diff --git a/docs/gateway/index.md b/docs/gateway/index.md
index de5f1b0ecbe..70439cbb4a1 100644
--- a/docs/gateway/index.md
+++ b/docs/gateway/index.md
@@ -202,6 +202,22 @@ WantedBy=default.target
+
+
+```powershell
+openclaw gateway install
+openclaw gateway status --json
+openclaw gateway restart
+openclaw gateway stop
+```
+
+Native Windows managed startup uses a Scheduled Task named `OpenClaw Gateway`
+(or `OpenClaw Gateway ()` for named profiles). If Scheduled Task
+creation is denied, OpenClaw falls back to a per-user Startup-folder launcher
+that points at `gateway.cmd` inside the state directory.
+
+
+
Use a system unit for multi-user/always-on hosts.
diff --git a/docs/install/index.md b/docs/install/index.md
index a3fe18e8f21..efbdb3a89e6 100644
--- a/docs/install/index.md
+++ b/docs/install/index.md
@@ -133,6 +133,12 @@ openclaw doctor # check for config issues
openclaw gateway status # verify the Gateway is running
```
+If you want managed startup after install:
+
+- macOS: LaunchAgent via `openclaw onboard --install-daemon` or `openclaw gateway install`
+- Linux/WSL2: systemd user service via the same commands
+- Native Windows: Scheduled Task first, with a per-user Startup-folder login item fallback if task creation is denied
+
## Hosting and deployment
Deploy OpenClaw on a cloud server or VPS:
diff --git a/docs/platforms/index.md b/docs/platforms/index.md
index 37a0a47a6fb..34c28e4c62b 100644
--- a/docs/platforms/index.md
+++ b/docs/platforms/index.md
@@ -52,3 +52,4 @@ The service target depends on OS:
- macOS: LaunchAgent (`ai.openclaw.gateway` or `ai.openclaw.`; legacy `com.openclaw.*`)
- Linux/WSL2: systemd user service (`openclaw-gateway[-].service`)
+- Native Windows: Scheduled Task (`OpenClaw Gateway` or `OpenClaw Gateway ()`), with a per-user Startup-folder login item fallback if task creation is denied
diff --git a/docs/start/wizard-cli-reference.md b/docs/start/wizard-cli-reference.md
index a5b43c157ca..5b53ee757dc 100644
--- a/docs/start/wizard-cli-reference.md
+++ b/docs/start/wizard-cli-reference.md
@@ -20,7 +20,7 @@ Local mode (default) walks you through:
- Workspace location and bootstrap files
- Gateway settings (port, bind, auth, tailscale)
- Channels and providers (Telegram, WhatsApp, Discord, Google Chat, Mattermost plugin, Signal)
-- Daemon install (LaunchAgent or systemd user unit)
+- Daemon install (LaunchAgent, systemd user unit, or native Windows Scheduled Task with Startup-folder fallback)
- Health check
- Skills setup
@@ -79,6 +79,9 @@ It does not install or modify anything on the remote host.
- Linux and Windows via WSL2: systemd user unit
- Wizard attempts `loginctl enable-linger ` so gateway stays up after logout.
- May prompt for sudo (writes `/var/lib/systemd/linger`); it tries without sudo first.
+ - Native Windows: Scheduled Task first
+ - If task creation is denied, OpenClaw falls back to a per-user Startup-folder login item and starts the gateway immediately.
+ - Scheduled Tasks remain preferred because they provide better supervisor status.
- Runtime selection: Node (recommended; required for WhatsApp and Telegram). Bun is not recommended.
diff --git a/docs/start/wizard.md b/docs/start/wizard.md
index 254130851b8..c5fcd4489b4 100644
--- a/docs/start/wizard.md
+++ b/docs/start/wizard.md
@@ -78,7 +78,7 @@ Onboarding starts with **QuickStart** (defaults) vs **Advanced** (full control).
In interactive token mode, choose default plaintext token storage or opt into SecretRef.
Non-interactive token SecretRef path: `--gateway-token-ref-env `.
4. **Channels** — WhatsApp, Telegram, Discord, Google Chat, Mattermost, Signal, BlueBubbles, or iMessage.
-5. **Daemon** — Installs a LaunchAgent (macOS) or systemd user unit (Linux/WSL2).
+5. **Daemon** — Installs a LaunchAgent (macOS), systemd user unit (Linux/WSL2), or native Windows Scheduled Task with per-user Startup-folder fallback.
If token auth requires a token and `gateway.auth.token` is SecretRef-managed, daemon install validates it but does not persist the resolved token into supervisor service environment metadata.
If token auth requires a token and the configured token SecretRef is unresolved, daemon install is blocked with actionable guidance.
If both `gateway.auth.token` and `gateway.auth.password` are configured and `gateway.auth.mode` is unset, daemon install is blocked until mode is set explicitly.