diff --git a/.env.template b/.env.template
index 9c9ba4ea..e7723e6c 100644
--- a/.env.template
+++ b/.env.template
@@ -72,3 +72,9 @@ ENCRYPTION_KEY=
 # KUBECONFIG_PATH=/root/.kube/config
 # THREAD_PVC=yuxi-thread
 # SKILLS_PVC=yuxi-skills  # 当前代码会读取，但 Pod 挂载实际仍只使用 THREAD_PVC
+
+# SearXNG (self-hosted meta search engine)
+SEARXNG_SECRET=  # 必填，可用 openssl rand -hex 32 生成
+
+# Crawl4AI (web crawl service)
+CRAWL4AI_API_TOKEN=  # 预留 JWT 认证，默认空
diff --git a/docker-compose.yml b/docker-compose.yml
index 6fc9b89d..492adce3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -32,8 +32,8 @@ x-api-worker-env: &api-worker-env
   # 敏感字段加密密钥
   ENCRYPTION_KEY: ${ENCRYPTION_KEY:-}
   # 其他环境变量
-  NO_PROXY: localhost,127.0.0.1,milvus,graph,minio,milvus-etcd-dev,etcd,mineru,paddlex,sandbox-provisioner,api.siliconflow.cn
-  no_proxy: localhost,127.0.0.1,milvus,graph,minio,milvus-etcd-dev,etcd,mineru,paddlex,sandbox-provisioner,api.siliconflow.cn
+  NO_PROXY: localhost,127.0.0.1,milvus,graph,minio,milvus-etcd-dev,etcd,mineru,paddlex,sandbox-provisioner,api.siliconflow.cn,searxng,crawl4ai
+  no_proxy: localhost,127.0.0.1,milvus,graph,minio,milvus-etcd-dev,etcd,mineru,paddlex,sandbox-provisioner,api.siliconflow.cn,searxng,crawl4ai
 
 services:
   api:
@@ -408,6 +408,49 @@ services:
       - app-network
     restart: unless-stopped
 
+  searxng:
+    image: searxng/searxng:latest
+    container_name: searxng
+    profiles:
+      - all
+    volumes:
+      - ./docker/searxng/settings.yml:/etc/searxng/settings.yml:ro
+    environment:
+      - SEARXNG_SECRET=${SEARXNG_SECRET:-}
+      - SEARXNG_BASE_URL=http://searxng:8080
+    networks:
+      - app-network
+    mem_limit: 512m
+    cpus: 0.5
+    healthcheck:
+      test: ["CMD-SHELL", "wget --spider -q http://localhost:8080/healthz || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    restart: unless-stopped
+
+  crawl4ai:
+    image: unclecode/crawl4ai:0.8.9
+    container_name: crawl4ai
+    profiles:
+      - all
+    environment:
+      - CRAWL4AI_API_TOKEN=${CRAWL4AI_API_TOKEN:-}
+      - CRAWL4AI_HOOKS_ENABLED=false
+    networks:
+      - app-network
+    mem_limit: 4g
+    mem_reservation: 1g
+    shm_size: 1g
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:11235/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    restart: unless-stopped
+
 volumes:
   nltk_data: