diff --git a/src/gateway/env.ts b/src/gateway/env.ts
index d9e01171b..1ecc6a3cd 100644
--- a/src/gateway/env.ts
+++ b/src/gateway/env.ts
@@ -47,6 +47,7 @@ export function buildEnvVars(env: MoltbotEnv): Record<string, string> {
   if (env.SLACK_APP_TOKEN) envVars.SLACK_APP_TOKEN = env.SLACK_APP_TOKEN;
   if (env.CF_AI_GATEWAY_MODEL) envVars.CF_AI_GATEWAY_MODEL = env.CF_AI_GATEWAY_MODEL;
   if (env.CF_ACCOUNT_ID) envVars.CF_ACCOUNT_ID = env.CF_ACCOUNT_ID;
+  if (env.OPENCLAW_AUTO_UPDATE) envVars.OPENCLAW_AUTO_UPDATE = env.OPENCLAW_AUTO_UPDATE;
   if (env.CDP_SECRET) envVars.CDP_SECRET = env.CDP_SECRET;
   if (env.WORKER_URL) envVars.WORKER_URL = env.WORKER_URL;
 
diff --git a/src/types.ts b/src/types.ts
index a85d32da3..97112bce7 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -24,6 +24,7 @@ export interface MoltbotEnv {
   E2E_TEST_MODE?: string; // Set to 'true' for E2E tests (skips CF Access auth but keeps device pairing)
   DEBUG_ROUTES?: string; // Set to 'true' to enable /debug/* routes
   SANDBOX_SLEEP_AFTER?: string; // How long before sandbox sleeps: 'never' (default), or duration like '10m', '1h'
+  OPENCLAW_AUTO_UPDATE?: string; // Set to 'true' to auto-update openclaw on container boot
   TELEGRAM_BOT_TOKEN?: string;
   TELEGRAM_DM_POLICY?: string;
   DISCORD_BOT_TOKEN?: string;
diff --git a/start-openclaw.sh b/start-openclaw.sh
index c862a80ce..5ceea90a0 100644
--- a/start-openclaw.sh
+++ b/start-openclaw.sh
@@ -98,6 +98,28 @@ else
     echo "R2 not configured, starting fresh"
 fi
 
+# ============================================================
+# SELF-UPDATE OPENCLAW (opt-in via OPENCLAW_AUTO_UPDATE=true)
+# ============================================================
+# When enabled, updates openclaw to the latest npm version on every cold start
+# so bug fixes and new features land without a full wrangler deploy.
+# The Dockerfile-pinned version serves as a fallback if npm is unreachable.
+if [ "$OPENCLAW_AUTO_UPDATE" = "true" ]; then
+    CURRENT_VER=$(openclaw --version 2>/dev/null || echo "unknown")
+    echo "Current openclaw version: $CURRENT_VER"
+    echo "Auto-update enabled, checking for updates..."
+    if npm install -g openclaw@latest --prefer-online 2>&1; then
+        NEW_VER=$(openclaw --version 2>/dev/null || echo "unknown")
+        if [ "$CURRENT_VER" != "$NEW_VER" ]; then
+            echo "Updated openclaw: $CURRENT_VER -> $NEW_VER"
+        else
+            echo "openclaw is already at latest ($CURRENT_VER)"
+        fi
+    else
+        echo "WARNING: openclaw update failed, continuing with $CURRENT_VER"
+    fi
+fi
+
 # ============================================================
 # ONBOARD (only if no config exists yet)
 # ============================================================