diff --git a/cluster_config.json b/cluster_config.json
index 58aa8a170..d8433ef24 100644
--- a/cluster_config.json
+++ b/cluster_config.json
@@ -196,6 +196,7 @@
     },
     "pico": {
       "enabled": true,
+      "token": "picoclaw-secret-123",
       "allow_token_query": true,
       "ping_interval": 30,
       "read_timeout": 60,
diff --git a/k3s/configmap.yaml b/k3s/configmap.yaml
index 2197bba6a..310cbce1e 100644
--- a/k3s/configmap.yaml
+++ b/k3s/configmap.yaml
@@ -203,6 +203,7 @@ data:
         },
         "pico": {
           "enabled": true,
+          "token": "picoclaw-secret-123",
           "allow_token_query": true,
           "ping_interval": 30,
           "read_timeout": 60,
diff --git a/pkg/gateway/gateway.go b/pkg/gateway/gateway.go
index bd22568ae..f6a4dbe3d 100644
--- a/pkg/gateway/gateway.go
+++ b/pkg/gateway/gateway.go
@@ -784,10 +784,16 @@ func overridePicoToken(cfg *config.Config, token string) {
 		return
 	}
 	picoToken := cfg.Channels.Pico.Token.String()
-	if picoToken == "" || strings.HasPrefix(picoToken, pico.PicoTokenPrefix) {
+	// Only return early if the token already has the official 'pico-' prefix and is NOT just the base 'picoclaw' name
+	if picoToken != "" && strings.HasPrefix(picoToken, pico.PicoTokenPrefix) && !strings.HasPrefix(picoToken, "picoclaw") {
 		return
 	}
-	cfg.Channels.Pico.SetToken(pico.PicoTokenPrefix + token + picoToken)
+	newToken := pico.PicoTokenPrefix + token
+	if picoToken != "" && picoToken != "[NOT_HERE]" {
+		newToken += "-" + picoToken
+	}
+	cfg.Channels.Pico.SetToken(newToken)
+	logger.DebugCF("gateway", "Pico channel token set", map[string]any{"enabled": true, "token_preview": newToken[:8] + "..."})
 }
 
 func createHeartbeatHandler(agentLoop *agent.AgentLoop) func(prompt, channel, chatID string) *tools.ToolResult {