diff --git a/CLAUDE.md b/CLAUDE.md
index dab7366..5c2ce01 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -195,7 +195,9 @@ world questions, so she needs to read external sources. What replaces it:
   2026-08-02). A self-hosted SearXNG (`search` block) answers first; the Kiwix ZIMs on
   homesrv answer when the search is empty, unreachable, or the line is down.
 - **External search is allowed and off unless configured**, like the weather and telegram
-  capabilities.
+  capabilities. The code default is still off. `deploy/mavend.json` now ships a `search`
+  block (owner's call, 2026-08-02), so it is on for this box and deleting the block turns
+  it off again.
 - **His notes and facts are never search input.** Looking up why the sky is blue and sending
   his stored personal notes to an upstream engine are different acts. Only the utterance goes
   out, never the persona block, history, or matched notes.
diff --git a/deploy/README.md b/deploy/README.md
index 1fca50c..c1ff3b2 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -73,10 +73,11 @@ What it does and does not do:
 - feed notes are **not** part of recall. "что я говорил про X" searches what he
   said; headlines are read back only by asking about the feeds.
 
-### Searching the web (`search`, also off by default)
+### Searching the web (`search`, on in this deploy)
 
-There is no `search` block either, so no query leaves the LAN. Switching it on
-points her at a self-hosted SearXNG:
+`deploy/mavend.json` ships a `search` block, so a question that is not about him
+reaches a self-hosted SearXNG before it reaches the ZIMs. Delete the block and
+no query leaves the LAN again. The shipped shape:
 
 ```json
 "search": {
diff --git a/deploy/mavend.json b/deploy/mavend.json
index c9e6c84..1b0ab1d 100644
--- a/deploy/mavend.json
+++ b/deploy/mavend.json
@@ -39,6 +39,24 @@
     "proxy": "socks5://192.168.240.1:10808"
   },
 
+  "//search": [
+    "The live web, searched after his own notes and before Kiwix. Only the",
+    "query string leaves the box — never a note, a fact, the persona block or",
+    "the history — and a question about him never reaches here at all.",
+    "The instance must have `json` in search.formats (settings.yml); a stock",
+    "SearXNG answers 403 to format=json and every search then fails. It is",
+    "addressed by container name, so it needs the same maven_default",
+    "attachment kiwix has. No instance reachable ⇒ she falls through to the",
+    "ZIMs and never says the search failed."
+  ],
+  "search": {
+    "url": "http://searxng:8080",
+    "max_results": 4,
+    "snippet_runes": 1500,
+    "language": "auto",
+    "timeout": "8s"
+  },
+
   "//kiwix": [
     "The offline encyclopedia, searched after his own notes and before anything",
     "on the network. kiwix-server publishes 8034 on loopback only, so a container",