diff --git a/stacks/openclaw/main.tf b/stacks/openclaw/main.tf
index 158ecfbb..3d670f7f 100644
--- a/stacks/openclaw/main.tf
+++ b/stacks/openclaw/main.tf
@@ -183,7 +183,7 @@ resource "kubernetes_config_map" "openclaw_config" {
         }
       }
       plugins = {
-        allow = ["memory-core"]
+        allow = ["memory-core", "recruiter-api"]
         slots = { memory = "memory-core" }
         load = {
           # /app/extensions is the legacy bundled-plugins path; OpenClaw
@@ -516,6 +516,12 @@ resource "kubernetes_deployment" "openclaw" {
             node openclaw.mjs mcp set ha "{\"url\":\"$HA_SOFIA_MCP_URL\",\"transport\":\"streamable-http\"}" 2>/dev/null
             node openclaw.mjs mcp set context7 '{"command":"npx","args":["-y","@upstash/context7-mcp"]}' 2>/dev/null
             node openclaw.mjs mcp set playwright '{"url":"http://localhost:3000/mcp","transport":"streamable-http"}' 2>/dev/null
+            # doctor --fix overwrites plugins.allow with its bundled-plugins
+            # list. Re-add our third-party plugin to the allow list via
+            # `config patch`, then enable it. (Same pattern as mcp set above.)
+            echo '{"plugins":{"allow":["memory-core","recruiter-api","telegram","openrouter","brave","openai","codex"]}}' \
+              | node openclaw.mjs config patch --stdin 2>/dev/null || true
+            node openclaw.mjs plugins enable recruiter-api 2>/dev/null || true
             exec node openclaw.mjs gateway --allow-unconfigured --bind lan
           EOC
           ]
diff --git a/stacks/recruiter-responder/terragrunt.hcl b/stacks/recruiter-responder/terragrunt.hcl
index ba47b0f7..9f09ba90 100644
--- a/stacks/recruiter-responder/terragrunt.hcl
+++ b/stacks/recruiter-responder/terragrunt.hcl
@@ -19,5 +19,5 @@ dependency "external-secrets" {
 
 inputs = {
   # Override per-deploy in CI / commit.
-  image_tag = "d7892396"
+  image_tag = "83ffd9fa"
 }