diff --git a/backend/open_webui/routers/ollama.py b/backend/open_webui/routers/ollama.py
index 01ba8e380e..dfb01e4eaf 100644
--- a/backend/open_webui/routers/ollama.py
+++ b/backend/open_webui/routers/ollama.py
@@ -471,7 +471,7 @@ async def get_filtered_models(models, user, db=None):
 
 
 @router.get('/api/tags')
-@router.get('/api/tags/{url_idx}')
+@router.get('/api/tags/{url_idx}', dependencies=[Depends(get_admin_user)])
 async def get_ollama_tags(
     request: Request,
     url_idx: int | None = None,
@@ -534,7 +534,7 @@ async def get_ollama_loaded_models(
 
 
 @router.get('/api/version')
-@router.get('/api/version/{url_idx}')
+@router.get('/api/version/{url_idx}', dependencies=[Depends(get_admin_user)])
 async def get_ollama_versions(
     request: Request,
     user=Depends(get_verified_user),
@@ -1053,7 +1053,7 @@ class GenerateChatCompletionForm(BaseModel):
 async def validate_ollama_backend_idx(request: Request, model: str, url_idx: int | None, user) -> None:
     # A caller-supplied url_idx must point to a backend the model is actually
     # served from; the None path is already constrained to that allow-list.
-    if url_idx is None or user is None or getattr(user, 'role', None) == 'admin' or BYPASS_MODEL_ACCESS_CONTROL:
+    if url_idx is None or user is None or getattr(user, 'role', None) == 'admin':
         return
     models = request.app.state.OLLAMA_MODELS
     if not models or model not in models:
@@ -1472,7 +1472,7 @@ async def generate_responses(
 
 
 @router.get('/v1/models')
-@router.get('/v1/models/{url_idx}')
+@router.get('/v1/models/{url_idx}', dependencies=[Depends(get_admin_user)])
 async def get_openai_models(
     request: Request,
     url_idx: int | None = None,
diff --git a/backend/open_webui/routers/openai.py b/backend/open_webui/routers/openai.py
index 619f8e43a0..9aed4a8f13 100644
--- a/backend/open_webui/routers/openai.py
+++ b/backend/open_webui/routers/openai.py
@@ -861,7 +861,7 @@ async def get_all_models(request: Request, user: UserModel) -> dict[str, list]:
 
 
 @router.get('/models')
-@router.get('/models/{url_idx}')
+@router.get('/models/{url_idx}', dependencies=[Depends(get_admin_user)])
 async def get_models(request: Request, url_idx: int | None = None, user=Depends(get_verified_user)):
     if not await Config.get('openai.enable'):
         raise HTTPException(status_code=503, detail='OpenAI API is disabled')