diff --git a/papur-addon/config.yaml b/papur-addon/config.yaml
index 9990acc..52aa75c 100644
--- a/papur-addon/config.yaml
+++ b/papur-addon/config.yaml
@@ -38,6 +38,9 @@ options:
   mikrotik_host: "192.168.88.1"
   mikrotik_ssh_user: "papur"
   mikrotik_ssh_key_path: "/data/keys/mikrotik_papur_nopw"
+  # Brave Search API key (optional; enables Brave-backed web search tool)
+  brave_api_key: ""
+
   # Cleanup stale session lock files left after crashes/restarts
   clean_session_locks_on_start: true
   clean_session_locks_on_exit: true
@@ -56,6 +59,7 @@ schema:
   mikrotik_host: str
   mikrotik_ssh_user: str
   mikrotik_ssh_key_path: str
+  brave_api_key: str?
   clean_session_locks_on_start: bool?
   clean_session_locks_on_exit: bool?
 
diff --git a/papur-addon/run.sh b/papur-addon/run.sh
index 243cafe..b3b0cea 100644
--- a/papur-addon/run.sh
+++ b/papur-addon/run.sh
@@ -17,6 +17,7 @@ GW_BIND=$(jq -r '.gateway_bind // "loopback"' "$OPTIONS_FILE")
 GW_PORT=$(jq -r '.gateway_port // 18789' "$OPTIONS_FILE")
 GW_TOKEN=$(jq -r '.gateway_token // empty' "$OPTIONS_FILE")
 HA_TOKEN=$(jq -r '.homeassistant_token // empty' "$OPTIONS_FILE")
+BRAVE_KEY=$(jq -r '.brave_api_key // empty' "$OPTIONS_FILE")
 MT_HOST=$(jq -r '.mikrotik_host // "192.168.88.1"' "$OPTIONS_FILE")
 MT_USER=$(jq -r '.mikrotik_ssh_user // "papur"' "$OPTIONS_FILE")
 MT_KEY=$(jq -r '.mikrotik_ssh_key_path // "/data/keys/mikrotik_papur_nopw"' "$OPTIONS_FILE")
@@ -98,13 +99,22 @@ else
 fi
 
 # ------------------------------------------------------------------------------
-# Store HA token (optional) in a local file for later use by the HA skill/tooling.
+# Store tokens / export env vars (optional)
 # ------------------------------------------------------------------------------
+
+# Home Assistant long-lived token (for local HA API scripts/tools)
 if [ -n "$HA_TOKEN" ]; then
   umask 077
   printf '%s' "$HA_TOKEN" > /config/secrets/homeassistant.token
 fi
 
+# Brave Search API key (for clawdbot's web_search tool, which reads BRAVE_API_KEY)
+if [ -n "$BRAVE_KEY" ]; then
+  export BRAVE_API_KEY="$BRAVE_KEY"
+  umask 077
+  printf '%s' "$BRAVE_KEY" > /config/secrets/brave_api_key
+fi
+
 # Decide Telegram DM access policy.
 DM_POLICY="pairing"
 ALLOW_FROM_JSON=""