diff --git a/litellm/proxy/management_helpers/audit_logs.py b/litellm/proxy/management_helpers/audit_logs.py
index 0d8c343fda4..d3b225e6e4d 100644
--- a/litellm/proxy/management_helpers/audit_logs.py
+++ b/litellm/proxy/management_helpers/audit_logs.py
@@ -42,7 +42,7 @@ def get_audit_log_changed_by(
 ) -> Optional[str]:
     if litellm_changed_by and _allows_litellm_changed_by_header(user_api_key_dict):
         return litellm_changed_by
-    return user_api_key_dict.user_id or litellm_changed_by or litellm_proxy_admin_name
+    return user_api_key_dict.user_id or litellm_proxy_admin_name
 
 
 def _resolve_audit_log_callback(name: str) -> Optional[CustomLogger]:
diff --git a/tests/proxy_unit_tests/test_audit_logs_proxy.py b/tests/proxy_unit_tests/test_audit_logs_proxy.py
index 248f27ee555..9e2b69176ec 100644
--- a/tests/proxy_unit_tests/test_audit_logs_proxy.py
+++ b/tests/proxy_unit_tests/test_audit_logs_proxy.py
@@ -107,9 +107,25 @@ def test_get_audit_log_changed_by_honors_header_with_team_opt_in():
     )
 
 
-def test_get_audit_log_changed_by_falls_back_to_header_when_user_id_missing():
+def test_get_audit_log_changed_by_ignores_header_without_opt_in_when_user_id_missing():
     user_api_key_dict = UserAPIKeyAuth(api_key="test-key")
 
+    assert (
+        get_audit_log_changed_by(
+            litellm_changed_by="spoofed-user",
+            user_api_key_dict=user_api_key_dict,
+            litellm_proxy_admin_name="proxy-admin",
+        )
+        == "proxy-admin"
+    )
+
+
+def test_get_audit_log_changed_by_honors_header_with_opt_in_when_user_id_missing():
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key="test-key",
+        metadata={"allow_litellm_changed_by_header": True},
+    )
+
     assert (
         get_audit_log_changed_by(
             litellm_changed_by="delegated-user",