AI:Tools</Category>\n  <WebUI></WebUI>\n  <TemplateURL></TemplateURL>\n  <Icon></Icon>\n  <ExtraParams>--entrypoint claw-telegram</ExtraParams>\n  <PostArgs>gateway serve</PostArgs>\n  <CPUset></CPUset>\n  <DateInstalled>{}</DateInstalled>\n  <DonateText></DonateText>\n  <DonateLink></DonateLink>\n  <Requires></Requires>\n  <Config Name=\"Docker Socket\" Target=\"/var/run/docker.sock\" Default=\"/var/run/docker.sock\" Mode=\"rw\" Description=\"Docker socket for worker orchestration; this grants root-equivalent control of the host\" Type=\"Path\" Display=\"always\" Required=\"true\" Mask=\"false\">/var/run/docker.sock</Config>\n  <Config Name=\"Unraid Templates\" Target=\"/unraid/templates-user\" Default=\"/boot/config/plugins/dockerMan/templates-user\" Mode=\"rw\" Description=\"Unraid template directory\" Type=\"Path\" Display=\"always\" Required=\"true\" Mask=\"false\">/boot/config/plugins/dockerMan/templates-user</Config>\n  <Config Name=\"Gateway AppData\" Target=\"/appdata\" Default=\"/mnt/user/appdata/claw-telegram-gateway\" Mode=\"rw\" Description=\"Gateway state and manifest directory\" Type=\"Path\" Display=\"always\" Required=\"true\" Mask=\"false\">/mnt/user/appdata/claw-telegram-gateway</Config>\n  <Config Name=\"CLAW_GATEWAY_TELEGRAM_BOT_TOKEN\" Target=\"CLAW_GATEWAY_TELEGRAM_BOT_TOKEN\" Default=\"\" Mode=\"\" Description=\"Telegram bot token used by the gateway ingress\" Type=\"Variable\" Display=\"always\" Required=\"true\" Mask=\"true\"></Config>\n  <Config Name=\"CLAW_WORKER_AUTH_TOKEN\" Target=\"CLAW_WORKER_AUTH_TOKEN\" Default=\"\" Mode=\"\" Description=\"Shared bearer token for worker API calls\" Type=\"Variable\" Display=\"always\" Required=\"true\" Mask=\"true\"></Config>\n  <Config Name=\"CLAW_GATEWAY_WORKER_IMAGE\" Target=\"CLAW_GATEWAY_WORKER_IMAGE\" Default=\"{repository}\" Mode=\"\" Description=\"Worker image pulled by the gateway for per-profile containers\" Type=\"Variable\" Display=\"always\" Required=\"true\" Mask=\"false\">{repository}</Config>\n  <Config Name=\"CLAW_GATEWAY_STATE_ROOT\" Target=\"CLAW_GATEWAY_STATE_ROOT\" Default=\"/appdata/state\" Mode=\"\" Description=\"Gateway runtime state root for offsets and downloaded files\" Type=\"Variable\" Display=\"advanced\" Required=\"true\" Mask=\"false\">/appdata/state</Config>\n  <Config Name=\"CLAW_GATEWAY_MANIFEST\" Target=\"CLAW_GATEWAY_MANIFEST\" Default=\"/appdata/profiles.json\" Mode=\"\" Description=\"Manifest path for channel identities and worker layout\" Type=\"Variable\" Display=\"advanced\" Required=\"true\" Mask=\"false\">/appdata/profiles.json</Config>\n  <Config Name=\"CLAW_GATEWAY_DOCKER_SOCKET\" Target=\"CLAW_GATEWAY_DOCKER_SOCKET\" Default=\"/var/run/docker.sock\" Mode=\"\" Description=\"Docker socket path inside the gateway container\" Type=\"Variable\" Display=\"advanced\" Required=\"true\" Mask=\"false\">/var/run/docker.sock</Config>\n  <Config Name=\"CLAW_GATEWAY_TEMPLATE_DIR\" Target=\"CLAW_GATEWAY_TEMPLATE_DIR\" Default=\"/unraid/templates-user\" Mode=\"\" Description=\"Unraid template directory path inside the gateway container\" Type=\"Variable\" Display=\"advanced\" Required=\"true\" Mask=\"false\">/unraid/templates-user</Config>\n  <Config Name=\"CLAW_GATEWAY_TEMPLATE_ARCHIVE_DIR\" Target=\"CLAW_GATEWAY_TEMPLATE_ARCHIVE_DIR\" Default=\"/appdata/template-archive\" Mode=\"\" Description=\"Archive location for removed worker templates\" Type=\"Variable\" Display=\"advanced\" Required=\"true\" Mask=\"false\">/appdata/template-archive</Config>\n  <Config Name=\"CLAW_GATEWAY_WORKER_NETWORK\" Target=\"CLAW_GATEWAY_WORKER_NETWORK\" Default=\"claw_gateway\" Mode=\"\" Description=\"Docker network name shared by the gateway and workers\" Type=\"Variable\" Display=\"advanced\" Required=\"true\" Mask=\"false\">claw_gateway</Config>\n  <Config Name=\"CLAW_GATEWAY_INHERITED_ENV\" Target=\"CLAW_GATEWAY_INHERITED_ENV\" Default=\"ANTHROPIC_AUTH_TOKEN\" Mode=\"\" Description=\"Comma-separated env vars copied from gateway into worker containers\" Type=\"Variable\" Display=\"advanced\" Required=\"false\" Mask=\"false\">ANTHROPIC_AUTH_TOKEN</Config>\n  <Config Name=\"CLAW_GATEWAY_WORKER_READY_TIMEOUT_SECS\" Target=\"CLAW_GATEWAY_WORKER_READY_TIMEOUT_SECS\" Default=\"15\" Mode=\"\" Description=\"Seconds to wait for a worker container to pass its health check\" Type=\"Variable\" Display=\"advanced\" Required=\"false\" Mask=\"false\">15</Config>\n  <Config Name=\"ANTHROPIC_AUTH_TOKEN\" Target=\"ANTHROPIC_AUTH_TOKEN\" Default=\"\" Mode=\"\" Description=\"Anthropic OAuth bearer token inherited by worker containers\" Type=\"Variable\" Display=\"advanced\" Required=\"false\" Mask=\"true\"></Config>\n  <Config Name=\"ANTHROPIC_API_KEY\" Target=\"ANTHROPIC_API_KEY\" Default=\"\" Mode=\"\" Description=\"Optional legacy Anthropic API key if you do not use OAuth bearer auth\" Type=\"Variable\" Display=\"advanced\" Required=\"false\" Mask=\"true\"></Config>\n  <TailscaleStateDir></TailscaleStateDir>\n</Container>\n",
             current_timestamp_secs()
         );
         let destination = destination.as_ref();