diff --git a/src/config/schema.rs b/src/config/schema.rs
index c9315d743..0260f0a34 100644
--- a/src/config/schema.rs
+++ b/src/config/schema.rs
@@ -1234,7 +1234,7 @@ pub struct WebFetchConfig {
     #[serde(default)]
     pub enabled: bool,
     /// Allowed domains for web fetch (exact or subdomain match; `["*"]` = all public hosts)
-    #[serde(default)]
+    #[serde(default = "default_web_fetch_allowed_domains")]
     pub allowed_domains: Vec<String>,
     /// Blocked domains (exact or subdomain match; always takes priority over allowed_domains)
     #[serde(default)]
@@ -1255,6 +1255,10 @@ fn default_web_fetch_timeout_secs() -> u64 {
     30
 }
 
+fn default_web_fetch_allowed_domains() -> Vec<String> {
+    vec!["*".into()]
+}
+
 impl Default for WebFetchConfig {
     fn default() -> Self {
         Self {