diff --git a/roles/web-app-hermes/meta/services.yml b/roles/web-app-hermes/meta/services.yml
index de4d9caa84..45556f0994 100644
--- a/roles/web-app-hermes/meta/services.yml
+++ b/roles/web-app-hermes/meta/services.yml
@@ -23,7 +23,7 @@ hermes:
   pids_limit: 2048
   ports:
     local:
-      http: 8089
+      http: 8092
       sso: 16512
     internal:
       http: 8642
@@ -85,6 +85,13 @@ prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"
 
+# nocheck: playwright-service-flag
+# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
+tor:
+  bond: 0.5
+  enabled: "{{ 'svc-net-tor' in group_names }}"
+  shared: true # nocheck: dynamic-flag
+
 # nocheck: playwright-service-flag, dynamic-flag
 container_backup: # nocheck: bond-baseline
   bond: 1
diff --git a/roles/web-app-hermes/meta/variants.yml b/roles/web-app-hermes/meta/variants.yml
index 450cb3fbe0..dd05f7e29e 100644
--- a/roles/web-app-hermes/meta/variants.yml
+++ b/roles/web-app-hermes/meta/variants.yml
@@ -26,6 +26,8 @@
     homeassistant:
       enabled: true
       shared: true
+    tor:
+      enabled: true
   mcp:
     enabled: true
     shared: true
@@ -54,6 +56,8 @@
     homeassistant:
       enabled: false
       shared: false # nocheck: variants-static-override variant pins a literal off-switch
+    tor:
+      enabled: true
   mcp:
     enabled: false
     shared: false
diff --git a/roles/web-app-homeassistant/meta/services.yml b/roles/web-app-homeassistant/meta/services.yml
index 3e32f5deab..d47e4fa7c2 100644
--- a/roles/web-app-homeassistant/meta/services.yml
+++ b/roles/web-app-homeassistant/meta/services.yml
@@ -52,6 +52,13 @@ prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"
 
+# nocheck: playwright-service-flag
+# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
+tor:
+  bond: 0.5
+  enabled: "{{ 'svc-net-tor' in group_names }}"
+  shared: true # nocheck: dynamic-flag
+
 # nocheck: playwright-service-flag, dynamic-flag
 container_backup: # nocheck: bond-baseline
   bond: 1
diff --git a/roles/web-app-homeassistant/meta/variants.yml b/roles/web-app-homeassistant/meta/variants.yml
index d699f3d040..db46ef885d 100644
--- a/roles/web-app-homeassistant/meta/variants.yml
+++ b/roles/web-app-homeassistant/meta/variants.yml
@@ -11,6 +11,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 
   mcp:
     enabled: true
@@ -25,6 +27,8 @@
     prometheus:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
+    tor:
+      enabled: true
   mcp:
     enabled: false
     shared: false
diff --git a/roles/web-app-litellm/meta/services.yml b/roles/web-app-litellm/meta/services.yml
index 72b1cf0845..b169fa89d3 100644
--- a/roles/web-app-litellm/meta/services.yml
+++ b/roles/web-app-litellm/meta/services.yml
@@ -22,6 +22,13 @@ prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"
 
+# nocheck: playwright-service-flag
+# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
+tor:
+  bond: 0.5
+  enabled: "{{ 'svc-net-tor' in group_names }}"
+  shared: true # nocheck: dynamic-flag
+
 # nocheck: sso, dynamic-flag, playwright-service-flag
 sso:
   enabled: false
diff --git a/roles/web-app-litellm/meta/variants.yml b/roles/web-app-litellm/meta/variants.yml
index 0ce99af67b..0be5db4f58 100644
--- a/roles/web-app-litellm/meta/variants.yml
+++ b/roles/web-app-litellm/meta/variants.yml
@@ -9,6 +9,8 @@
     prometheus:
       enabled: true
       shared: true
+    tor:
+      enabled: true
 
 - services:
     dashboard:
@@ -17,3 +19,5 @@
     prometheus:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
+    tor:
+      enabled: true
diff --git a/roles/web-app-openclaw/meta/services.yml b/roles/web-app-openclaw/meta/services.yml
index 8f38af0667..f0e1fbd007 100644
--- a/roles/web-app-openclaw/meta/services.yml
+++ b/roles/web-app-openclaw/meta/services.yml
@@ -78,6 +78,13 @@ prometheus:
   enabled: "{{ 'web-app-prometheus' in group_names }}"
   shared: "{{ 'web-app-prometheus' in group_names }}"
 
+# nocheck: playwright-service-flag
+# nocheck: variants-coverage — sso-variant-tor requires the onion on in every variant, so the false polarity has no variant left to live in
+tor:
+  bond: 0.5
+  enabled: "{{ 'svc-net-tor' in group_names }}"
+  shared: true # nocheck: dynamic-flag
+
 # nocheck: playwright-service-flag, dynamic-flag
 container_backup: # nocheck: bond-baseline
   bond: 1
diff --git a/roles/web-app-openclaw/meta/variants.yml b/roles/web-app-openclaw/meta/variants.yml
index 279ddc0413..9be935ceae 100644
--- a/roles/web-app-openclaw/meta/variants.yml
+++ b/roles/web-app-openclaw/meta/variants.yml
@@ -29,6 +29,8 @@
     homeassistant:
       enabled: true
       shared: true
+    tor:
+      enabled: true
   mcp:
     enabled: true
     shared: true
@@ -60,6 +62,8 @@
     homeassistant:
       enabled: false
       shared: false # nocheck: variants-static-override backup shared stays literally true
+    tor:
+      enabled: true
   mcp:
     enabled: false
     shared: false