diff --git a/cmd/verstak-gui/bindings_config.go b/cmd/verstak-gui/bindings_config.go
index 0668373..51cb5ae 100644
--- a/cmd/verstak-gui/bindings_config.go
+++ b/cmd/verstak-gui/bindings_config.go
@@ -228,6 +228,9 @@ func (a *App) initVault(vaultPath string) error {
 		}
 	}
 
+	// Apply installed/enabled state from config to discovered plugins
+	pm.SyncConfig(appCfg)
+
 	// Sync service
 	deviceID := ""
 	_ = appCfg // will store sync settings
@@ -292,6 +295,11 @@ func (a *App) initVault(vaultPath string) error {
 	// Start auto-sync loop
 	go a.autoSyncLoop()
 
+	// Start plugin runtimes for enabled plugins (creates VM, loads scripts, calls on_init)
+	pm.InitRuntimes()
+	pm.CallInitHooks()
+	pm.StartSchedulers()
+
 	// Start bridge server for browser extension integration (if enabled).
 	if appCfg == nil || appCfg.Vault.Bridge.Enabled {
 		a.startBridge(appCfg)
@@ -313,6 +321,12 @@ func (a *App) closeVault() {
 	if a.fileWatcher != nil {
 		a.fileWatcher.Stop()
 	}
+	// Stop plugin runtimes (schedulers → on_shutdown → close VMs)
+	if a.plugins != nil {
+		a.plugins.StopSchedulers()
+		a.plugins.CallShutdownHooks()
+		a.plugins.CloseRuntimes()
+	}
 	// Stop bridge server.
 	if a.bridge != nil {
 		a.bridge.Stop()
diff --git a/cmd/verstak-gui/bindings_plugins.go b/cmd/verstak-gui/bindings_plugins.go
index 56c28bf..dfa2495 100644
--- a/cmd/verstak-gui/bindings_plugins.go
+++ b/cmd/verstak-gui/bindings_plugins.go
@@ -180,8 +180,16 @@ func (a *App) GetPluginPanelHTML(pluginName string) (string, error) {
 	if a.plugins == nil {
 		return "", fmt.Errorf("plugin manager not ready")
 	}
+	appCfg, _ := config.LoadAppConfig()
+	enabledSet := make(map[string]bool)
+	if appCfg != nil {
+		for _, name := range appCfg.EnabledPlugins {
+			enabledSet[name] = true
+		}
+	}
 	for _, p := range a.plugins.Plugins() {
-		if p.Meta.Name != pluginName || !p.Active {
+		active := enabledSet[p.Meta.Name] || p.Active
+		if p.Meta.Name != pluginName || !active {
 			continue
 		}
 		if p.Meta.Panel == "" {