diff --git a/scripts/render-start.sh b/scripts/render-start.sh
index 7a198436f..1f804657c 100755
--- a/scripts/render-start.sh
+++ b/scripts/render-start.sh
@@ -1,11 +1,12 @@
 #!/bin/sh
 # Render startup script - creates config and starts gateway
+set -e
 
 # Create config directory
-mkdir -p /data/.clawdbot
+mkdir -p "$CLAWDBOT_STATE_DIR"
 
 # Write config file with Render-specific settings
-cat > /data/.clawdbot/clawdbot.json << 'EOF'
+cat > "$CLAWDBOT_STATE_DIR/clawdbot.json" << 'EOF'
 {
   "gateway": {
     "trustedProxies": ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"],
@@ -16,9 +17,12 @@ cat > /data/.clawdbot/clawdbot.json << 'EOF'
 }
 EOF
 
-# Start the gateway
+echo "Config written to $CLAWDBOT_STATE_DIR/clawdbot.json"
+
+# Start the gateway with password from env var
 exec node dist/index.js gateway \
   --port 8080 \
   --bind lan \
   --auth password \
+  --password "$CLAWDBOT_GATEWAY_PASSWORD" \
   --allow-unconfigured