diff --git a/steward/core/settings.py b/steward/core/settings.py
index a1e055a..f8cf0d1 100644
--- a/steward/core/settings.py
+++ b/steward/core/settings.py
@@ -60,6 +60,17 @@ DEFAULTS: dict[str, Any] = {
     "ping.threshold.good_ms": 50,
     "ping.threshold.warn_ms": 200,
     "plugins.index_url": "https://git.fabledsword.com/bvandeusen/Steward-plugins/raw/branch/main/index.yaml",
+    # Default-enabled plugins. These are the generic, non-vendor-specific
+    # bundled plugins (protocols/standards, not a single product) — useful on
+    # almost any install, so a fresh deployment comes up monitoring rather than
+    # blank. Vendor-specific plugins (traefik, unifi) stay opt-in. An operator
+    # who disables one writes plugin.<name>={"enabled": False}, which overrides
+    # these defaults (stored value wins in get_all_settings/load_settings_sync).
+    # Per-plugin yaml config defaults are merged on top at load time.
+    "plugin.docker": {"enabled": True},
+    "plugin.host_agent": {"enabled": True},
+    "plugin.http": {"enabled": True},
+    "plugin.snmp": {"enabled": True},
     # OIDC single-sign-on
     "oidc.enabled": False,
     "oidc.discovery_url": "",
diff --git a/tests/core/test_settings_default_plugins.py b/tests/core/test_settings_default_plugins.py
new file mode 100644
index 0000000..32a45c9
--- /dev/null
+++ b/tests/core/test_settings_default_plugins.py
@@ -0,0 +1,41 @@
+"""Pure-function tests for the default-enabled plugin set.
+
+A fresh install (no stored plugin.* rows) should come up with the generic,
+non-vendor-specific bundled plugins already enabled, while vendor-specific
+plugins stay opt-in. An operator's stored choice must override the default.
+No DB / Quart fixtures — we exercise to_plugins_cfg over the DEFAULTS dict
+and a DEFAULTS-merged-with-stored dict, mirroring get_all_settings' merge.
+"""
+from steward.core import settings as settings_module
+from steward.core.settings import DEFAULTS, to_plugins_cfg
+
+DEFAULT_ON = {"docker", "host_agent", "http", "snmp"}
+VENDOR_OPT_IN = {"traefik", "unifi"}
+
+
+def test_generic_plugins_enabled_by_default():
+    cfg = to_plugins_cfg(DEFAULTS)
+    for name in DEFAULT_ON:
+        assert cfg.get(name, {}).get("enabled") is True, name
+
+
+def test_vendor_plugins_not_enabled_by_default():
+    cfg = to_plugins_cfg(DEFAULTS)
+    for name in VENDOR_OPT_IN:
+        assert name not in cfg, name
+
+
+def test_stored_choice_overrides_default():
+    # get_all_settings / load_settings_sync overlay stored values onto DEFAULTS;
+    # a stored disable must win over the built-in default-on.
+    merged = {**DEFAULTS, "plugin.docker": {"enabled": False}}
+    cfg = to_plugins_cfg(merged)
+    assert cfg["docker"]["enabled"] is False
+    # untouched defaults remain enabled
+    assert cfg["http"]["enabled"] is True
+
+
+def test_defaults_use_plugin_dot_namespace():
+    # The keys must live under the plugin.<name> namespace to_plugins_cfg reads.
+    for name in DEFAULT_ON:
+        assert f"plugin.{name}" in settings_module.DEFAULTS