diff --git a/deploy/egress/tinyproxy-filter b/deploy/egress/tinyproxy-filter
index 9f70c14..3f9447a 100644
--- a/deploy/egress/tinyproxy-filter
+++ b/deploy/egress/tinyproxy-filter
@@ -31,3 +31,17 @@
 ^\(.*\.\)*search\.brave\.com$
 ^\(.*\.\)*duckduckgo\.com$
 ^searx\.diante\.me$
+# live-info primary sources (2026-10-30, user-approved): time
+# APIs + weather primary sources only, so web_fetch can verify
+# numbers instead of failing 403 Filtered. Deliberately NOT
+# included: time.is / time.org.cn / time.ms (commercial or
+# secondary time sites; worldtimeapi + timeapi cover time),
+# and no general news/social domains -- the whitelist stays
+# fail-closed, these are the only fetch destinations live-info
+# needs. Each line is domain + subdomains, same BASIC form.
+^\(.*\.\)*worldtimeapi\.org$
+^\(.*\.\)*timeapi\.io$
+^\(.*\.\)*open-meteo\.com$
+^\(.*\.\)*weather\.com\.cn$
+^\(.*\.\)*meteoblue\.com$
+^\(.*\.\)*accuweather\.com$