diff --git a/.env.example b/.env.example
index 3aaa4b2..c933cb7 100644
--- a/.env.example
+++ b/.env.example
@@ -15,6 +15,9 @@ POP_RPC_URL=
 # Subgraph URL for the default chain (optional if using built-in defaults)
 POP_SUBGRAPH_URL=
 
+# The Graph gateway API key (required for Arbitrum and Gnosis subgraphs)
+POP_SUBGRAPH_API_KEY=
+
 # IPFS endpoints (optional — defaults to The Graph's IPFS)
 POP_IPFS_API_URL=https://api.thegraph.com/ipfs/api/v0
 POP_IPFS_GATEWAY_URL=https://ipfs.io/ipfs/
diff --git a/agent/.env.agent.template b/agent/.env.agent.template
index 66f47f8..f7661ec 100644
--- a/agent/.env.agent.template
+++ b/agent/.env.agent.template
@@ -11,6 +11,9 @@ POP_DEFAULT_ORG=
 # 42161=Arbitrum, 100=Gnosis, 11155111=Sepolia, 84532=Base Sepolia
 POP_DEFAULT_CHAIN=100
 
+# Required for Arbitrum/Gnosis: The Graph gateway API key
+POP_SUBGRAPH_API_KEY=
+
 # Optional: Override RPC/subgraph endpoints
 POP_RPC_URL=
 POP_SUBGRAPH_URL=
diff --git a/src/config/networks.ts b/src/config/networks.ts
index ef719e6..2660a07 100644
--- a/src/config/networks.ts
+++ b/src/config/networks.ts
@@ -22,7 +22,7 @@ export const NETWORKS: Record<string, NetworkConfig> = {
     rpcUrl: 'https://arb1.arbitrum.io/rpc',
     blockExplorer: 'https://arbiscan.io',
     isTestnet: false,
-    subgraphUrl: 'https://gateway.thegraph.com/api/204b1629ba85581bdc48cc6701e821ff/subgraphs/id/2egvcs94ZStD38inRtK9bp3Maw3UZw4BDinH8jLyAF4G',
+    subgraphUrl: 'https://gateway.thegraph.com/api/subgraphs/id/2egvcs94ZStD38inRtK9bp3Maw3UZw4BDinH8jLyAF4G',
     bountyTokens: {
       USDC: '0xaf88d065e77c8cC2239327C5EDb3A432268e5831',
     },
@@ -34,7 +34,7 @@ export const NETWORKS: Record<string, NetworkConfig> = {
     rpcUrl: 'https://rpc.gnosischain.com',
     blockExplorer: 'https://gnosisscan.io',
     isTestnet: false,
-    subgraphUrl: 'https://gateway.thegraph.com/api/204b1629ba85581bdc48cc6701e821ff/subgraphs/id/576YA6oF16nA2uG5Q9KFfBSvJm4ZNKzWZkwh8eWXaxJs',
+    subgraphUrl: 'https://gateway.thegraph.com/api/subgraphs/id/576YA6oF16nA2uG5Q9KFfBSvJm4ZNKzWZkwh8eWXaxJs',
     bountyTokens: {
       BREAD: '0xa555d5344f6FB6c65da19e403Cb4c1eC4a1a5Ee3',
       USDC: '0xDDAfbb505ad214D7b80b1f830fcCc89B60fB7A83',
diff --git a/src/lib/subgraph.ts b/src/lib/subgraph.ts
index 42196d6..977a9e5 100644
--- a/src/lib/subgraph.ts
+++ b/src/lib/subgraph.ts
@@ -1,6 +1,7 @@
 /**
  * Subgraph Client
  * Lightweight GraphQL client for querying The Graph subgraphs.
+ * Passes POP_SUBGRAPH_API_KEY as bearer token header for gateway endpoints.
  */
 
 import { GraphQLClient } from 'graphql-request';
@@ -9,10 +10,16 @@ import { resolveNetworkConfig, getAllSubgraphUrls } from '../config/networks';
 let clientCache: Map<string, GraphQLClient> = new Map();
 
 function getClient(url: string): GraphQLClient {
-  let client = clientCache.get(url);
+  const cacheKey = url;
+  let client = clientCache.get(cacheKey);
   if (!client) {
-    client = new GraphQLClient(url);
-    clientCache.set(url, client);
+    const headers: Record<string, string> = {};
+    // Gateway endpoints require an API key via Authorization header
+    if (url.includes('gateway.thegraph.com') && process.env.POP_SUBGRAPH_API_KEY) {
+      headers['Authorization'] = `Bearer ${process.env.POP_SUBGRAPH_API_KEY}`;
+    }
+    client = new GraphQLClient(url, { headers });
+    clientCache.set(cacheKey, client);
   }
   return client;
 }