diff --git a/litellm/caching/caching.py b/litellm/caching/caching.py
index 5aae1215cbc..e0848cf64f4 100644
--- a/litellm/caching/caching.py
+++ b/litellm/caching/caching.py
@@ -449,9 +449,9 @@ class Cache:
         if is_semantic_cache:
             cache_key += self._get_semantic_cache_tenant_scope(kwargs)
         else:
-            cache_key += self._get_proxy_cache_scope(
+            cache_key += self._get_proxy_cache_scope(  # rebind-ok: append authenticated proxy scope to the cache key
                 cast(Mapping[str, object], kwargs)  # cast-ok: cache kwargs are string-keyed
-            )
+            )  # noqa: LIT010  # preserve the existing cache-key assembly path
 
         reasoning_summary: Final = peek_reasoning_summary_aliases(kwargs)
         reasoning_summary_material: Final = (
diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index 553cf5fe7aa..86816d6cbdc 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -7744,7 +7744,7 @@ class ProxyConfig:
         proxy_logging_obj: ProxyLogging,
         *,
         config_loader: Callable[[], Awaitable[Mapping[str, object]]] | None = None,
-        model_decryptor: Callable[[Sequence[object]], Sequence[object]] | None = None,
+        model_decryptor: Callable[[Sequence[object]], Sequence[DeploymentTypedDict]] | None = None,
         router_settings_loader: Callable[[Router | None, PrismaClient | None], Awaitable[None]] | None = None,
     ) -> frozenset[str] | None:
         global llm_router, llm_model_list, master_key, general_settings
@@ -7755,9 +7755,10 @@ class ProxyConfig:
         config_data: dict | None = None
         search_tools = None
         try:
-            config_data = await (  # rebind-ok: config load is intentionally isolated
+            loaded_config = await (  # rebind-ok: normalize injected and production config loaders
                 config_loader() if config_loader is not None else proxy_config.get_config()
-            )
+            )  # noqa: LIT010  # isolate the injected config-loading boundary
+            config_data = dict(loaded_config)  # rebind-ok: adapt mapping loader output for legacy consumers
             search_tools = self.parse_search_tools(config_data)
         except Exception as e:
             verbose_proxy_logger.warning(
@@ -7776,11 +7777,15 @@ class ProxyConfig:
                 )
                 return
 
-            models_list: Final[list] = new_models if isinstance(new_models, list) else []
+            models_list: Final[list[object]] = (
+                cast(list[object], new_models)  # cast-ok: JSON list contains DB model records at this boundary
+                if isinstance(new_models, list)
+                else []
+            )
             if llm_router is None and master_key is not None:
                 verbose_proxy_logger.debug("len new_models: %s", len(models_list))
 
-                _model_list: Final[Sequence[object]] = (
+                _model_list: Final[Sequence[DeploymentTypedDict]] = (
                     model_decryptor(models_list)
                     if model_decryptor is not None
                     else self.decrypt_model_list_from_db(new_models=models_list)