diff --git a/routes/chat_routes.py b/routes/chat_routes.py
index 705fa4b..928d433 100644
--- a/routes/chat_routes.py
+++ b/routes/chat_routes.py
@@ -596,6 +596,7 @@ def setup_chat_routes(
         # shell disabled).
         auto_escalated = False
         _tool_intent = _classify_tool_intent(message) if isinstance(message, str) else None
+        _explicit_web_intent = bool(_tool_intent and _tool_intent.category == "web")
         if chat_mode == "chat" and _tool_intent and _tool_intent.needs_tools:
             chat_mode = "agent"
             auto_escalated = True
@@ -882,11 +883,10 @@ def setup_chat_routes(
         ):
             disabled_tools.add("web_search")
             disabled_tools.add("web_fetch")
-        if _explicit_web_intent:
+        if _explicit_web_intent and "web_search" not in disabled_tools:
             # A direct lookup/search request should not drift into personal
-            # tools or shell fallbacks. We still keep web_search/web_fetch
-            # available even when the frontend toggle is stale/falsy because
-            # the user's words are the stronger signal.
+            # tools or shell fallbacks. If the caller explicitly disabled web
+            # search above, keep that hard deny.
             disabled_tools.update({
                 "bash", "python",
                 "search_chats", "manage_skills", "manage_memory",
@@ -1410,7 +1410,7 @@ def setup_chat_routes(
                     _max_rounds = max(1, min(_max_rounds, 200))
 
                     _forced_tools = None
-                    if _explicit_web_intent:
+                    if _explicit_web_intent and "web_search" not in disabled_tools:
                         _forced_tools = {"web_search", "web_fetch"}
                     elif _search_enabled:
                         _forced_tools = {"web_search", "web_fetch"}