diff --git a/decnet/web/router/workers/api_start_all_workers.py b/decnet/web/router/workers/api_start_all_workers.py
index 0323a1e0..bc61a1fe 100644
--- a/decnet/web/router/workers/api_start_all_workers.py
+++ b/decnet/web/router/workers/api_start_all_workers.py
@@ -25,6 +25,7 @@ _PREFERRED_ORDER: tuple[str, ...] = (
     "sniffer",
     "prober",
     "mutator",
+    "webhook",
 )
 
 
diff --git a/decnet/web/worker_registry.py b/decnet/web/worker_registry.py
index 6257341a..38e4e5d5 100644
--- a/decnet/web/worker_registry.py
+++ b/decnet/web/worker_registry.py
@@ -38,6 +38,7 @@ KNOWN_WORKERS: tuple[str, ...] = (
     "sniffer",
     "prober",
     "mutator",
+    "webhook",    # external SIEM/SOAR egress — bus consumer → HMAC HTTP POSTs
     "agent",
     "forwarder",
     "updater",