diff --git a/cmd/gateway_setup.go b/cmd/gateway_setup.go
index 730f7a8f..dfa3fdaf 100644
--- a/cmd/gateway_setup.go
+++ b/cmd/gateway_setup.go
@@ -117,12 +117,7 @@ func setupToolRegistry(
 		toolsReg.Register(browser.NewBrowserTool(browserMgr))
 	}
 
-	// Web tools (web_search + web_fetch)
-	webSearchTool := tools.NewWebSearchTool(tools.WebSearchConfigFromConfig(cfg))
-	if webSearchTool != nil {
-		toolsReg.Register(webSearchTool)
-		slog.Info("web_search tool enabled")
-	}
+	// Web tools (web_fetch; web_search is registered in wireExtraTools after stores are ready)
 	webFetchTool = tools.NewWebFetchTool(tools.WebFetchConfig{
 		Policy:         cfg.Tools.WebFetch.Policy,
 		AllowedDomains: cfg.Tools.WebFetch.AllowedDomains,
diff --git a/cmd/gateway_tools_wiring.go b/cmd/gateway_tools_wiring.go
index aa0e856c..192255c4 100644
--- a/cmd/gateway_tools_wiring.go
+++ b/cmd/gateway_tools_wiring.go
@@ -24,6 +24,10 @@ func wireExtraTools(
 	globalSkillsDir string,
 	builtinSkillsDir string,
 ) (heartbeatTool *tools.HeartbeatTool, hasMemory bool) {
+	// web_search: tenant-scoped resolve requires stores + msgBus — register here.
+	toolsReg.Register(tools.NewWebSearchTool(pgStores.ConfigSecrets, msgBus))
+	slog.Info("web_search tool registered (tenant-scoped resolve)")
+
 	// DateTime tool (precise time for cron scheduling, memory timestamps, etc.)
 	toolsReg.Register(tools.NewDateTimeTool())