- Create render-start.sh that writes config before starting gateway - Configure gateway.trustedProxies for Render's internal network - Enable gateway.controlUi.allowInsecureAuth to skip device pairing