diff --git a/nix/agent-modules/mcp.nix b/nix/agent-modules/mcp.nix
index f65ba05f..3c96ab36 100644
--- a/nix/agent-modules/mcp.nix
+++ b/nix/agent-modules/mcp.nix
@@ -378,6 +378,16 @@ in
         # HIVE_AGENT_SOCKET (agent-service.nix).
         HIVE_AGENT_SOCKET = "/run/hive-agent/${userName}/agent.sock";
         RUST_LOG = "info";
+        # This daemon resolves each subagent's `--tools` from the same
+        # tool groups the harness resolves its own session from, so that a
+        # subagent's built-in tools are its parent agent's and never wider.
+        # The meta renderer writes this var onto the harness unit alone, so
+        # forward it from there rather than re-deriving it: without it the
+        # daemon falls back to the default groups and an agent granted
+        # `web_tools` would spawn subagents that quietly lack web access.
+        # `null` when the agent has no groups declared, which systemd drops
+        # — the same "absent" the harness itself would see.
+        HIVE_TOOL_GROUPS = config.systemd.services.hive-agent.environment.HIVE_TOOL_GROUPS or null;
         # HYPERHIVE_HARNESS_DIR / HYPERHIVE_STATE_DIR: see
         # `hive-bash-daemon`'s own comment above — same global injection,
         # same reasoning.