diff --git a/packages/secubox-openclaw/conf/openclaw.toml.example b/packages/secubox-openclaw/conf/openclaw.toml.example
new file mode 100644
index 00000000..afd13dad
--- /dev/null
+++ b/packages/secubox-openclaw/conf/openclaw.toml.example
@@ -0,0 +1,12 @@
+# /etc/secubox/openclaw.toml — cp from this example.
+enabled = true
+container_name = "openclaw"
+lxc_ip = "10.100.0.41"
+# Active nmap scans are auto-allowed for RFC1918/LAN + these owned suffixes;
+# any other external active target needs an explicit authorized=true per scan.
+owned_domains = ["gk2.secubox.in"]
+# Optional OSINT integrations (leave blank to disable). Put real keys in
+# /etc/secubox/secrets/ (chmod 600) if you prefer them off the TOML.
+# shodan_api_key = ""
+# censys_api_id = ""
+# virustotal_api_key = ""
diff --git a/packages/secubox-openclaw/debian/control b/packages/secubox-openclaw/debian/control
index 51ff7d24..ad08e834 100644
--- a/packages/secubox-openclaw/debian/control
+++ b/packages/secubox-openclaw/debian/control
@@ -7,7 +7,7 @@ Standards-Version: 4.6.2
 
 Package: secubox-openclaw
 Architecture: all
-Depends: ${misc:Depends}, secubox-core (>= 1.0.0), dnsutils, whois, curl
+Depends: ${misc:Depends}, secubox-core (>= 1.0.0), debootstrap, lxc, jq
 Recommends: nmap
 Description: SecuBox OpenClaw OSINT Module
  Open Source Intelligence (OSINT) tool for reconnaissance and
diff --git a/packages/secubox-openclaw/debian/postinst b/packages/secubox-openclaw/debian/postinst
index e2ef4935..07d8ce30 100755
--- a/packages/secubox-openclaw/debian/postinst
+++ b/packages/secubox-openclaw/debian/postinst
@@ -1,6 +1,13 @@
 #!/bin/sh
 set -e
 if [ "$1" = "configure" ]; then
+    if [ -f /etc/sudoers.d/secubox-openclaw ]; then
+        visudo -cf /etc/sudoers.d/secubox-openclaw >/dev/null || {
+            echo "secubox-openclaw: invalid sudoers, removing" >&2
+            rm -f /etc/sudoers.d/secubox-openclaw
+        }
+    fi
+
     # Create data directories. The openclaw FastAPI imports a module that
     # touches /var/lib/secubox/openclaw/scans at import time, so the user
     # that loads it MUST be able to traverse the parent dir. Under
@@ -14,10 +21,9 @@ if [ "$1" = "configure" ]; then
     chmod 0755 /var/lib/secubox/openclaw
     chmod 0750 /var/lib/secubox/openclaw/scans
 
-    # Enable and start service
+    # The aggregator serves this module in-process (imports api/main.py as
+    # user secubox) — do NOT enable the dedicated secubox-openclaw.service.
     systemctl daemon-reload
-    systemctl enable secubox-openclaw.service || true
-    systemctl start secubox-openclaw.service || true
 
     # Reload nginx if available
     if systemctl is-active --quiet nginx; then
diff --git a/packages/secubox-openclaw/debian/rules b/packages/secubox-openclaw/debian/rules
index 86540550..07eb31ea 100755
--- a/packages/secubox-openclaw/debian/rules
+++ b/packages/secubox-openclaw/debian/rules
@@ -13,3 +13,16 @@ override_dh_auto_install:
 	[ -d nginx ] && cp -r nginx/. debian/secubox-openclaw/etc/nginx/secubox.d/ || true
 	install -d debian/secubox-openclaw/lib/systemd/system
 	[ -d systemd ] && cp systemd/*.service debian/secubox-openclaw/lib/systemd/system/ || true
+
+	install -d debian/secubox-openclaw/usr/sbin
+	install -m 755 sbin/openclawctl debian/secubox-openclaw/usr/sbin/openclawctl
+
+	# Sudoers drop-in: lets the aggregator (user secubox) drive openclawctl
+	# as root without a password — the ONLY privileged surface for the module.
+	install -d debian/secubox-openclaw/etc/sudoers.d
+	install -m 440 debian/secubox-openclaw.sudoers debian/secubox-openclaw/etc/sudoers.d/secubox-openclaw
+
+	# Operator config example. Shipped to /etc/secubox/ so operators can
+	# `cp openclaw.toml.example openclaw.toml` without hunting for keys.
+	install -d debian/secubox-openclaw/etc/secubox
+	install -m 644 conf/openclaw.toml.example debian/secubox-openclaw/etc/secubox/openclaw.toml.example
diff --git a/packages/secubox-openclaw/debian/secubox-openclaw.sudoers b/packages/secubox-openclaw/debian/secubox-openclaw.sudoers
new file mode 100644
index 00000000..130765f1
--- /dev/null
+++ b/packages/secubox-openclaw/debian/secubox-openclaw.sudoers
@@ -0,0 +1,3 @@
+# The aggregator (user secubox) drives the OpenClaw LXC through openclawctl.
+# This is the ONLY privileged surface for the module.
+secubox ALL=(root) NOPASSWD: /usr/sbin/openclawctl