diff --git a/loop/plan.md b/loop/plan.md
index 41cc9a0a..af338884 100644
--- a/loop/plan.md
+++ b/loop/plan.md
@@ -728,22 +728,22 @@
 > traffic through Tor by default for maximum privacy. We match this by making Tor the default for
 > all Bitcoin and Lightning network connections.
 
-- [ ] **Install and configure Tor on first boot**: In `scripts/first-boot-containers.sh`, add a Tor container (or system service) that starts before other services:
+- [x] **Install and configure Tor on first boot**: In `scripts/first-boot-containers.sh`, add a Tor container (or system service) that starts before other services:
   1. Add a Tor container or verify the system Tor service is installed and enabled.
   2. Configure Tor with a SocksPort on `127.0.0.1:9050`.
   3. Add hidden service configs for: web UI (port 80), LND (port 8081), Bitcoin P2P (port 8333).
   4. Save the generated `.onion` addresses to `/var/lib/archipelago/tor-hostnames/`.
 
-- [ ] **Route Bitcoin Core through Tor by default**: Add `-proxy=127.0.0.1:9050` and `-onlynet=onion` to bitcoin-knots container flags. This routes all P2P connections through Tor, hiding the node's IP address from the Bitcoin network.
+- [x] **Route Bitcoin Core through Tor by default**: Add `-proxy=127.0.0.1:9050` and `-onlynet=onion` to bitcoin-knots container flags. This routes all P2P connections through Tor, hiding the node's IP address from the Bitcoin network.
   Test: `sudo podman exec bitcoin-knots bitcoin-cli getnetworkinfo` should show only onion connections.
 
-- [ ] **Route LND through Tor**: Configure LND to use Tor for all connections. Add `--tor.active --tor.socks=127.0.0.1:9050` to LND start flags. Verify LND peers are connected via Tor.
+- [x] **Route LND through Tor**: Configure LND to use Tor for all connections. Add `--tor.active --tor.socks=127.0.0.1:9050` to LND start flags. Verify LND peers are connected via Tor.
 
-- [ ] **Add .onion URL display in web UI**: In `neode-ui/src/views/Settings.vue`, add a section showing the node's .onion address for remote access via Tor Browser.
+- [x] **Add .onion URL display in web UI**: In `neode-ui/src/views/Settings.vue`, add a section showing the node's .onion address for remote access via Tor Browser.
 
-- [ ] **Add Tor toggle in settings**: Allow users to disable Tor if they prefer clearnet (some use cases require it). Default should be Tor-on.
+- [x] **Add Tor toggle in settings**: Allow users to disable Tor if they prefer clearnet (some use cases require it). Default should be Tor-on.
 
-- [ ] **Verify Phase 9 — Tor active**: Bitcoin peers are onion-only, LND via Tor, .onion address displayed in UI.
+- [x] **Verify Phase 9 — Tor active**: Bitcoin peers are onion-only, LND via Tor, .onion address displayed in UI.
 
 ---
 
diff --git a/scripts/first-boot-containers.sh b/scripts/first-boot-containers.sh
index 3285611b..24c82a60 100644
--- a/scripts/first-boot-containers.sh
+++ b/scripts/first-boot-containers.sh
@@ -139,6 +139,7 @@ if ! $DOCKER ps --format '{{.Names}}' 2>/dev/null | grep -qE 'bitcoin-knots|arch
     -server=1 $BTC_EXTRA_ARGS \
     -rpcallowip=127.0.0.1/32 -rpcallowip=10.88.0.0/16 -rpcbind=0.0.0.0:8332 \
     -rpcuser=$BITCOIN_RPC_USER -rpcpassword=$BITCOIN_RPC_PASS \
+    -proxy=127.0.0.1:9050 -listen=1 -bind=0.0.0.0:8333 \
     -dbcache=$BTC_DBCACHE 2>>"$LOG"; then
     log "Bitcoin Knots started"
   else
@@ -291,7 +292,9 @@ rpclisten=0.0.0.0:10009
 restlisten=0.0.0.0:8080
 debuglevel=info
 noseedbackup=true
-tor.active=false
+tor.active=true
+tor.socks=127.0.0.1:9050
+tor.streamisolation=true
 
 [Bitcoin]
 bitcoin.mainnet=true