diff --git a/deploy/templates/etc/left4me/web.env.template b/deploy/templates/etc/left4me/web.env.template
index 876a80c..c316f4b 100644
--- a/deploy/templates/etc/left4me/web.env.template
+++ b/deploy/templates/etc/left4me/web.env.template
@@ -1,3 +1,10 @@
 DATABASE_URL=sqlite:////var/lib/left4me/left4me.db
 SECRET_KEY=replace-with-generated-secret
 JOB_WORKER_THREADS=4
+
+# Steam Web API key for ISteamUser/GetPlayerSummaries — used by the
+# live-state poller to resolve player Steam IDs to persona names + avatars
+# in the server detail panel. Free at https://steamcommunity.com/dev/apikey.
+# Optional: if empty, the live-state panel still shows counts/map and the
+# in-game name from RCON, just with placeholder avatars.
+STEAM_WEB_API_KEY=
diff --git a/deploy/tests/test_deploy_artifacts.py b/deploy/tests/test_deploy_artifacts.py
index 55be1a6..658b41c 100644
--- a/deploy/tests/test_deploy_artifacts.py
+++ b/deploy/tests/test_deploy_artifacts.py
@@ -428,11 +428,13 @@ def test_env_templates_contain_required_defaults():
     host_env = HOST_ENV.read_text()
     assert "Deployment units use fixed /var/lib/left4me paths" in host_env
     assert host_env.endswith("LEFT4ME_ROOT=/var/lib/left4me\n")
-    assert WEB_ENV_TEMPLATE.read_text() == (
+    web_env = WEB_ENV_TEMPLATE.read_text()
+    assert web_env.startswith(
         "DATABASE_URL=sqlite:////var/lib/left4me/left4me.db\n"
         "SECRET_KEY=replace-with-generated-secret\n"
         "JOB_WORKER_THREADS=4\n"
     )
+    assert web_env.rstrip().endswith("STEAM_WEB_API_KEY=")
 
 
 def test_deploy_script_has_safe_defaults_and_preserves_state() -> None: