diff --git a/scripts/install-dirigent-openclaw.mjs b/scripts/install-dirigent-openclaw.mjs
index 64ea4ba..d5fb9c5 100755
--- a/scripts/install-dirigent-openclaw.mjs
+++ b/scripts/install-dirigent-openclaw.mjs
@@ -279,19 +279,25 @@ else {
   const delta = rec.delta || { added: {}, replaced: {}, removed: {} };
 
   try {
-    // ── Handle ADDED entries: remove them ─────────────────────────────────
+    // ── IMPORTANT: Order matters for OpenClaw config validation ────────────
+    // 1. First remove from allow (before deleting entry, otherwise validation fails)
+    if (delta.added[PATH_PLUGINS_ALLOW] !== undefined) {
+      const allowList = getJson(PATH_PLUGINS_ALLOW) || [];
+      const idx = allowList.indexOf("dirigent");
+      if (idx !== -1) {
+        allowList.splice(idx, 1);
+        setJson(PATH_PLUGINS_ALLOW, allowList);
+        console.log("[dirigent] removed 'dirigent' from plugins.allow");
+      }
+    }
+
+    // 2. Then remove entry
     if (delta.added[PATH_PLUGIN_ENTRY] !== undefined || delta.replaced[PATH_PLUGIN_ENTRY] !== undefined) {
       unsetPath(PATH_PLUGIN_ENTRY);
       console.log("[dirigent] removed plugins.entries.dirigent");
     }
 
-    if (delta.added[PATH_PROVIDER_ENTRY] !== undefined) {
-      const providers = getJson(PATH_PROVIDERS) || {};
-      delete providers[NO_REPLY_PROVIDER_ID];
-      setJson(PATH_PROVIDERS, providers);
-      console.log(`[dirigent] removed models.providers.${NO_REPLY_PROVIDER_ID}`);
-    }
-
+    // 3. Then remove plugin path (after entry is gone)
     if (delta.added[PATH_PLUGINS_LOAD] !== undefined) {
       const plugins = getJson("plugins") || {};
       const paths = plugins.load?.paths || [];
@@ -304,15 +310,12 @@ else {
       }
     }
 
-    // ── Handle plugins.allow ──────────────────────────────────────────────
-    if (delta.added[PATH_PLUGINS_ALLOW] !== undefined) {
-      const allowList = getJson(PATH_PLUGINS_ALLOW) || [];
-      const idx = allowList.indexOf("dirigent");
-      if (idx !== -1) {
-        allowList.splice(idx, 1);
-        setJson(PATH_PLUGINS_ALLOW, allowList);
-        console.log("[dirigent] removed 'dirigent' from plugins.allow");
-      }
+    // 4. Finally remove provider
+    if (delta.added[PATH_PROVIDER_ENTRY] !== undefined) {
+      const providers = getJson(PATH_PROVIDERS) || {};
+      delete providers[NO_REPLY_PROVIDER_ID];
+      setJson(PATH_PROVIDERS, providers);
+      console.log(`[dirigent] removed models.providers.${NO_REPLY_PROVIDER_ID}`);
     }
 
     // ── Handle REPLACED provider: restore old value ───────────────────────