Fix: use gateway.controlUi.pairing = false

start.sh

@@ -157,9 +157,8 @@ if [ -n "$SPACE_HOST" ]; then
   CONFIG_JSON=$(echo "$CONFIG_JSON" | jq ".gateway.controlUi.allowedOrigins = [\"https://${SPACE_HOST}\"]")
 fi
 
-# Disable pairing for headless/Docker — allow open connections
-# Note: This allows any client with the gateway token. Only use in trusted networks.
-CONFIG_JSON=$(echo "$CONFIG_JSON" | jq ".channels.control_ui = {\"dmPolicy\": \"open\", \"allowFrom\": [\"*\"]}")
+# Disable pairing for Control UI connections (headless/Docker)
+CONFIG_JSON=$(echo "$CONFIG_JSON" | jq ".gateway.controlUi.pairing = false")
 
 # Telegram (supports multiple user IDs, comma-separated)
 if [ -n "$TELEGRAM_BOT_TOKEN" ]; then