diff --git a/src/agents/models-config.e2e-harness.ts b/src/agents/models-config.e2e-harness.ts
index 2a8e725c5ad..be812b3a2ff 100644
--- a/src/agents/models-config.e2e-harness.ts
+++ b/src/agents/models-config.e2e-harness.ts
@@ -287,6 +287,24 @@ async function inferImplicitProviderTestPluginIds(params: {
   for (const providerId of await inferAuthProfileProviderIds(params.agentDir)) {
     providerIds.add(providerId);
   }
+  for (const [pluginId, entry] of Object.entries(params.config?.plugins?.entries ?? {})) {
+    if (!pluginId.trim() || entry?.enabled === false) {
+      continue;
+    }
+    const pluginConfig =
+      entry.config && typeof entry.config === "object"
+        ? (entry.config as { webSearch?: { apiKey?: unknown } })
+        : undefined;
+    if (pluginConfig?.webSearch?.apiKey !== undefined) {
+      providerIds.add(pluginId);
+    }
+  }
+  const legacyGrokApiKey = (
+    params.config?.tools?.web?.search as { grok?: { apiKey?: unknown } } | undefined
+  )?.grok?.apiKey;
+  if (legacyGrokApiKey !== undefined && params.config?.plugins?.entries?.xai?.enabled !== false) {
+    providerIds.add("xai");
+  }
 
   if (providerIds.size === 0) {
     // No config/env/auth hints: keep ambient local auto-discovery focused on the
diff --git a/src/agents/models-config.providers.secrets.ts b/src/agents/models-config.providers.secrets.ts
index fc2f88b5faf..c3a179fffd1 100644
--- a/src/agents/models-config.providers.secrets.ts
+++ b/src/agents/models-config.providers.secrets.ts
@@ -511,5 +511,30 @@ function resolveXaiConfigFallbackAuth(params: { provider: string; config?: OpenC
       mode: "api-key",
     };
   }
+  const legacyGrokApiKey = normalizeOptionalSecretInput(
+    (params.config?.tools?.web?.search as { grok?: { apiKey?: unknown } } | undefined | null)?.grok
+      ?.apiKey,
+  );
+  if (legacyGrokApiKey) {
+    return {
+      apiKey: legacyGrokApiKey,
+      source: "tools.web.search.grok.apiKey",
+      mode: "api-key",
+    };
+  }
+  const legacyGrokApiKeyRef = coerceSecretRef(
+    (params.config?.tools?.web?.search as { grok?: { apiKey?: unknown } } | undefined | null)?.grok
+      ?.apiKey,
+  );
+  if (legacyGrokApiKeyRef) {
+    return {
+      apiKey:
+        legacyGrokApiKeyRef.source === "env"
+          ? legacyGrokApiKeyRef.id.trim()
+          : resolveNonEnvSecretRefApiKeyMarker(legacyGrokApiKeyRef.source),
+      source: "tools.web.search.grok.apiKey",
+      mode: "api-key",
+    };
+  }
   return undefined;
 }