@@ -36,6 +36,10 @@ function headersFingerprint(headers: Record<string, string> | undefined): string
   return crypto.createHash('sha256').update(JSON.stringify(ordered)).digest('hex').slice(0, 16);
 }
 
+function recordFingerprint(value: Record<string, string> | undefined): string {
+  return headersFingerprint(value);
+}
+
 interface ResolvedEndpoint {
   name: string;
   endpoint: TEndpoint;
@@ -171,7 +175,7 @@ export function createLoadConfigModels(deps: LoadConfigModelsDeps) {
       // endpoints that happen to share the same baseURL+apiKey but configure
       // different (potentially user-bound) headers don't reuse each other's
       // fetched model list within the same request.
-      const uniqueKey = `${BASE_URL}__${API_KEY}__${headersFingerprint(endpointHeaders)}`;
+      const uniqueKey = `${BASE_URL}__${API_KEY}__${headersFingerprint(endpointHeaders)}__${recordFingerprint(models?.fetchQuery)}`;
 
       if (models?.fetch && !apiKeyIsUserProvided && !baseURLIsUserProvided) {
         if (!fetchPromisesMap[uniqueKey]) {
@@ -190,6 +194,7 @@ export function createLoadConfigModels(deps: LoadConfigModelsDeps) {
             headers: endpointHeaders,
             direct: endpoint.directEndpoint,
             userIdQuery: models.userIdQuery,
+            fetchQuery: models.fetchQuery,
             tokenKey,
           });
         }
@@ -233,6 +238,7 @@ export function createLoadConfigModels(deps: LoadConfigModelsDeps) {
                 headers: baseURLIsUserProvided ? undefined : endpointHeaders,
                 direct: endpoint.directEndpoint,
                 userIdQuery: models.userIdQuery,
+                fetchQuery: models.fetchQuery,
                 skipCache: true,
                 /** Fetched with the user's key/URL — always user-scoped */
                 tokenKey: getTokenConfigKey(endpoint, name, req.user?.id ?? '', tenantId),
 
@@ -111,6 +111,21 @@ describe('fetchModels', () => {
     );
   });
 
+  it('adds admin-configured model discovery query parameters', async () => {
+    const models = await fetchModels({
+      apiKey: 'testApiKey',
+      baseURL: 'https://bifrost.test/v1',
+      fetchQuery: { scope: 'personal' },
+      name: 'bifrost-loki',
+    });
+
+    expect(models).toEqual(['model-1', 'model-2']);
+    expect(mockedAxios.get).toHaveBeenCalledWith(
+      'https://bifrost.test/v1/models?scope=personal',
+      expect.any(Object),
+    );
+  });
+
   it('should pass custom headers to the API request', async () => {
     const customHeaders = {
       'X-Custom-Header': 'custom-value',
 
@@ -45,6 +45,8 @@ export interface FetchModelsParams {
   azure?: boolean;
   /** Whether to send user ID as query parameter */
   userIdQuery?: boolean;
+  /** Admin-configured query parameters for model discovery. */
+  fetchQuery?: Record<string, string>;
   /** Whether to create token configuration from API response */
   createTokenConfig?: boolean;
   /** Cache key for token configuration (uses name if omitted) */
@@ -161,6 +163,7 @@ export async function fetchModels({
   direct = false,
   azure = false,
   userIdQuery = false,
+  fetchQuery,
   createTokenConfig = true,
   tokenKey,
   headers,
@@ -280,6 +283,7 @@ export async function fetchModels({
     }
 
     const url = new URL(`${(baseURL ?? '').replace(/\/+$/, '')}${azure ? '' : '/models'}`);
+    Object.entries(fetchQuery ?? {}).forEach(([key, value]) => url.searchParams.set(key, value));
     if (user && userIdQuery) {
       url.searchParams.append('user', user);
     }
 
@@ -251,6 +251,36 @@ describe('endpointSchema deprecated fields', () => {
   });
 });
 
+describe('endpointSchema fetched models', () => {
+  const endpoint = {
+    name: 'BifrostLoki',
+    apiKey: 'service-key',
+    baseURL: 'https://bifrost.example.test/v1',
+  };
+
+  it('accepts a fetch-only endpoint without inventing a static fallback', () => {
+    const result = endpointSchema.safeParse({
+      ...endpoint,
+      models: { fetch: true, fetchQuery: { scope: 'personal' } },
+    });
+
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.models.default).toEqual([]);
+      expect(result.data.models.fetchQuery).toEqual({ scope: 'personal' });
+    }
+  });
+
+  it('rejects an endpoint with neither discovery nor a default model', () => {
+    const result = endpointSchema.safeParse({
+      ...endpoint,
+      models: {},
+    });
+
+    expect(result.success).toBe(false);
+  });
+});
+
 describe('endpointSchema addParams validation', () => {
   const validEndpoint = {
     name: 'CustomEndpoint',
 
@@ -1123,11 +1123,16 @@ export const endpointSchema = baseEndpointSchema.merge(
      * reads can show which key is configured without returning the secret. */
     apiKeyPreview: z.string().optional(),
     baseURL: z.string(),
-    models: z.object({
-      default: z.array(modelItemSchema).min(1),
-      fetch: z.boolean().optional(),
-      userIdQuery: z.boolean().optional(),
-    }),
+    models: z
+      .object({
+        default: z.array(modelItemSchema).default([]),
+        fetch: z.boolean().optional(),
+        fetchQuery: z.record(z.string()).optional(),
+        userIdQuery: z.boolean().optional(),
+      })
+      .refine((models) => models.fetch === true || models.default.length > 0, {
+        message: 'models requires fetch: true or at least one default model',
+      }),
     iconURL: z.string().optional(),
     modelDisplayLabel: z.string().optional(),
     /**