diff --git a/litellm/proxy/common_request_processing.py b/litellm/proxy/common_request_processing.py
index 9e58c662726..a94116ca940 100644
--- a/litellm/proxy/common_request_processing.py
+++ b/litellm/proxy/common_request_processing.py
@@ -2373,9 +2373,11 @@ class ProxyBaseLLMRequestProcessing:
             kind="image_edit" if route_type == "aimage_edit" else "completion",
         )
         self.data["model"] = resolved_model
-        # Auth checked the body model; the endpoint model from the URL wins here, so
-        # authorize the resolved name before any alias rewrite.
-        if llm_router is not None:
+        # Auth read the body model (requested_model above). When the endpoint model from
+        # the URL overrides it, the served model was never checked, so authorize the
+        # resolved name here, before any alias rewrite. A request whose model came from
+        # the body was already checked by auth, so it is left alone.
+        if llm_router is not None and isinstance(model, str) and model and model != requested_model:
             await can_key_call_requested_models(
                 model=resolved_model, valid_token=user_api_key_dict, llm_router=llm_router
             )
diff --git a/litellm/proxy/image_endpoints/endpoints.py b/litellm/proxy/image_endpoints/endpoints.py
index 3112e41c277..0802cb329c5 100644
--- a/litellm/proxy/image_endpoints/endpoints.py
+++ b/litellm/proxy/image_endpoints/endpoints.py
@@ -123,13 +123,15 @@ async def image_generation(
         if isinstance(model, str):
             reject_url_valued_destination("model", model)
 
+        body_model: Final = data.get("model")  # pyright: ignore[reportUnknownMemberType, reportUnknownVariableType]  # data is an untyped dict body
         resolved_model: Final = resolve_inference_model(
-            data.get("model"), general_settings, user_model, model, kind="image_generation"
+            body_model, general_settings, user_model, model, kind="image_generation"
         )
         data["model"] = resolved_model
-        # Auth checked the body model; the deployment path model wins here, so
-        # authorize the resolved name before any alias rewrite.
-        if llm_router is not None:
+        # Auth read the body model. When the deployment or query model from the URL
+        # overrides it, the served model was never checked, so authorize the resolved
+        # name here, before any alias rewrite. A body model was already checked by auth.
+        if llm_router is not None and isinstance(model, str) and model and model != body_model:
             await can_key_call_requested_models(
                 model=resolved_model, valid_token=user_api_key_dict, llm_router=llm_router
             )