diff --git a/channel/web/core/_common.py b/channel/web/core/_common.py
index 39d9598a..1b28c999 100644
--- a/channel/web/core/_common.py
+++ b/channel/web/core/_common.py
@@ -833,8 +833,8 @@ def _live_channel_manager():
 def _serve_allowed_roots() -> list:
     """Roots that /api/file and /preview may read from (symlinks resolved).
 
-    Includes the configured serve root, the Agent workspace, and any project
-    directory a session has opened. Project dirs may live outside the serve
+    Includes the configured serve root, all configured Agent workspaces
+    (including disabled Agents), and any project directory a session has opened. Project dirs may live outside the serve
     root (e.g. ``/tmp/foo``), so previewing files in an opened project would
     otherwise be denied.
     """
diff --git a/docs/channels/web.mdx b/docs/channels/web.mdx
index 4ead3e08..85ace7b5 100644
--- a/docs/channels/web.mdx
+++ b/docs/channels/web.mdx
@@ -28,7 +28,7 @@ The Web Console is CowAgent's default channel. It runs automatically once starte
 | `external_api_enabled` | Turn on the [Chat API](/extensions/chat-api) | `false` |
 | `external_api_token` | API key of the [Chat API](/extensions/chat-api), kept while the API is off | `""` |
 | `web_session_expire_days` | Login session validity in days | `30` |
-| `web_file_serve_root` | Root directory the web console can directly read/send files from. Defaults to the user home dir and agent workspace only; set to `/` to allow the whole filesystem | `"~"` |
+| `web_file_serve_root` | Additional root directory the web console can directly read/send files from (defaults to the user home directory). Configured Agent workspaces, including disabled Agents, and opened project directories are also allowed; set to `/` to allow the whole filesystem | `"~"` |
 | `enable_thinking` | Whether to enable deep thinking mode | `false` |
 
 Once a password is configured, you must enter it to log in when accessing the console. The login session is kept for 30 days by default, so restarting the service during that period does not require re-login. The password can also be changed online from the "Configuration" page in the console.