diff --git a/services/openclaw/configmap.yaml b/services/openclaw/configmap.yaml
index 125deca3..e495d372 100644
--- a/services/openclaw/configmap.yaml
+++ b/services/openclaw/configmap.yaml
@@ -39,8 +39,14 @@ data:
         },
         "port": 18789,
         "bind": "lan",
+        "trustedProxies": ["10.42.0.0/16"],
         "controlUi": {
-          "enabled": true
+          "enabled": true,
+          "allowedOrigins": [
+            "http://localhost:18789",
+            "http://127.0.0.1:18789",
+            "https://agent.bstein.dev"
+          ]
         },
         "tailscale": {
           "mode": "off",
diff --git a/services/openclaw/deployment.yaml b/services/openclaw/deployment.yaml
index d1e6c69d..535def93 100644
--- a/services/openclaw/deployment.yaml
+++ b/services/openclaw/deployment.yaml
@@ -23,7 +23,7 @@ spec:
         ai.bstein.dev/instructions: kubectl-field-selectors
         ai.bstein.dev/role: testing-triage
         ai.bstein.dev/placement: arm64 gateway lane (jetson preferred)
-        ai.bstein.dev/config-rev: "20260520-local-triage"
+        ai.bstein.dev/config-rev: "20260520-agent-origin"
     spec:
       serviceAccountName: openclaw-triage
       automountServiceAccountToken: true