diff --git a/deploy/helm/pieced-operator/Chart.yaml b/deploy/helm/pieced-operator/Chart.yaml
index 7c8c101..e475214 100644
--- a/deploy/helm/pieced-operator/Chart.yaml
+++ b/deploy/helm/pieced-operator/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: pieced-operator
 description: PieCed IT tenant lifecycle operator
-version: 0.1.47
-appVersion: "0.1.47"
+version: 0.1.48
+appVersion: "0.1.48"
 type: application
diff --git a/deploy/helm/pieced-operator/templates/catalog-cm.yaml b/deploy/helm/pieced-operator/templates/catalog-cm.yaml
index ce5af67..b0d2c44 100644
--- a/deploy/helm/pieced-operator/templates/catalog-cm.yaml
+++ b/deploy/helm/pieced-operator/templates/catalog-cm.yaml
@@ -297,6 +297,30 @@ data:
         egress_rules:
           - namespace: threema-gateway
             port: 8080
+        # OpenClaw 2026.5.x loads external plugins from
+        # /data/extensions/<dir>/openclaw.plugin.json. Three gates must
+        # be open for the runtime to register an external plugin:
+        #   1. plugins.enabled: true             — feature flag
+        #   2. plugins.allow contains the id     — security allowlist
+        #   3. plugins.entries.<id>.enabled: true — per-plugin toggle
+        # Cedric's personal instance.yaml hand-codes the same three gates
+        # for his direct `openclaw-channel-threema` plugin; this patch
+        # generates them automatically for every tenant that enables
+        # threema. The init container that copies the plugin onto the
+        # PVC is emitted by the operator (plugin_image below).
+        config_patch:
+          plugins:
+            enabled: true
+            allow:
+              - "threema"
+            entries:
+              threema:
+                enabled: true
+                config: {}
+        plugin_image:
+          repository: registry.c5ai.ch/pieced/openclaw-channel-threema-relay
+          tag: "0.1.0"
+          target_dir: openclaw-channel-threema-relay
         customer_instructions: |
           1. Once enabled, register the Threema IDs you want to receive
              messages from under "Authorized Users → threema".
diff --git a/deploy/helm/pieced-operator/values.yaml b/deploy/helm/pieced-operator/values.yaml
index 80005a4..5b79c96 100644
--- a/deploy/helm/pieced-operator/values.yaml
+++ b/deploy/helm/pieced-operator/values.yaml
@@ -1,6 +1,6 @@
 image:
   repository: registry.c5ai.ch/pieced/pieced-operator
-  tag: "0.1.47"
+  tag: "0.1.48"
   pullPolicy: IfNotPresent
 
 imagePullSecrets: