diff --git a/public/js/admin.js b/public/js/admin.js
index 12aefd5a..47f7d5fc 100644
--- a/public/js/admin.js
+++ b/public/js/admin.js
@@ -85,7 +85,6 @@ function adminTabActive() {
         if (el) el.textContent = stats.todayApiCalls !== undefined ? stats.todayApiCalls : '—';
 
         updateRegStatus(settings.registrationEnabled !== false);
-        loadWebSearch();
       })
       .catch(function(err) { console.error('[Admin] Settings load failed:', err); });
   }
@@ -420,6 +419,19 @@ function adminTabActive() {
   // Its own endpoints rather than the generic setter: the key is masked on read
   // and a blank field means "keep what is there", so changing the provider does
   // not silently wipe a working key.
+  //
+  // Loads itself on tabChanged, like every other block in this file. It used to
+  // be called from the settings loader in the block above, which cannot see it:
+  // this file is a series of bare { } blocks, and a function declared in one is
+  // not in scope in another. That call threw ReferenceError on every admin
+  // open, and because it sat inside the settings .then(), it took the rest of
+  // that handler down with it — so the card showed its defaults and PubMed read
+  // "Disabled" while the database said true.
+  document.addEventListener('tabChanged', function (e) {
+    if (e.detail && e.detail.tab === 'admin') loadWebSearch();
+  });
+  if (adminTabActive()) loadWebSearch();
+
   function loadWebSearch() {
     fetch('/api/admin/websearch', { headers: getAuthHeaders() })
       .then(function(r) { return r.json(); })