diff --git a/litellm/llms/bedrock/base_aws_llm.py b/litellm/llms/bedrock/base_aws_llm.py
index 70869f69e3a..385d5898569 100644
--- a/litellm/llms/bedrock/base_aws_llm.py
+++ b/litellm/llms/bedrock/base_aws_llm.py
@@ -133,6 +133,7 @@ _WEB_IDENTITY_SESSION_POLICY_ACTIONS: Final[Mapping[str, tuple[str, ...]]] = Map
         ),
         "BedrockAgentCoreLiteLLM": (
             "bedrock-agentcore:InvokeAgentRuntime",
+            "bedrock-agentcore:InvokeAgentRuntimeForUser",
             "bedrock-agentcore:InvokeGateway",
         ),
         "ClaudePlatformLiteLLM": (
diff --git a/tests/test_litellm/llms/bedrock/test_web_identity_session_policy.py b/tests/test_litellm/llms/bedrock/test_web_identity_session_policy.py
index 2e84c3ca36a..cbb69b4ceed 100644
--- a/tests/test_litellm/llms/bedrock/test_web_identity_session_policy.py
+++ b/tests/test_litellm/llms/bedrock/test_web_identity_session_policy.py
@@ -230,7 +230,7 @@ class TestInvalidIdentityTokenSurfacesAudience:
     operator can diagnose the mismatch without enabling LITELLM_LOG=DEBUG on a
     prod instance."""
 
-    _AUD = "https://guidepoint.litellm-prod.ai"
+    _AUD = "https://gateway.example.com"
     _ISS = "https://accounts.google.com"
     _STS_MESSAGE = (
         "An error occurred (InvalidIdentityToken) when calling the "
@@ -322,6 +322,9 @@ _BEDROCK_ROUTE_ACTIONS: Final = MappingProxyType(
         "knowledgebases": "bedrock:ListKnowledgeBases",
         "agents/{agent_id}/agentAliases/{alias_id}/sessions/{session_id}/text": "bedrock:InvokeAgent",
         "runtimes/{agent_runtime_arn}/invocations": "bedrock-agentcore:InvokeAgentRuntime",
+        "runtimes/{agent_runtime_arn}/invocations with X-Amzn-Bedrock-AgentCore-Runtime-User-Id": (
+            "bedrock-agentcore:InvokeAgentRuntimeForUser"
+        ),
         "mcp": "bedrock-agentcore:InvokeGateway",
     }
 )