diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0c8e276f3d4..c1a3b59b360 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ Docs: https://docs.openclaw.ai
 ### Fixes
 
 - Discord/voice: merge configured media-understanding providers such as Deepgram into partial active provider registries, so follow-up voice turns keep transcribing after another media plugin is already active. Fixes #65687. Thanks @OneMintJulep.
+- WhatsApp: stage `qrcode` with the WhatsApp plugin runtime dependencies so packaged QR pairing can render from staged plugin-runtime-deps installs. Fixes #75394. Thanks @FelipeX2001.
 - Discord/voice: apply per-channel Discord `systemPrompt` overrides to voice transcript turns by forwarding the trusted channel prompt through the voice agent run. Fixes #47095. Thanks @qearlyao.
 - Discord/voice: run voice-channel turns under a voice-output policy that hides the agent `tts` tool and asks for spoken reply text, so `/vc join` sessions synthesize and play agent replies instead of ending with `NO_REPLY`. Fixes #61536. Thanks @aounakram.
 - Plugins/runtime-deps: include packaged OpenClaw identity in bundled plugin loader cache keys, so same-path package upgrades stop reusing stale versioned runtime-deps mirrors. Fixes #75045. Thanks @sahilsatralkar.
diff --git a/extensions/whatsapp/package.json b/extensions/whatsapp/package.json
index 3e44e2e9485..ef398217bf2 100644
--- a/extensions/whatsapp/package.json
+++ b/extensions/whatsapp/package.json
@@ -7,6 +7,7 @@
     "@whiskeysockets/baileys": "7.0.0-rc.9",
     "https-proxy-agent": "^9.0.0",
     "jimp": "^1.6.1",
+    "qrcode": "1.5.4",
     "typebox": "1.1.34",
     "undici": "8.1.0"
   },
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 9aca7c7c1e5..c752cbe3ef4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1458,6 +1458,9 @@ importers:
       jimp:
         specifier: ^1.6.1
         version: 1.6.1
+      qrcode:
+        specifier: 1.5.4
+        version: 1.5.4
       typebox:
         specifier: 1.1.34
         version: 1.1.34
diff --git a/src/plugins/bundled-runtime-deps-drift.test.ts b/src/plugins/bundled-runtime-deps-drift.test.ts
index 6094359c643..1b60da8609e 100644
--- a/src/plugins/bundled-runtime-deps-drift.test.ts
+++ b/src/plugins/bundled-runtime-deps-drift.test.ts
@@ -13,7 +13,7 @@ describe("mirrored root runtime dependency drift guard", () => {
     "file-type", // available transitively via mirrored deps
     "ipaddr.js", // available transitively via mirrored deps
     "proxy-agent", // available transitively via mirrored deps
-    "qrcode", // type-only import in src/media/qr-runtime.ts
+    "qrcode", // QR setup flows stage this through the owning channel plugin, not the root mirror
     "typescript", // CLI/dev only (api-baseline, jiti-runtime-api)
   ]);