diff --git a/docs/src/content/docs/features/Multi-User Mode/admin-guide.mdx b/docs/src/content/docs/features/Multi-User Mode/admin-guide.mdx
index bcef946fb3c..03222a57e3c 100644
--- a/docs/src/content/docs/features/Multi-User Mode/admin-guide.mdx	
+++ b/docs/src/content/docs/features/Multi-User Mode/admin-guide.mdx	
@@ -218,6 +218,34 @@ view the models previously installed, but cannot add or modify them.
 
 ## Security
 
+### Download URL Restrictions
+
+These restrictions apply to every download the server performs on your behalf —
+model installs from URLs are the main case. (The old general-purpose
+`/api/v1/download_queue` REST endpoint, which accepted an arbitrary URL and
+destination path, has been removed.)
+
+Downloads are refused when the URL resolves to a loopback, link-local or
+private-network address. This stops a download URL from being used to reach
+services that only the server can see, such as an admin interface bound to
+`127.0.0.1` or a cloud instance-metadata endpoint. Redirects are checked at
+every hop, so a public URL cannot bounce the server onto a private address.
+
+If you install models from a mirror on your own network, re-enable those
+addresses in `invokeai.yaml`:
+
+```yaml
+allow_private_download_urls: true
+```
+
+For security, the guarded downloader ignores ambient `HTTP_PROXY`, `HTTPS_PROXY`,
+and `ALL_PROXY` settings. It still honors `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`,
+and `.netrc`. If direct outbound access is unavailable, set `download_proxy` to an
+explicit proxy whose destination policy blocks private addresses; proxy-side DNS
+cannot be checked by InvokeAI. Do not enable `allow_private_download_urls` merely to
+make an untrusted proxy work. The two settings are independent: `download_proxy` is
+honored whether or not `allow_private_download_urls` is enabled.
+
 :::note[Strict Password Checking]
 It is recommended that you enable strict password checking.  This will
 force all users to select good passwords that follow the
diff --git a/docs/src/content/docs/index.mdx b/docs/src/content/docs/index.mdx
index 52de38f6faf..f9f8cc25c1b 100644
--- a/docs/src/content/docs/index.mdx
+++ b/docs/src/content/docs/index.mdx
@@ -118,8 +118,8 @@ Ready to unleash your creativity? Invoke is available for Windows, macOS, and Li
 
 ---
 
-:::note[About the Hosted Version]
-The Invoke hosted platform has been shut down as the founding team joined Adobe. However, Invoke lives on as a thriving open-source project maintained by the community.
+:::note[About the former officially-hosted version]
+The Invoke.ai hosted platform has been shut down as the founding team joined Adobe. However, Invoke lives on as a thriving open-source project maintained by the community.
 
 The open-source version offers the same powerful features you may have used in the hosted service, with the added benefit of complete control and privacy through self-hosting.
 
diff --git a/docs/src/generated/settings.json b/docs/src/generated/settings.json
index fcb47dbfb23..d07a713442c 100644
--- a/docs/src/generated/settings.json
+++ b/docs/src/generated/settings.json
@@ -696,6 +696,28 @@
       "type": "<class 'bool'>",
       "validation": {}
     },
+    {
+      "category": "MODEL INSTALL",
+      "default": false,
+      "description": "Allow the download queue to fetch from loopback, link-local and private-network addresses. Disabled by default so that a download URL cannot be used to reach services that are only reachable from the server. Enable this only if you install models from a mirror on your own network.",
+      "env_var": "INVOKEAI_ALLOW_PRIVATE_DOWNLOAD_URLS",
+      "literal_values": [],
+      "name": "allow_private_download_urls",
+      "required": false,
+      "type": "<class 'bool'>",
+      "validation": {}
+    },
+    {
+      "category": "MODEL INSTALL",
+      "default": null,
+      "description": "Optional HTTP proxy for model downloads. The proxy must enforce the public-address policy because proxy-side DNS cannot be checked by InvokeAI.",
+      "env_var": "INVOKEAI_DOWNLOAD_PROXY",
+      "literal_values": [],
+      "name": "download_proxy",
+      "required": false,
+      "type": "typing.Optional[str]",
+      "validation": {}
+    },
     {
       "category": "MODEL INSTALL",
       "default": false,
diff --git a/docs/src/lib/components/DownloadOptions.astro b/docs/src/lib/components/DownloadOptions.astro
index dfae32a4915..95124322fd9 100644
--- a/docs/src/lib/components/DownloadOptions.astro
+++ b/docs/src/lib/components/DownloadOptions.astro
@@ -1,5 +1,5 @@
 ---
-import { LinkCard, Icon, LinkButton } from '@astrojs/starlight/components';
+import { CardGrid, LinkCard, Icon, LinkButton } from '@astrojs/starlight/components';
 import { type StarlightIcon } from '@astrojs/starlight/types';
 import { withBase } from '../base-path';
 
@@ -49,6 +49,24 @@ const manualDownloadOptions = {
     href: withBase('/configuration/docker/', import.meta.env.BASE_URL),
   },
 };
+
+const hostedOptions = {
+  aibadgr: {
+     headline: 'Run on AI Badgr',
+     description: 'Run on the AI Badgr hosted GPU service',
+     href: 'https://aibadgr.com/gpu/launch?template=invokeai',
+   },
+  runpod: {
+     headline: 'Run on RunPod',
+     description: 'Run on the RunPod hosted GPU service',
+     href: 'https://www.runpod.io/blog/invoke-ai-stable-diffusion-runpod-nfz18',
+   },
+  railway: {
+     headline: 'Run on Railway',
+     description: 'Run on the Railway hosted GPU service',
+     href: 'https://railway.com/deploy/invokeai',
+   },
+};
 ---
 
 <div class="download-options">
@@ -92,6 +110,20 @@ const manualDownloadOptions = {
       ))
     }
   </div>
+
+  <!-- Hosted Options -->
+  <div class="download-options__hosted">
+    <h3>Hosted Options</h3>
+    <p>For users who want to run Invoke on a hosted GPU service instead of their own hardware.</p>
+
+    <CardGrid>
+      {
+        Object.entries(hostedOptions).map(([key, { headline, href, description }]) => (
+          <LinkCard title={headline} {href} {description} />
+        ))
+      }
+    </CardGrid>
+  </div>
 </div>
 
 <style is:global>
@@ -134,6 +166,23 @@ const manualDownloadOptions = {
     }
   }
 
+  .download-options__hosted {
+    margin: 0;
+    border-radius: var(--radius);
+    background: var(--sl-color-black);
+    border: 1px solid var(--sl-color-gray-5);
+    padding: 1.5rem;
+
+    h3 {
+      margin-top: 0;
+    }
+
+    > p {
+      margin-top: 0.5rem;
+      color: var(--sl-color-gray-2);
+    }
+  }
+
   .download-options--launcher {
     display: grid;
     gap: 1.5rem;
diff --git a/docs/src/styles/custom.css b/docs/src/styles/custom.css
index abb93263edd..63a47b18b28 100644
--- a/docs/src/styles/custom.css
+++ b/docs/src/styles/custom.css
@@ -342,6 +342,11 @@ article.card {
 
 /* Splash Page-specific styles */
 
+/* Make the default body font a bit smaller on the splash/home page. */
+[data-has-hero] .sl-markdown-content {
+  font-size: 0.9rem;
+}
+
 @keyframes splash-animate {
   0% { background-position: 0% 0%; }
   50% { background-position: 0% 100%; }
diff --git a/invokeai/app/api/routers/app_info.py b/invokeai/app/api/routers/app_info.py
index 832e58f5e24..1d429588e2a 100644
--- a/invokeai/app/api/routers/app_info.py
+++ b/invokeai/app/api/routers/app_info.py
@@ -11,7 +11,7 @@
 from fastapi.routing import APIRouter
 from pydantic import BaseModel, Field, model_validator
 
-from invokeai.app.api.auth_dependencies import AdminUserOrDefault
+from invokeai.app.api.auth_dependencies import AdminUserOrDefault, CurrentUserOrDefault
 from invokeai.app.api.dependencies import ApiDependencies
 from invokeai.app.services.config.config_default import (
     EXTERNAL_PROVIDER_CONFIG_FIELDS,
@@ -55,7 +55,7 @@ async def get_version() -> AppVersion:
 
 
 @app_router.get("/app_deps", operation_id="get_app_deps", status_code=200, response_model=dict[str, str])
-async def get_app_deps() -> dict[str, str]:
+async def get_app_deps(current_user: CurrentUserOrDefault) -> dict[str, str]:
     deps: dict[str, str] = {dist.metadata["Name"]: dist.version for dist in distributions()}
     try:
         cuda = getattr(getattr(torch, "version", None), "cuda", None) or "N/A"  # pyright: ignore[reportAttributeAccessIssue]
@@ -70,7 +70,7 @@ async def get_app_deps() -> dict[str, str]:
 
 
 @app_router.get("/patchmatch_status", operation_id="get_patchmatch_status", status_code=200, response_model=bool)
-async def get_patchmatch_status() -> bool:
+async def get_patchmatch_status(current_user: CurrentUserOrDefault) -> bool:
     return PatchMatch.patchmatch_available()
 
 
@@ -139,12 +139,46 @@ def validate_explicit_nulls(self) -> "UpdateAppGenerationSettingsRequest":
         return self
 
 
+REDACTED_SECRET = "**********"
+
+
+def _redact_config_secrets(config: InvokeAIAppConfig) -> InvokeAIAppConfig:
+    """Return a copy of the config with credential fields masked.
+
+    The runtime config carries provider API keys and model-download bearer tokens. The route is admin-only, but no
+    client - not even an admin's browser - has any use for the raw values; the UI only cares whether a credential is
+    configured.
+
+    NOTE: coverage is by convention, not automatic. Only `*_api_key` fields listed in
+    EXTERNAL_PROVIDER_CONFIG_FIELDS plus `remote_api_tokens` and credentials embedded in
+    `download_proxy` are masked. If you add a credential to InvokeAIAppConfig under any other
+    name, you must extend this function or it will be served verbatim.
+    """
+    updates: dict[str, Any] = {}
+
+    for field_name in EXTERNAL_PROVIDER_CONFIG_FIELDS:
+        if not field_name.endswith("_api_key"):
+            continue
+        if getattr(config, field_name, None):
+            updates[field_name] = REDACTED_SECRET
+
+    if config.remote_api_tokens:
+        updates["remote_api_tokens"] = [
+            pair.model_copy(update={"token": REDACTED_SECRET}) for pair in config.remote_api_tokens
+        ]
+
+    if config.download_proxy and "@" in config.download_proxy:
+        updates["download_proxy"] = REDACTED_SECRET
+
+    return config.model_copy(update=updates) if updates else config
+
+
 @app_router.get(
     "/runtime_config", operation_id="get_runtime_config", status_code=200, response_model=InvokeAIAppConfigWithSetFields
 )
-async def get_runtime_config() -> InvokeAIAppConfigWithSetFields:
+async def get_runtime_config(current_admin: AdminUserOrDefault) -> InvokeAIAppConfigWithSetFields:
     config = get_config()
-    return InvokeAIAppConfigWithSetFields(set_fields=config.model_fields_set, config=config)
+    return InvokeAIAppConfigWithSetFields(set_fields=config.model_fields_set, config=_redact_config_secrets(config))
 
 
 @app_router.patch(
@@ -169,7 +203,7 @@ async def update_runtime_config(
 
         persisted_config.update_config(update_dict)
         persisted_config.write_file(config.config_file_path)
-        return InvokeAIAppConfigWithSetFields(set_fields=config.model_fields_set, config=config)
+        return InvokeAIAppConfigWithSetFields(set_fields=config.model_fields_set, config=_redact_config_secrets(config))
 
 
 @app_router.get(
@@ -178,7 +212,7 @@ async def update_runtime_config(
     status_code=200,
     response_model=list[ExternalProviderStatusModel],
 )
-async def get_external_provider_statuses() -> list[ExternalProviderStatusModel]:
+async def get_external_provider_statuses(current_user: CurrentUserOrDefault) -> list[ExternalProviderStatusModel]:
     statuses = ApiDependencies.invoker.services.external_generation.get_provider_statuses()
     return [status_to_model(status) for status in statuses.values()]
 
@@ -189,7 +223,7 @@ async def get_external_provider_statuses() -> list[ExternalProviderStatusModel]:
     status_code=200,
     response_model=list[ExternalProviderConfigModel],
 )
-async def get_external_provider_configs() -> list[ExternalProviderConfigModel]:
+async def get_external_provider_configs(current_admin: AdminUserOrDefault) -> list[ExternalProviderConfigModel]:
     config = get_config()
     return [_build_external_provider_config(provider_id, config) for provider_id in EXTERNAL_PROVIDER_FIELDS]
 
@@ -340,7 +374,7 @@ def _remove_external_models_for_provider(provider_id: str) -> None:
     responses={200: {"description": "The operation was successful"}},
     response_model=LogLevel,
 )
-async def get_log_level() -> LogLevel:
+async def get_log_level(current_admin: AdminUserOrDefault) -> LogLevel:
     """Returns the log level"""
     return LogLevel(ApiDependencies.invoker.services.logger.level)
 
@@ -352,6 +386,7 @@ async def get_log_level() -> LogLevel:
     response_model=LogLevel,
 )
 async def set_log_level(
+    current_admin: AdminUserOrDefault,
     level: LogLevel = Body(description="New log verbosity level"),
 ) -> LogLevel:
     """Sets the log verbosity level"""
@@ -364,7 +399,7 @@ async def set_log_level(
     operation_id="clear_invocation_cache",
     responses={200: {"description": "The operation was successful"}},
 )
-async def clear_invocation_cache() -> None:
+async def clear_invocation_cache(current_admin: AdminUserOrDefault) -> None:
     """Clears the invocation cache"""
     ApiDependencies.invoker.services.invocation_cache.clear()
 
@@ -374,7 +409,7 @@ async def clear_invocation_cache() -> None:
     operation_id="enable_invocation_cache",
     responses={200: {"description": "The operation was successful"}},
 )
-async def enable_invocation_cache() -> None:
+async def enable_invocation_cache(current_admin: AdminUserOrDefault) -> None:
     """Clears the invocation cache"""
     ApiDependencies.invoker.services.invocation_cache.enable()
 
@@ -384,7 +419,7 @@ async def enable_invocation_cache() -> None:
     operation_id="disable_invocation_cache",
     responses={200: {"description": "The operation was successful"}},
 )
-async def disable_invocation_cache() -> None:
+async def disable_invocation_cache(current_admin: AdminUserOrDefault) -> None:
     """Clears the invocation cache"""
     ApiDependencies.invoker.services.invocation_cache.disable()
 
@@ -394,6 +429,6 @@ async def disable_invocation_cache() -> None:
     operation_id="get_invocation_cache_status",
     responses={200: {"model": InvocationCacheStatus}},
 )
-async def get_invocation_cache_status() -> InvocationCacheStatus:
+async def get_invocation_cache_status(current_admin: AdminUserOrDefault) -> InvocationCacheStatus:
     """Clears the invocation cache"""
     return ApiDependencies.invoker.services.invocation_cache.get_status()
diff --git a/invokeai/app/api/routers/download_queue.py b/invokeai/app/api/routers/download_queue.py
deleted file mode 100644
index 305eaf9273e..00000000000
--- a/invokeai/app/api/routers/download_queue.py
+++ /dev/null
@@ -1,138 +0,0 @@
-# Copyright (c) 2023 Lincoln D. Stein
-"""FastAPI route for the download queue."""
-
-from pathlib import Path as FsPath
-from pathlib import PurePosixPath, PureWindowsPath
-from typing import List, Optional
-
-from fastapi import Body, Path, Response
-from fastapi.routing import APIRouter
-from pydantic.networks import AnyHttpUrl
-from starlette.exceptions import HTTPException
-
-from invokeai.app.api.auth_dependencies import AdminUserOrDefault, CurrentUserOrDefault
-from invokeai.app.api.dependencies import ApiDependencies
-from invokeai.app.services.download import (
-    DownloadJob,
-    UnknownJobIDException,
-)
-
-download_queue_router = APIRouter(prefix="/v1/download_queue", tags=["download_queue"])
-
-
-def _validate_dest(dest: str) -> str:
-    """Reject absolute paths and parent-traversal segments.
-
-    Accepts a relative POSIX- or Windows-style path. Returns the original string
-    for the caller to wrap in `Path(...)`. Raises 400 on suspicious input so the
-    download service never sees it.
-    """
-    if not dest or not dest.strip():
-        raise HTTPException(status_code=400, detail="Download destination must not be empty.")
-
-    posix = PurePosixPath(dest)
-    windows = PureWindowsPath(dest)
-    if posix.is_absolute() or windows.is_absolute():
-        raise HTTPException(status_code=400, detail="Download destination must be a relative path.")
-
-    if ".." in posix.parts or ".." in windows.parts:
-        raise HTTPException(status_code=400, detail="Download destination must not contain '..' segments.")
-
-    return dest
-
-
-@download_queue_router.get(
-    "/",
-    operation_id="list_downloads",
-)
-async def list_downloads(current_user: CurrentUserOrDefault) -> List[DownloadJob]:
-    """Get a list of active and inactive jobs."""
-    queue = ApiDependencies.invoker.services.download_queue
-    return queue.list_jobs()
-
-
-@download_queue_router.patch(
-    "/",
-    operation_id="prune_downloads",
-    responses={
-        204: {"description": "All completed jobs have been pruned"},
-        400: {"description": "Bad request"},
-    },
-)
-async def prune_downloads(current_user: AdminUserOrDefault) -> Response:
-    """Prune completed and errored jobs."""
-    queue = ApiDependencies.invoker.services.download_queue
-    queue.prune_jobs()
-    return Response(status_code=204)
-
-
-@download_queue_router.post(
-    "/i/",
-    operation_id="download",
-)
-async def download(
-    current_user: CurrentUserOrDefault,
-    source: AnyHttpUrl = Body(description="download source"),
-    dest: str = Body(description="download destination"),
-    priority: int = Body(default=10, description="queue priority"),
-    access_token: Optional[str] = Body(default=None, description="token for authorization to download"),
-) -> DownloadJob:
-    """Download the source URL to the file or directory indicted in dest."""
-    validated_dest = _validate_dest(dest)
-    queue = ApiDependencies.invoker.services.download_queue
-    return queue.download(source, FsPath(validated_dest), priority, access_token)
-
-
-@download_queue_router.get(
-    "/i/{id}",
-    operation_id="get_download_job",
-    responses={
-        200: {"description": "Success"},
-        404: {"description": "The requested download JobID could not be found"},
-    },
-)
-async def get_download_job(
-    current_user: CurrentUserOrDefault,
-    id: int = Path(description="ID of the download job to fetch."),
-) -> DownloadJob:
-    """Get a download job using its ID."""
-    try:
-        job = ApiDependencies.invoker.services.download_queue.id_to_job(id)
-        return job
-    except UnknownJobIDException as e:
-        raise HTTPException(status_code=404, detail=str(e))
-
-
-@download_queue_router.delete(
-    "/i/{id}",
-    operation_id="cancel_download_job",
-    responses={
-        204: {"description": "Job has been cancelled"},
-        404: {"description": "The requested download JobID could not be found"},
-    },
-)
-async def cancel_download_job(
-    current_user: CurrentUserOrDefault,
-    id: int = Path(description="ID of the download job to cancel."),
-) -> Response:
-    """Cancel a download job using its ID."""
-    try:
-        queue = ApiDependencies.invoker.services.download_queue
-        job = queue.id_to_job(id)
-        queue.cancel_job(job)
-        return Response(status_code=204)
-    except UnknownJobIDException as e:
-        raise HTTPException(status_code=404, detail=str(e))
-
-
-@download_queue_router.delete(
-    "/i",
-    operation_id="cancel_all_download_jobs",
-    responses={
-        204: {"description": "Download jobs have been cancelled"},
-    },
-)
-async def cancel_all_download_jobs(current_user: AdminUserOrDefault) -> Response:
-    """Cancel all download jobs."""
-    ApiDependencies.invoker.services.download_queue.cancel_all_jobs()
-    return Response(status_code=204)
diff --git a/invokeai/app/api/routers/images.py b/invokeai/app/api/routers/images.py
index 976434c68f2..9c723939e85 100644
--- a/invokeai/app/api/routers/images.py
+++ b/invokeai/app/api/routers/images.py
@@ -179,6 +179,7 @@ class ImageUploadEntry(BaseModel):
 
 @images_router.post("/", operation_id="create_image_upload_entry")
 async def create_image_upload_entry(
+    _: CurrentUserOrDefault,
     width: int = Body(description="The width of the image"),
     height: int = Body(description="The height of the image"),
     board_id: Optional[str] = Body(default=None, description="The board to add this image to, if any"),
diff --git a/invokeai/app/api/routers/model_manager.py b/invokeai/app/api/routers/model_manager.py
index bdd2e406444..a9d9e9cef36 100644
--- a/invokeai/app/api/routers/model_manager.py
+++ b/invokeai/app/api/routers/model_manager.py
@@ -19,7 +19,7 @@
 from starlette.exceptions import HTTPException
 from typing_extensions import Annotated
 
-from invokeai.app.api.auth_dependencies import AdminUserOrDefault
+from invokeai.app.api.auth_dependencies import AdminUserOrDefault, CurrentUserOrDefault
 from invokeai.app.api.dependencies import ApiDependencies
 from invokeai.app.services.model_images.model_images_common import ModelImageFileNotFoundException
 from invokeai.app.services.model_install.model_install_common import ModelInstallJob
@@ -155,6 +155,7 @@ def prepare_model_config_for_response(config: AnyModelConfig, dependencies: Type
     operation_id="list_model_records",
 )
 async def list_model_records(
+    current_user: CurrentUserOrDefault,
     base_models: Optional[List[BaseModelType]] = Query(default=None, description="Base models to include"),
     model_type: Optional[ModelType] = Query(default=None, description="The type of model to get"),
     model_name: Optional[str] = Query(default=None, description="Exact match on the name of the model"),
@@ -199,11 +200,14 @@ async def list_model_records(
     operation_id="list_missing_models",
     responses={200: {"description": "List of models with missing files"}},
 )
-async def list_missing_models() -> ModelsList:
+async def list_missing_models(current_user: CurrentUserOrDefault) -> ModelsList:
     """Get models whose files are missing from disk.
 
     These are models that have database entries but their corresponding
     weight files have been deleted externally (not via Model Manager).
+
+    Available to any authenticated user, not just admins: the frontend's model hooks subtract this
+    set from the model list so unusable models are kept out of the generation dropdowns.
     """
     record_store = ApiDependencies.invoker.services.model_manager.store
     models_path = ApiDependencies.invoker.services.configuration.models_path
@@ -224,6 +228,7 @@ async def list_missing_models() -> ModelsList:
     response_model=AnyModelConfig,
 )
 async def get_model_records_by_attrs(
+    current_user: CurrentUserOrDefault,
     name: str = Query(description="The name of the model"),
     type: ModelType = Query(description="The type of the model"),
     base: BaseModelType = Query(description="The base model of the model"),
@@ -245,6 +250,7 @@ async def get_model_records_by_attrs(
     response_model=AnyModelConfig,
 )
 async def get_model_records_by_hash(
+    current_user: CurrentUserOrDefault,
     hash: str = Query(description="The hash of the model"),
 ) -> AnyModelConfig:
     """Gets a model by its hash. This is useful for recalling models that were deleted and reinstalled,
@@ -269,6 +275,7 @@ async def get_model_records_by_hash(
     },
 )
 async def get_model_record(
+    current_user: CurrentUserOrDefault,
     key: str = Path(description="Key of the model record to fetch."),
 ) -> AnyModelConfig:
     """Get a model record"""
@@ -341,14 +348,23 @@ class FoundModel(BaseModel):
     response_model=List[FoundModel],
 )
 async def scan_for_models(
+    current_admin: AdminUserOrDefault,
     scan_path: str = Query(description="Directory path to search for models", default=None),
 ) -> List[FoundModel]:
+    # A single generic error is used for every path-validation failure below, so that the response cannot be
+    # used as an existence/readability oracle for arbitrary filesystem paths.
+    scan_failed = HTTPException(
+        status_code=400,
+        detail=f"The search path '{scan_path}' could not be scanned",
+    )
+
+    # Guard before constructing a Path: the query param defaults to None and pathlib.Path(None) raises.
+    if not scan_path:
+        raise scan_failed
+
     path = pathlib.Path(scan_path)
-    if not scan_path or not path.is_dir():
-        raise HTTPException(
-            status_code=400,
-            detail=f"The search path '{scan_path}' does not exist or is not directory",
-        )
+    if not path.is_dir():
+        raise scan_failed
 
     search = ModelSearch()
     try:
@@ -372,11 +388,13 @@ async def scan_for_models(
             found_model = FoundModel(path=path, is_installed=is_installed)
             scan_results.append(found_model)
     except Exception as e:
-        error_type = type(e).__name__
-        raise HTTPException(
-            status_code=500,
-            detail=f"An error occurred while searching the directory: {error_type}",
+        ApiDependencies.invoker.services.logger.error(
+            f"Error scanning '{scan_path}' for models: {type(e).__name__}: {e}"
         )
+        # By this point is_dir() has already confirmed the path exists, so a distinct status leaks nothing
+        # new. Keeping 500 (with the details only in the server log) preserves the caller-error vs
+        # server-fault distinction for the admin and for retry logic.
+        raise HTTPException(status_code=500, detail=f"An error occurred while scanning '{scan_path}'")
     return scan_results
 
 
@@ -396,6 +414,7 @@ class HuggingFaceModels(BaseModel):
     response_model=HuggingFaceModels,
 )
 async def get_hugging_face_models(
+    current_admin: AdminUserOrDefault,
     hugging_face_repo: str = Query(description="Hugging face repo to search for models", default=None),
 ) -> HuggingFaceModels:
     try:
@@ -1258,7 +1277,7 @@ def get_is_installed(
 
 
 @model_manager_router.get("/starter_models", operation_id="get_starter_models", response_model=StarterModelResponse)
-async def get_starter_models() -> StarterModelResponse:
+async def get_starter_models(current_admin: AdminUserOrDefault) -> StarterModelResponse:
     installed_models = ApiDependencies.invoker.services.model_manager.store.search_by_attr()
     starter_models = deepcopy(STARTER_MODELS)
     starter_bundles = deepcopy(STARTER_BUNDLES)
@@ -1291,7 +1310,7 @@ async def get_starter_models() -> StarterModelResponse:
     response_model=Optional[CacheStats],
     summary="Get model manager RAM cache performance statistics.",
 )
-async def get_stats() -> Optional[CacheStats]:
+async def get_stats(current_admin: AdminUserOrDefault) -> Optional[CacheStats]:
     """Return performance statistics on the model manager's RAM cache. Will return null if no models have been loaded."""
 
     return ApiDependencies.invoker.services.model_manager.load.ram_cache.stats
@@ -1341,7 +1360,7 @@ def reset_token(cls) -> HFTokenStatus:
 
 
 @model_manager_router.get("/hf_login", operation_id="get_hf_login_status", response_model=HFTokenStatus)
-async def get_hf_login_status() -> HFTokenStatus:
+async def get_hf_login_status(current_admin: AdminUserOrDefault) -> HFTokenStatus:
     token_status = HFTokenHelper.get_status()
 
     if token_status is HFTokenStatus.UNKNOWN:
diff --git a/invokeai/app/api/sockets.py b/invokeai/app/api/sockets.py
index 7e93c332d64..f0ea1aacf1d 100644
--- a/invokeai/app/api/sockets.py
+++ b/invokeai/app/api/sockets.py
@@ -260,6 +260,17 @@ async def _handle_sub_bulk_download(self, sid: str, data: Any) -> None:
     async def _handle_unsub_bulk_download(self, sid: str, data: Any) -> None:
         await self._sio.leave_room(sid, BulkDownloadSubscriptionEvent(**data).bulk_download_id)
 
+    def _admin_sids(self) -> list[str]:
+        """Sockets belonging to administrators, identified at connect time.
+
+        The "admin" room is only entered on queue subscription, so it cannot carry events
+        that are not tied to a queue: a socket that has connected but not yet sent
+        `subscribe_queue` is in no rooms at all and would miss them. `_socket_users` is
+        populated in `_handle_connect`, so addressing those sockets directly covers the
+        window between connect and subscribe.
+        """
+        return [sid for sid, info in self._socket_users.items() if info.get("is_admin")]
+
     async def _handle_queue_event(self, event: FastAPIEvent[QueueEventBase]):
         """Handle queue events with user isolation.
 
@@ -354,7 +365,24 @@ async def _handle_queue_event(self, event: FastAPIEvent[QueueEventBase]):
             logger.error(f"Error handling queue event {event[0]}: {e}", exc_info=True)
 
     async def _handle_model_event(self, event: FastAPIEvent[ModelEventBase | DownloadEventBase]) -> None:
-        await self._sio.emit(event=event[0], data=event[1].model_dump(mode="json"))
+        event_name, event_data = event
+
+        # Model load events drive the loading-models spinner in every client, so they stay
+        # broadcast. Their `config` does carry `path` and `source`, but any authenticated user
+        # can already read those for every model from `list_model_records`, so broadcasting
+        # them discloses nothing new. (Upstream routes these to the triggering user's room
+        # instead, which needs a `user_id` on the event that this release line does not have.)
+        if isinstance(event_data, (ModelLoadStartedEvent, ModelLoadCompleteEvent)):
+            await self._sio.emit(event=event_name, data=event_data.model_dump(mode="json"))
+            return
+
+        # Model install and download events contain signed source URLs and server filesystem
+        # paths. They feed the admin-only model manager UI and must not be broadcast to users.
+        # Addressed to the admin sockets rather than the "admin" room because that room is only
+        # entered on queue subscription, and these events are not tied to a queue.
+        admin_sids = self._admin_sids()
+        if admin_sids:
+            await self._sio.emit(event=event_name, data=event_data.model_dump(mode="json"), to=admin_sids)
 
     async def _handle_bulk_image_download_event(self, event: FastAPIEvent[BulkDownloadEventBase]) -> None:
         event_name, event_data = event
diff --git a/invokeai/app/api_app.py b/invokeai/app/api_app.py
index 4b79e1eeb0c..bbc1fbb31ad 100644
--- a/invokeai/app/api_app.py
+++ b/invokeai/app/api_app.py
@@ -22,7 +22,6 @@
     boards,
     client_state,
     custom_nodes,
-    download_queue,
     images,
     model_manager,
     model_relationships,
@@ -175,7 +174,6 @@ async def dispatch(self, request: Request, call_next: RequestResponseEndpoint):
 app.include_router(auth.auth_router, prefix="/api")
 app.include_router(utilities.utilities_router, prefix="/api")
 app.include_router(model_manager.model_manager_router, prefix="/api")
-app.include_router(download_queue.download_queue_router, prefix="/api")
 app.include_router(images.images_router, prefix="/api")
 app.include_router(boards.boards_router, prefix="/api")
 app.include_router(board_images.board_images_router, prefix="/api")
diff --git a/invokeai/app/invocations/qwen_image_image_to_latents.py b/invokeai/app/invocations/qwen_image_image_to_latents.py
index ef88e03082b..ffae5470f68 100644
--- a/invokeai/app/invocations/qwen_image_image_to_latents.py
+++ b/invokeai/app/invocations/qwen_image_image_to_latents.py
@@ -18,6 +18,7 @@
 from invokeai.backend.model_manager.load.load_base import LoadedModel
 from invokeai.backend.stable_diffusion.diffusers_pipeline import image_resized_to_grid_as_tensor
 from invokeai.backend.util.devices import TorchDevice
+from invokeai.backend.util.vae_working_memory import estimate_vae_working_memory_qwen_image
 
 
 @invocation(
@@ -44,7 +45,13 @@ class QwenImageImageToLatentsInvocation(BaseInvocation, WithMetadata, WithBoard)
 
     @staticmethod
     def vae_encode(vae_info: LoadedModel, image_tensor: torch.Tensor) -> torch.Tensor:
-        with vae_info.model_on_device() as (_, vae):
+        assert isinstance(vae_info.model, AutoencoderKLQwenImage)
+        estimated_working_memory = estimate_vae_working_memory_qwen_image(
+            operation="encode",
+            image_tensor=image_tensor,
+            vae=vae_info.model,
+        )
+        with vae_info.model_on_device(working_mem_bytes=estimated_working_memory) as (_, vae):
             assert isinstance(vae, AutoencoderKLQwenImage)
 
             vae.disable_tiling()
diff --git a/invokeai/app/invocations/qwen_image_latents_to_image.py b/invokeai/app/invocations/qwen_image_latents_to_image.py
index b3ea39c4bbf..072185f147b 100644
--- a/invokeai/app/invocations/qwen_image_latents_to_image.py
+++ b/invokeai/app/invocations/qwen_image_latents_to_image.py
@@ -19,6 +19,7 @@
 from invokeai.app.services.shared.invocation_context import InvocationContext
 from invokeai.backend.stable_diffusion.extensions.seamless import SeamlessExt
 from invokeai.backend.util.devices import TorchDevice
+from invokeai.backend.util.vae_working_memory import estimate_vae_working_memory_qwen_image
 
 
 @invocation(
@@ -41,9 +42,14 @@ def invoke(self, context: InvocationContext) -> ImageOutput:
 
         vae_info = context.models.load(self.vae.vae)
         assert isinstance(vae_info.model, AutoencoderKLQwenImage)
+        estimated_working_memory = estimate_vae_working_memory_qwen_image(
+            operation="decode",
+            image_tensor=latents,
+            vae=vae_info.model,
+        )
         with (
             SeamlessExt.static_patch_model(vae_info.model, self.vae.seamless_axes),
-            vae_info.model_on_device() as (_, vae),
+            vae_info.model_on_device(working_mem_bytes=estimated_working_memory) as (_, vae),
         ):
             context.util.signal_progress("Running VAE")
             assert isinstance(vae, AutoencoderKLQwenImage)
diff --git a/invokeai/app/services/config/config_default.py b/invokeai/app/services/config/config_default.py
index e6cc7c2798c..678a4492e54 100644
--- a/invokeai/app/services/config/config_default.py
+++ b/invokeai/app/services/config/config_default.py
@@ -122,6 +122,8 @@ class InvokeAIAppConfig(BaseSettings):
         hashing_algorithm: Model hashing algorthim for model installs. 'blake3_multi' is best for SSDs. 'blake3_single' is best for spinning disk HDDs. 'random' disables hashing, instead assigning a UUID to models. Useful when using a memory db to reduce model installation time, or if you don't care about storing stable hashes for models. Alternatively, any other hashlib algorithm is accepted, though these are not nearly as performant as blake3.<br>Valid values: `blake3_multi`, `blake3_single`, `random`, `md5`, `sha1`, `sha224`, `sha256`, `sha384`, `sha512`, `blake2b`, `blake2s`, `sha3_224`, `sha3_256`, `sha3_384`, `sha3_512`, `shake_128`, `shake_256`
         remote_api_tokens: List of regular expression and token pairs used when downloading models from URLs. The download URL is tested against the regex, and if it matches, the token is provided in as a Bearer token.
         scan_models_on_startup: Scan the models directory on startup, registering orphaned models. This is typically only used in conjunction with `use_memory_db` for testing purposes.
+        allow_private_download_urls: Allow the download queue to fetch from loopback, link-local and private-network addresses. Disabled by default so that a download URL cannot be used to reach services that are only reachable from the server. Enable this only if you install models from a mirror on your own network.
+        download_proxy: Optional HTTP proxy for model downloads. The proxy must enforce the public-address policy because proxy-side DNS cannot be checked by InvokeAI.
         unsafe_disable_picklescan: UNSAFE. Disable the picklescan security check during model installation. Recommended only for development and testing purposes. This will allow arbitrary code execution during model installation, so should never be used in production.
         allow_unknown_models: Allow installation of models that we are unable to identify. If enabled, models will be marked as `unknown` in the database, and will not have any metadata associated with them. If disabled, unknown models will be rejected during installation.
         multiuser: Enable multiuser support. When disabled, the application runs in single-user mode using a default system account with administrator privileges. When enabled, requires user authentication and authorization.
@@ -226,6 +228,8 @@ class InvokeAIAppConfig(BaseSettings):
     hashing_algorithm: HASHING_ALGORITHMS = Field(default="blake3_single",  description="Model hashing algorthim for model installs. 'blake3_multi' is best for SSDs. 'blake3_single' is best for spinning disk HDDs. 'random' disables hashing, instead assigning a UUID to models. Useful when using a memory db to reduce model installation time, or if you don't care about storing stable hashes for models. Alternatively, any other hashlib algorithm is accepted, though these are not nearly as performant as blake3.")
     remote_api_tokens: Optional[list[URLRegexTokenPair]] = Field(default=None, description="List of regular expression and token pairs used when downloading models from URLs. The download URL is tested against the regex, and if it matches, the token is provided in as a Bearer token.")
     scan_models_on_startup:        bool = Field(default=False,              description="Scan the models directory on startup, registering orphaned models. This is typically only used in conjunction with `use_memory_db` for testing purposes.")
+    allow_private_download_urls:   bool = Field(default=False,              description="Allow the download queue to fetch from loopback, link-local and private-network addresses. Disabled by default so that a download URL cannot be used to reach services that are only reachable from the server. Enable this only if you install models from a mirror on your own network.")
+    download_proxy:                Optional[str] = Field(default=None,      description="Optional HTTP proxy for model downloads. The proxy must enforce the public-address policy because proxy-side DNS cannot be checked by InvokeAI.")
     unsafe_disable_picklescan:     bool = Field(default=False,              description="UNSAFE. Disable the picklescan security check during model installation. Recommended only for development and testing purposes. This will allow arbitrary code execution during model installation, so should never be used in production.")
     allow_unknown_models:          bool = Field(default=True,              description="Allow installation of models that we are unable to identify. If enabled, models will be marked as `unknown` in the database, and will not have any metadata associated with them. If disabled, unknown models will be rejected during installation.")
 
diff --git a/invokeai/app/services/download/download_base.py b/invokeai/app/services/download/download_base.py
index 1798fd69df5..9f943bf1878 100644
--- a/invokeai/app/services/download/download_base.py
+++ b/invokeai/app/services/download/download_base.py
@@ -7,7 +7,7 @@
 from pathlib import Path
 from typing import Any, Callable, List, Optional, Set, Union
 
-from pydantic import BaseModel, Field, PrivateAttr
+from pydantic import BaseModel, Field, PrivateAttr, field_serializer
 from pydantic.networks import AnyHttpUrl
 
 from invokeai.backend.model_manager.metadata import RemoteModelFile
@@ -60,6 +60,17 @@ class DownloadJobBase(BaseModel):
     error_type: Optional[str] = Field(default=None, description="Name of exception that caused an error")
     error: Optional[str] = Field(default=None, description="Traceback of the exception that caused an error")
 
+    @field_serializer("dest", "download_path")
+    def _serialize_path(self, path: Optional[Path]) -> Optional[str]:
+        """Emit paths with forward slashes so the wire format does not depend on the server's OS.
+
+        `str(WindowsPath("models/x.bin"))` is `models\\x.bin`, so without this a client that
+        submits a POSIX-style `dest` gets a different spelling back from a Windows host than
+        from a Linux one. The download events already normalise this way - see
+        `DownloadStartedEvent.build` in `events_common.py`.
+        """
+        return path.as_posix() if path is not None else None
+
     # internal flag
     _cancelled: bool = PrivateAttr(default=False)
     _paused: bool = PrivateAttr(default=False)
diff --git a/invokeai/app/services/download/download_default.py b/invokeai/app/services/download/download_default.py
index 13e86d18284..88a51a502eb 100644
--- a/invokeai/app/services/download/download_default.py
+++ b/invokeai/app/services/download/download_default.py
@@ -6,11 +6,11 @@
 import threading
 import time
 import traceback
-from pathlib import Path
+from pathlib import Path, PurePosixPath, PureWindowsPath
 from queue import Empty, PriorityQueue
 from shutil import disk_usage
 from typing import TYPE_CHECKING, Any, Dict, List, Literal, Optional, Set
-from urllib.parse import urlparse
+from urllib.parse import urljoin, urlparse
 
 import requests
 from pydantic.networks import AnyHttpUrl
@@ -31,6 +31,7 @@
     UnknownJobIDException,
 )
 from invokeai.app.util.misc import get_iso_timestamp
+from invokeai.app.util.ssrf import build_guarded_session, validate_download_url, warn_if_proxied
 from invokeai.backend.model_manager.metadata import RemoteModelFile
 from invokeai.backend.util.logging import InvokeAILogger
 
@@ -71,7 +72,27 @@ def __init__(
         self._lock = threading.Lock()
         self._logger = InvokeAILogger.get_logger("DownloadQueueService")
         self._event_bus = event_bus
-        self._requests = requests_session or requests.Session()
+        # A caller-supplied session is left exactly as given (the tests inject mock
+        # transports). Sessions we build ourselves refuse to connect to a non-public
+        # address, which is the check that holds against DNS rebinding and against host
+        # spellings that `requests` decodes differently from us.
+        self._request_proxies: Optional[Dict[str, str]] = None
+        if requests_session is not None:
+            self._requests = requests_session
+        elif self._app_config.allow_private_download_urls:
+            # The operator has opted out of the address policy, so ambient proxy variables
+            # keep working here exactly as they always have — but an explicitly configured
+            # download_proxy must still be honored rather than silently ignored when both
+            # settings are present. It is applied per request (see the single call site in
+            # _do_download) because that is the only level that takes precedence over
+            # ambient *_PROXY variables in a plain Session.
+            self._requests = requests.Session()
+            if self._app_config.download_proxy:
+                proxy = self._app_config.download_proxy
+                self._request_proxies = {"http": proxy, "https": proxy}
+        else:
+            self._requests = build_guarded_session(proxy=self._app_config.download_proxy)
+            warn_if_proxied(self._requests, self._logger)
         self._accept_download_requests = False
         self._max_parallel_dl = max_parallel_dl
 
@@ -418,8 +439,18 @@ def _do_download(self, job: DownloadJob) -> None:
                 job.resume_message = "Partial file missing. Restarted download from the beginning."
 
         # Make a streaming request. This will retrieve headers including
-        # content-length and content-disposition, but not fetch any content itself
-        resp = self._requests.get(str(url), headers=header, stream=True)
+        # content-length and content-disposition, but not fetch any content itself.
+        # The URL is checked here rather than at submit time so that it is the address we
+        # are about to connect to that gets vetted, and the response hook re-checks every
+        # redirect hop — otherwise a public URL could bounce us onto a private address.
+        self._validate_url(url)
+        resp = self._requests.get(
+            str(url),
+            headers=header,
+            stream=True,
+            hooks={"response": self._reject_unsafe_redirect},
+            proxies=self._request_proxies,
+        )
         job.final_url = str(resp.url) if resp.url else None
         self._logger.debug(
             "Resume response: "
@@ -467,6 +498,11 @@ def _do_download(self, job: DownloadJob) -> None:
                 if self._validate_filename(job.dest.as_posix(), remote_name):
                     file_name = remote_name
 
+            # The URL path is attacker-influenced too -- a final segment of ".." would
+            # otherwise put download_path one level above dest.
+            if not self._validate_filename(job.dest.as_posix(), file_name):
+                raise ValueError(f"Cannot derive a safe filename for {url} from '{file_name}'")
+
             job.download_path = job.dest / file_name
 
         else:
@@ -578,13 +614,40 @@ def _do_download(self, job: DownloadJob) -> None:
         self._logger.debug(f"{job.source}: saved to {job.download_path} (bytes={job.bytes})")
         in_progress_path.rename(job.download_path)
 
+    def _validate_url(self, url: str) -> None:
+        """Refuse to fetch URLs that point at addresses only the server can reach."""
+        validate_download_url(str(url), allow_private_urls=self._app_config.allow_private_download_urls)
+
+    def _reject_unsafe_redirect(self, response: requests.Response, *args: Any, **kwargs: Any) -> requests.Response:
+        """Response hook: vet each redirect target before `requests` follows it."""
+        if response.is_redirect or response.is_permanent_redirect:
+            location = response.headers.get("location")
+            if location:
+                try:
+                    self._validate_url(urljoin(response.url, location))
+                except Exception:
+                    response.close()
+                    raise
+        return response
+
     def _validate_filename(self, directory: str, filename: str) -> bool:
         pc_name_max = get_pc_name_max(directory)
         pc_path_max = get_pc_path_max(directory)
-        if "/" in filename:
+        # The name must be a single path component. A remote server picks this value, so
+        # separators of either flavour, drive letters and '..' all have to be rejected --
+        # on Windows `Path(dir) / "..\\evil"` escapes `dir` even though it has no '/'.
+        if "/" in filename or "\\" in filename:
+            return False
+        if filename in ("", ".", ".."):
             return False
         if filename.startswith(".."):
             return False
+        if PurePosixPath(filename).is_absolute() or PureWindowsPath(filename).is_absolute():
+            return False
+        # `WindowsPath("D:/dest") / "C:evil"` yields "C:evil" -- a drive-relative name
+        # replaces the destination entirely without ever looking absolute.
+        if PureWindowsPath(filename).drive:
+            return False
         if len(filename) > pc_name_max:
             return False
         if len(os.path.join(directory, filename)) > pc_path_max:
diff --git a/invokeai/app/services/model_install/model_install_default.py b/invokeai/app/services/model_install/model_install_default.py
index 3baf11029ff..d34a467eeee 100644
--- a/invokeai/app/services/model_install/model_install_default.py
+++ b/invokeai/app/services/model_install/model_install_default.py
@@ -355,7 +355,8 @@ def stop(self, invoker: Optional[Invoker] = None) -> None:
         self._logger.debug("calling stop_event.set()")
         self._stop_event.set()
         self._clear_pending_jobs()
-        self._download_cache.clear()
+        with self._lock:
+            self._download_cache.clear()
         assert self._install_thread is not None
         self._install_thread.join()
         self._running = False
@@ -520,7 +521,14 @@ def wait_for_installs(self, timeout: int = 0) -> List[ModelInstallJob]:  # noqa
         self._wait_for_restore_complete()
 
         start = time.time()
-        while len(self._download_cache) > 0:
+        while True:
+            # The completion callback removes a download from this cache while holding
+            # the same lock it uses to enqueue the install. Do not observe the cache
+            # between those two operations.
+            with self._lock:
+                downloads_pending = bool(self._download_cache)
+            if not downloads_pending:
+                break
             if self._downloads_changed_event.wait(timeout=0.25):  # in case we miss an event
                 self._downloads_changed_event.clear()
             if timeout > 0 and time.time() - start > timeout:
@@ -1257,7 +1265,8 @@ def _enqueue_remote_download(
                 part.final_url = meta.get("final_url") or part.final_url
                 if meta.get("download_path"):
                     part.download_path = Path(meta.get("download_path"))
-        self._download_cache[multifile_job.id] = job
+        with self._lock:
+            self._download_cache[multifile_job.id] = job
         job._multifile_job = multifile_job
 
         self._write_install_marker(job, status=InstallStatus.WAITING)
diff --git a/invokeai/app/util/ssrf.py b/invokeai/app/util/ssrf.py
new file mode 100644
index 00000000000..4825c9e1cc0
--- /dev/null
+++ b/invokeai/app/util/ssrf.py
@@ -0,0 +1,361 @@
+"""Guards against server-side request forgery (SSRF) via user-supplied download URLs.
+
+The download queue fetches URLs supplied over the API. Without a check, a caller can
+point the server at addresses only the server can reach — loopback services, other
+hosts on the private network, or the cloud metadata endpoint at 169.254.169.254 — and
+use the download job as a proxy for them.
+
+There are two layers here, and the second is the one that actually holds:
+
+`build_guarded_session()` returns a `requests.Session` that validates the peer address
+of every socket it opens, before a single byte of the request is written. Checking the
+connected socket is the only check that cannot be desynchronised from what the HTTP
+client does: it is immune to DNS rebinding (the client resolves again after any
+up-front check, and an attacker controlling the zone can answer the two lookups
+differently) and to hostname spellings that we and `requests` disagree about (it
+percent-decodes unreserved characters in the host, so `http://%6cocalhost/` and
+`http://169.254.169%2e254/` reach loopback and the metadata service respectively).
+
+`validate_download_url()` is the cheap up-front check. It rejects the obvious cases
+before any packet is sent — which keeps the API's error messages useful and stops the
+socket layer being used as a port-existence oracle — but it resolves the host itself,
+so it must never be relied on alone.
+
+Ambient `HTTP_PROXY`/`HTTPS_PROXY`/`ALL_PROXY` settings are ignored by the guarded session.
+That keeps destination resolution inside this process, where the socket-level policy can
+inspect the connected peer, while Requests' CA-bundle and netrc environment support remains
+enabled. A caller that explicitly adds a proxy to a session accepts the proxy's destination
+policy instead; `warn_if_proxied()` reports that weaker configuration.
+"""
+
+from __future__ import annotations
+
+import ipaddress
+import logging
+import socket
+from collections.abc import Iterator
+from typing import Any
+from urllib.parse import unquote, urlsplit
+from urllib.request import getproxies
+
+import requests
+from requests.adapters import HTTPAdapter
+from requests.auth import _basic_auth_str
+from requests.models import PreparedRequest
+from requests.utils import get_auth_from_url, resolve_proxies
+from urllib3.connection import HTTPConnection, HTTPSConnection
+from urllib3.connectionpool import HTTPConnectionPool, HTTPSConnectionPool
+
+ALLOWED_SCHEMES = ("http", "https")
+logger = logging.getLogger(__name__)
+
+IpAddress = ipaddress.IPv4Address | ipaddress.IPv6Address
+
+
+class UnsafeDownloadURLException(ValueError):
+    """Raised when a URL points at a network location the download service refuses to fetch."""
+
+
+# RFC 5214 reserves this interface-identifier marker for ISATAP; the 32 bits after it are
+# the tunnelled IPv4 address. `u/g` may be 0x0000 or 0x0200.
+_ISATAP_MARKERS = (0x00005EFE, 0x02005EFE)
+
+
+def _candidates(ip: IpAddress) -> Iterator[IpAddress]:
+    """The address itself, plus every IPv4 address it can carry traffic to.
+
+    IPv6 has several ways to wrap an IPv4 destination, and on a host with the matching
+    transition mechanism enabled, connecting to the wrapper reaches the embedded IPv4
+    address. `IPv6Address("::ffff:127.0.0.1").is_loopback` is False, so the inner address
+    has to be pulled out and judged on its own.
+
+    An IPv4-mapped IPv6 address is an alternate spelling of its embedded IPv4 address, so
+    only the embedded address is judged. Other wrappers must be acceptable themselves and
+    what they wrap, which is why those addresses are yielded rather than substituted: a
+    Teredo address whose embedded client is public is still a Teredo address.
+
+    Only wrappers identifiable from the address alone are enumerated: v4-mapped, 6to4,
+    Teredo and ISATAP. The NAT64 well-known prefixes (`64:ff9b::/96`, `64:ff9b:1::/48`)
+    need no special case — they sit in `::/8` and so are already `is_reserved`. NAT64 with
+    an operator-chosen network-specific prefix, 6rd, and SIIT-EAM are out of scope by
+    construction: their prefix length and bit offsets are site-local configuration, so a
+    translated address is indistinguishable from any other global one. 6over4 is likewise
+    excluded — its "IPv4 in the low 32 bits" layout is what an ordinary hand-assigned
+    address looks like, so screening for it would reject a great deal of real traffic.
+    """
+    if isinstance(ip, ipaddress.IPv6Address):
+        if ip.ipv4_mapped is not None:
+            yield ip.ipv4_mapped
+            return
+        yield ip
+        teredo = ip.teredo
+        for inner in (ip.sixtofour, teredo[1] if teredo else None):
+            if inner is not None:
+                yield inner
+        if (int(ip) >> 32) & 0xFFFFFFFF in _ISATAP_MARKERS:
+            yield ipaddress.IPv4Address(int(ip) & 0xFFFFFFFF)
+    else:
+        yield ip
+
+
+def _is_blocked(ip: IpAddress) -> bool:
+    """Allow only globally-routable unicast addresses, wrappers included.
+
+    `is_global` rather than a hand-written range list, so that the shared address space
+    (`100.64.0.0/10`, RFC 6598) and the benchmarking range are covered — neither is
+    `is_private` or `is_reserved`, but both reach a provider's internal infrastructure.
+
+    `is_reserved` and `is_multicast` are still needed on top of it: for IPv6, CPython
+    defines `is_global` as `not is_private`, and the IPv6 private list covers neither the
+    reserved/unallocated space (`::/8`, `4000::/3`, the NAT64 prefixes) nor multicast, all
+    of which report `is_global == True`.
+    """
+    return any(not c.is_global or c.is_reserved or c.is_multicast for c in _candidates(ip))
+
+
+def _resolve(host: str, port: int | None) -> list[IpAddress]:
+    infos = socket.getaddrinfo(host, port, proto=socket.IPPROTO_TCP)
+    return [ipaddress.ip_address(info[4][0]) for info in infos]
+
+
+def _host_spellings(host: str) -> list[str]:
+    """Every host string the HTTP client might end up connecting to.
+
+    `requests` runs the URL through `requote_uri()`, which decodes percent-escapes of
+    unreserved characters. So `169.254.169%2e254` is checked by us as-is but connected to
+    as `169.254.169.254`. Check the decoded form too; the socket-level guard is what
+    finally catches anything this misses.
+    """
+    spellings = [host]
+    decoded = unquote(host)
+    if decoded != host:
+        spellings.append(decoded)
+    return spellings
+
+
+def _parse_ipv4_literal(host: str) -> IpAddress | None:
+    """Parse dotted and legacy numeric IPv4 spellings accepted by HTTP clients."""
+    host = host.removesuffix(".")
+    try:
+        return ipaddress.ip_address(host)
+    except ValueError:
+        pass
+
+    parts = host.split(".")
+    if not 1 <= len(parts) <= 4:
+        return None
+
+    values: list[int] = []
+    for part in parts:
+        if not part or part[0] in "+-" or not part.isascii():
+            return None
+        if part.lower().startswith("0x"):
+            base, digits = 16, part[2:]
+        elif len(part) > 1 and part.startswith("0"):
+            base, digits = 8, part[1:]
+        else:
+            base, digits = 10, part
+        alphabet = "0123456789abcdef"[:base]
+        if not digits or any(char.lower() not in alphabet for char in digits):
+            return None
+        try:
+            values.append(int(digits, base))
+        except ValueError:
+            return None
+
+    widths = {1: (32,), 2: (8, 24), 3: (8, 8, 16), 4: (8, 8, 8, 8)}[len(values)]
+    if any(value >= 1 << width for value, width in zip(values, widths, strict=True)):
+        return None
+
+    address = 0
+    for value, width in zip(values, widths, strict=True):
+        address = (address << width) | value
+    return ipaddress.IPv4Address(address)
+
+
+def check_address(ip: IpAddress, host: str) -> None:
+    """Raise if `ip` is not an address we are willing to connect to."""
+    if _is_blocked(ip):
+        logger.warning("Blocked download host %s resolving to non-public address %s", host, ip)
+        raise UnsafeDownloadURLException(
+            f"Refusing to download from '{host}': it resolves to a non-public address. "
+            "Set `allow_private_download_urls` in invokeai.yaml to permit downloads from loopback "
+            "and private-network addresses."
+        )
+
+
+def validate_download_url(url: str, allow_private_urls: bool = False) -> None:
+    """Reject `url` up front if it obviously points somewhere only the server can reach.
+
+    Every address the host resolves to must be public — a hostname with both a public and a
+    loopback record is rejected, because we cannot control which one the HTTP client picks.
+
+    An unresolvable host is allowed through to the HTTP client, so that offline test
+    environments and mocked sessions keep working. That is only safe because the session
+    from `build_guarded_session()` re-checks the address it actually connects to.
+    """
+    parts = urlsplit(str(url))
+
+    if parts.scheme.lower() not in ALLOWED_SCHEMES:
+        raise UnsafeDownloadURLException(f"Unsupported URL scheme '{parts.scheme}'. Only http and https are allowed.")
+
+    host = parts.hostname
+    if not host:
+        raise UnsafeDownloadURLException(f"Download URL '{url}' has no host.")
+
+    try:
+        port = parts.port
+    except ValueError as e:
+        raise UnsafeDownloadURLException(f"Download URL '{url}' has an invalid port.") from e
+
+    if allow_private_urls:
+        return
+
+    for spelling in _host_spellings(host):
+        literal = _parse_ipv4_literal(spelling)
+        if literal is not None:
+            candidates = [literal]
+        else:
+            try:
+                candidates = _resolve(spelling, port)
+            except (OSError, UnicodeError, ValueError):
+                continue
+        for candidate in candidates:
+            check_address(candidate, host)
+
+
+def _check_socket(sock: socket.socket) -> None:
+    """Validate the address a socket is actually connected to."""
+    peer = sock.getpeername()
+    # IPv6 peers come back as (host, port, flowinfo, scope_id) and the host may carry a
+    # "%iface" suffix; ip_address() will not parse that.
+    address = ipaddress.ip_address(str(peer[0]).partition("%")[0])
+    check_address(address, str(peer[0]))
+
+
+class _GuardedHTTPConnection(HTTPConnection):
+    def _new_conn(self) -> socket.socket:
+        sock = super()._new_conn()
+        try:
+            _check_socket(sock)
+        except BaseException:
+            sock.close()
+            raise
+        return sock
+
+
+class _GuardedHTTPSConnection(HTTPSConnection):
+    def _new_conn(self) -> socket.socket:
+        # Checked here rather than after `connect()` so that we bail out before the TLS
+        # handshake, not just before the HTTP request.
+        sock = super()._new_conn()
+        try:
+            _check_socket(sock)
+        except BaseException:
+            sock.close()
+            raise
+        return sock
+
+
+class _GuardedHTTPConnectionPool(HTTPConnectionPool):
+    ConnectionCls = _GuardedHTTPConnection
+
+
+class _GuardedHTTPSConnectionPool(HTTPSConnectionPool):
+    ConnectionCls = _GuardedHTTPSConnection
+
+
+class SsrfGuardedAdapter(HTTPAdapter):
+    """A `requests` adapter that refuses to talk to non-public addresses."""
+
+    def init_poolmanager(self, *args: Any, **kwargs: Any) -> None:
+        super().init_poolmanager(*args, **kwargs)
+        self.poolmanager.pool_classes_by_scheme = {
+            "http": _GuardedHTTPConnectionPool,
+            "https": _GuardedHTTPSConnectionPool,
+        }
+
+
+class _SsrfGuardedSession(requests.Session):
+    """Session that keeps Requests environment support but drops ambient proxies."""
+
+    _ignore_environment_proxies = True
+
+    def merge_environment_settings(
+        self,
+        url: str,
+        proxies: dict[str, str] | None,
+        stream: bool | None,
+        verify: bool | str | None,
+        cert: str | tuple[str, str] | None,
+    ) -> dict[str, Any]:
+        request_proxies = dict(proxies or {})
+        settings = super().merge_environment_settings(url, proxies, stream, verify, cert)
+        # `super()` supplies CA-bundle and netrc environment settings, which we want to
+        # retain. Replace only the merged proxy map so ambient proxies cannot bypass the
+        # peer-address check. Explicit session/request proxies remain supported but weaker.
+        effective_proxies = dict(self.proxies)
+        effective_proxies.update(request_proxies)
+        settings["proxies"] = effective_proxies
+        return settings
+
+    def rebuild_proxies(self, prepared_request: PreparedRequest, proxies: dict[str, str] | None) -> dict[str, str]:
+        """Rebuild explicit proxies across redirects without consulting the environment."""
+        new_proxies = resolve_proxies(prepared_request, proxies, trust_env=False)
+        headers = prepared_request.headers
+        if "Proxy-Authorization" in headers:
+            del headers["Proxy-Authorization"]
+
+        scheme = urlsplit(prepared_request.url).scheme
+        try:
+            username, password = get_auth_from_url(new_proxies[scheme])
+        except KeyError:
+            username, password = None, None
+
+        # urllib3 handles proxy authorization for HTTPS tunnels. Avoid putting these
+        # credentials in the tunneled request headers.
+        if not scheme.startswith("https") and username and password:
+            headers["Proxy-Authorization"] = _basic_auth_str(username, password)
+        return new_proxies
+
+    def send(self, request: PreparedRequest, **kwargs: Any) -> requests.Response:
+        """Keep direct `send()` calls from reintroducing ambient proxies."""
+        if kwargs.get("proxies") is None:
+            kwargs["proxies"] = dict(self.proxies)
+        return super().send(request, **kwargs)
+
+
+def build_guarded_session(proxy: str | None = None) -> requests.Session:
+    """A `requests.Session` that will not open a connection to a non-public address."""
+    session = _SsrfGuardedSession()
+    if proxy:
+        session.proxies.update({"http": proxy, "https": proxy})
+    adapter = SsrfGuardedAdapter()
+    session.mount("http://", adapter)
+    session.mount("https://", adapter)
+    return session
+
+
+def proxies_in_effect(session: requests.Session) -> dict[str, str]:
+    """Proxies this session would use, including ones inherited from the environment."""
+    proxies = dict(session.proxies)
+    if session.trust_env and not getattr(session, "_ignore_environment_proxies", False):
+        # Every key, not just http/https: `ALL_PROXY` arrives as the key "all", which
+        # `requests.utils.select_proxy` honours as a catch-all. Filtering by scheme would
+        # miss the form most egress-proxy setups actually use.
+        for scheme, proxy_url in getproxies().items():
+            proxies.setdefault(scheme, proxy_url)
+    return proxies
+
+
+def warn_if_proxied(session: requests.Session, logger: logging.Logger) -> None:
+    """Report explicit proxies or ignored ambient proxy settings."""
+    proxies = proxies_in_effect(session)
+    if proxies:
+        logger.warning(
+            "An explicit HTTP proxy is configured (%s). Downloads through it cannot be checked "
+            "against loopback/private addresses at the socket; restrict outbound access at the proxy.",
+            ", ".join(sorted(proxies)),
+        )
+    elif getattr(session, "_ignore_environment_proxies", False) and getproxies():
+        logger.warning("Ambient HTTP proxy settings are ignored for guarded downloads.")
diff --git a/invokeai/backend/model_manager/load/model_loaders/qwen_image.py b/invokeai/backend/model_manager/load/model_loaders/qwen_image.py
index 289f1c92d1e..11cd497720b 100644
--- a/invokeai/backend/model_manager/load/model_loaders/qwen_image.py
+++ b/invokeai/backend/model_manager/load/model_loaders/qwen_image.py
@@ -444,7 +444,15 @@ def _load_text_encoder_from_singlefile(self, config: QwenVLEncoder_Checkpoint_Co
         # `model.language_model.X`. Apply the same conversion mapping that
         # `Qwen2_5_VLForConditionalGeneration.from_pretrained` would, since
         # `load_state_dict` does not.
-        key_mapping = Qwen2_5_VLForConditionalGeneration._checkpoint_conversion_mapping
+        #
+        # transformers ≤4.x exposed this as `_checkpoint_conversion_mapping`, but 5.x
+        # dropped it (returns `{}`), so we fall back to the legacy mapping ourselves.
+        # The negative lookahead keeps already-converted checkpoints untouched, so the
+        # remap is safe to apply to both legacy and new-layout single-file checkpoints.
+        key_mapping = Qwen2_5_VLForConditionalGeneration._checkpoint_conversion_mapping or {
+            r"^visual": "model.visual",
+            r"^model(?!\.(language_model|visual))": "model.language_model",
+        }
         if key_mapping:
             remapped_sd: dict[str, torch.Tensor] = {}
             for old_key, tensor in sd.items():
diff --git a/invokeai/backend/util/vae_working_memory.py b/invokeai/backend/util/vae_working_memory.py
index f9228ced652..57d558c03b4 100644
--- a/invokeai/backend/util/vae_working_memory.py
+++ b/invokeai/backend/util/vae_working_memory.py
@@ -2,6 +2,7 @@
 
 import torch
 from diffusers.models.autoencoders.autoencoder_kl import AutoencoderKL
+from diffusers.models.autoencoders.autoencoder_kl_qwenimage import AutoencoderKLQwenImage
 from diffusers.models.autoencoders.autoencoder_tiny import AutoencoderTiny
 
 from invokeai.app.invocations.constants import LATENT_SCALE_FACTOR
@@ -92,6 +93,57 @@ def estimate_vae_working_memory_flux(
     return int(working_memory)
 
 
+def estimate_vae_working_memory_qwen_image(
+    operation: Literal["encode", "decode"], image_tensor: torch.Tensor, vae: AutoencoderKLQwenImage
+) -> int:
+    """Estimate the working memory required by the invocation in bytes.
+
+    The Qwen Image VAE is a video-style autoencoder that operates on 5D tensors of shape
+    (B, C, num_frames, H, W). Tiling is not used, so peak working memory scales with the full
+    spatial output. The two trailing dimensions are the spatial H/W in latent space (decode) or
+    pixel space (encode), matching the convention used by the other estimators here.
+    """
+    latent_scale_factor_for_operation = LATENT_SCALE_FACTOR if operation == "decode" else 1
+
+    h = latent_scale_factor_for_operation * image_tensor.shape[-2]
+    w = latent_scale_factor_for_operation * image_tensor.shape[-1]
+    element_size = next(vae.parameters()).element_size()
+
+    # The Qwen Image VAE is much heavier than the SD/SDXL VAE and needs correspondingly larger
+    # constants. These were calibrated by measuring peak *reserved* memory growth (not just allocated
+    # -- reserved is what the cache's `free >= estimate` check compares against) across a resolution
+    # grid in fp16, on both an AMD W7900 (ROCm) and an NVIDIA card (CUDA). See
+    # scripts/calibrate_qwen_vae_working_memory.py.
+    #
+    # Implied constant = reserved_bytes / (h * w * element_size). Per-point maxima (fp16):
+    #              512^2  768^2  1024^2  1536^2  1792^2  2048^2    -> ship (max observed + ~8% headroom)
+    #   ROCm decode  5132   4596   4570    3273    3735    4813    -> 5500
+    #   ROCm encode  5864   5858   5858    3532    4364   (OOM)    -> 6300
+    #   CUDA decode  2660   2519   2690    2671    2281   (OOM)    -> 2900
+    #   CUDA encode  1456   1451   1458    1456    1455    1455    -> 1600
+    #
+    # Why this branches on backend (the only estimator here that does):
+    #  - The Qwen VAE is attention-heavy. With Flash/efficient attention (CUDA) the attention memory
+    #    is O(area) and the curve is flat/linear; the ROCm build falls back to math attention, which
+    #    is O(area^2), so ROCm reserves ~2x (decode) to ~4x (encode) more and goes super-linear above
+    #    ~1792^2. The two backends differ far more than any headroom, so a single constant would
+    #    either under-estimate on ROCm (OOM) or massively over-budget on CUDA (needless eviction).
+    #  - "Encoding is half of decoding" (as the sibling estimators assume) is only true on CUDA. On
+    #    ROCm encode reserves >= decode, so the ROCm encode constant is sized accordingly -- this is
+    #    the path Qwen Image Edit exercises.
+    #  - On ROCm the linear model under-estimates for decodes well above 2048^2, but those OOM on a
+    #    48GB card regardless; on CUDA the curve stays linear so no extra term is needed.
+    is_rocm = torch.version.hip is not None
+    if operation == "decode":
+        scaling_constant = 5500 if is_rocm else 2900
+    else:  # encode
+        scaling_constant = 6300 if is_rocm else 1600
+
+    working_memory = h * w * element_size * scaling_constant
+
+    return int(working_memory)
+
+
 def estimate_vae_working_memory_sd3(
     operation: Literal["encode", "decode"], image_tensor: torch.Tensor, vae: AutoencoderKL
 ) -> int:
diff --git a/invokeai/frontend/web/openapi.json b/invokeai/frontend/web/openapi.json
index 7033408b197..9f559e996a6 100644
--- a/invokeai/frontend/web/openapi.json
+++ b/invokeai/frontend/web/openapi.json
@@ -585,6 +585,11 @@
         "summary": "List Model Records",
         "description": "Get a list of models.",
         "operationId": "list_model_records",
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ],
         "parameters": [
           {
             "name": "base_models",
@@ -712,7 +717,7 @@
       "get": {
         "tags": ["model_manager"],
         "summary": "List Missing Models",
-        "description": "Get models whose files are missing from disk.\n\nThese are models that have database entries but their corresponding\nweight files have been deleted externally (not via Model Manager).",
+        "description": "Get models whose files are missing from disk.\n\nThese are models that have database entries but their corresponding\nweight files have been deleted externally (not via Model Manager).\n\nAvailable to any authenticated user, not just admins: the frontend's model hooks subtract this\nset from the model list so unusable models are kept out of the generation dropdowns.",
         "operationId": "list_missing_models",
         "responses": {
           "200": {
@@ -725,7 +730,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       }
     },
     "/api/v2/models/get_by_attrs": {
@@ -734,6 +744,11 @@
         "summary": "Get Model Records By Attrs",
         "description": "Gets a model by its attributes. The main use of this route is to provide backwards compatibility with the old\nmodel manager, which identified models by a combination of name, base and type.",
         "operationId": "get_model_records_by_attrs",
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ],
         "parameters": [
           {
             "name": "name",
@@ -1075,6 +1090,11 @@
         "summary": "Get Model Records By Hash",
         "description": "Gets a model by its hash. This is useful for recalling models that were deleted and reinstalled,\nas the hash remains stable across reinstallations while the key (UUID) changes.",
         "operationId": "get_model_records_by_hash",
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ],
         "parameters": [
           {
             "name": "hash",
@@ -1396,6 +1416,11 @@
         "summary": "Get Model Record",
         "description": "Get a model record",
         "operationId": "get_model_record",
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ],
         "parameters": [
           {
             "name": "key",
@@ -2506,6 +2531,11 @@
         "tags": ["model_manager"],
         "summary": "Scan For Models",
         "operationId": "scan_for_models",
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ],
         "parameters": [
           {
             "name": "scan_path",
@@ -2555,6 +2585,11 @@
         "tags": ["model_manager"],
         "summary": "Get Hugging Face Models",
         "operationId": "get_hugging_face_models",
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ],
         "parameters": [
           {
             "name": "hugging_face_repo",
@@ -3735,7 +3770,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       }
     },
     "/api/v2/models/stats": {
@@ -3763,7 +3803,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       }
     },
     "/api/v2/models/empty_model_cache": {
@@ -3805,7 +3850,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       },
       "post": {
         "tags": ["model_manager"],
@@ -3944,234 +3994,6 @@
         ]
       }
     },
-    "/api/v1/download_queue/": {
-      "get": {
-        "tags": ["download_queue"],
-        "summary": "List Downloads",
-        "description": "Get a list of active and inactive jobs.",
-        "operationId": "list_downloads",
-        "responses": {
-          "200": {
-            "description": "Successful Response",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "items": {
-                    "$ref": "#/components/schemas/DownloadJob"
-                  },
-                  "type": "array",
-                  "title": "Response List Downloads"
-                }
-              }
-            }
-          }
-        },
-        "security": [
-          {
-            "HTTPBearer": []
-          }
-        ]
-      },
-      "patch": {
-        "tags": ["download_queue"],
-        "summary": "Prune Downloads",
-        "description": "Prune completed and errored jobs.",
-        "operationId": "prune_downloads",
-        "responses": {
-          "200": {
-            "description": "Successful Response",
-            "content": {
-              "application/json": {
-                "schema": {}
-              }
-            }
-          },
-          "204": {
-            "description": "All completed jobs have been pruned"
-          },
-          "400": {
-            "description": "Bad request"
-          }
-        },
-        "security": [
-          {
-            "HTTPBearer": []
-          }
-        ]
-      }
-    },
-    "/api/v1/download_queue/i/": {
-      "post": {
-        "tags": ["download_queue"],
-        "summary": "Download",
-        "description": "Download the source URL to the file or directory indicted in dest.",
-        "operationId": "download",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/Body_download"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "description": "Successful Response",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/DownloadJob"
-                }
-              }
-            }
-          },
-          "422": {
-            "description": "Validation Error",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/HTTPValidationError"
-                }
-              }
-            }
-          }
-        },
-        "security": [
-          {
-            "HTTPBearer": []
-          }
-        ]
-      }
-    },
-    "/api/v1/download_queue/i/{id}": {
-      "get": {
-        "tags": ["download_queue"],
-        "summary": "Get Download Job",
-        "description": "Get a download job using its ID.",
-        "operationId": "get_download_job",
-        "security": [
-          {
-            "HTTPBearer": []
-          }
-        ],
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "integer",
-              "description": "ID of the download job to fetch.",
-              "title": "Id"
-            },
-            "description": "ID of the download job to fetch."
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Success",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/DownloadJob"
-                }
-              }
-            }
-          },
-          "404": {
-            "description": "The requested download JobID could not be found"
-          },
-          "422": {
-            "description": "Validation Error",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/HTTPValidationError"
-                }
-              }
-            }
-          }
-        }
-      },
-      "delete": {
-        "tags": ["download_queue"],
-        "summary": "Cancel Download Job",
-        "description": "Cancel a download job using its ID.",
-        "operationId": "cancel_download_job",
-        "security": [
-          {
-            "HTTPBearer": []
-          }
-        ],
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "integer",
-              "description": "ID of the download job to cancel.",
-              "title": "Id"
-            },
-            "description": "ID of the download job to cancel."
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Successful Response",
-            "content": {
-              "application/json": {
-                "schema": {}
-              }
-            }
-          },
-          "204": {
-            "description": "Job has been cancelled"
-          },
-          "404": {
-            "description": "The requested download JobID could not be found"
-          },
-          "422": {
-            "description": "Validation Error",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/HTTPValidationError"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "/api/v1/download_queue/i": {
-      "delete": {
-        "tags": ["download_queue"],
-        "summary": "Cancel All Download Jobs",
-        "description": "Cancel all download jobs.",
-        "operationId": "cancel_all_download_jobs",
-        "responses": {
-          "200": {
-            "description": "Successful Response",
-            "content": {
-              "application/json": {
-                "schema": {}
-              }
-            }
-          },
-          "204": {
-            "description": "Download jobs have been cancelled"
-          }
-        },
-        "security": [
-          {
-            "HTTPBearer": []
-          }
-        ]
-      }
-    },
     "/api/v1/images/upload": {
       "post": {
         "tags": ["images"],
@@ -4304,6 +4126,11 @@
         "summary": "Create Image Upload Entry",
         "description": "Uploads an image from a URL, not implemented",
         "operationId": "create_image_upload_entry",
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ],
         "requestBody": {
           "required": true,
           "content": {
@@ -6426,7 +6253,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       }
     },
     "/api/v1/app/patchmatch_status": {
@@ -6446,7 +6278,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       }
     },
     "/api/v1/app/runtime_config": {
@@ -6465,7 +6302,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       },
       "patch": {
         "tags": ["app"],
@@ -6531,7 +6373,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       }
     },
     "/api/v1/app/external_providers/config": {
@@ -6554,7 +6401,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       }
     },
     "/api/v1/app/external_providers/config/{provider_id}": {
@@ -6677,7 +6529,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       },
       "post": {
         "tags": ["app"],
@@ -6716,7 +6573,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       }
     },
     "/api/v1/app/invocation_cache": {
@@ -6734,7 +6596,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       }
     },
     "/api/v1/app/invocation_cache/enable": {
@@ -6752,7 +6619,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       }
     },
     "/api/v1/app/invocation_cache/disable": {
@@ -6770,7 +6642,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       }
     },
     "/api/v1/app/invocation_cache/status": {
@@ -6790,7 +6667,12 @@
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "HTTPBearer": []
+          }
+        ]
       }
     },
     "/api/v1/queue/{queue_id}/enqueue_batch": {
@@ -12770,43 +12652,6 @@
         "required": ["token"],
         "title": "Body_do_hf_login"
       },
-      "Body_download": {
-        "properties": {
-          "source": {
-            "type": "string",
-            "minLength": 1,
-            "format": "uri",
-            "title": "Source",
-            "description": "download source"
-          },
-          "dest": {
-            "type": "string",
-            "title": "Dest",
-            "description": "download destination"
-          },
-          "priority": {
-            "type": "integer",
-            "title": "Priority",
-            "description": "queue priority",
-            "default": 10
-          },
-          "access_token": {
-            "anyOf": [
-              {
-                "type": "string"
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "title": "Access Token",
-            "description": "token for authorization to download"
-          }
-        },
-        "type": "object",
-        "required": ["source", "dest"],
-        "title": "Body_download"
-      },
       "Body_download_images_from_list": {
         "properties": {
           "image_names": {
@@ -41299,6 +41144,24 @@
             "description": "Scan the models directory on startup, registering orphaned models. This is typically only used in conjunction with `use_memory_db` for testing purposes.",
             "default": false
           },
+          "allow_private_download_urls": {
+            "type": "boolean",
+            "title": "Allow Private Download Urls",
+            "description": "Allow the download queue to fetch from loopback, link-local and private-network addresses. Disabled by default so that a download URL cannot be used to reach services that are only reachable from the server. Enable this only if you install models from a mirror on your own network.",
+            "default": false
+          },
+          "download_proxy": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Download Proxy",
+            "description": "Optional HTTP proxy for model downloads. The proxy must enforce the public-address policy because proxy-side DNS cannot be checked by InvokeAI."
+          },
           "unsafe_disable_picklescan": {
             "type": "boolean",
             "title": "Unsafe Disable Picklescan",
@@ -41423,7 +41286,7 @@
         "additionalProperties": false,
         "type": "object",
         "title": "InvokeAIAppConfig",
-        "description": "Invoke's global app configuration.\n\nTypically, you won't need to interact with this class directly. Instead, use the `get_config` function from `invokeai.app.services.config` to get a singleton config object.\n\nAttributes:\n    host: IP address to bind to. Use `0.0.0.0` to serve to your local network.\n    port: Port to bind to.\n    allow_origins: Allowed CORS origins.\n    allow_credentials: Allow CORS credentials.\n    allow_methods: Methods allowed for CORS.\n    allow_headers: Headers allowed for CORS.\n    ssl_certfile: SSL certificate file for HTTPS. See https://www.uvicorn.dev/settings/#https.\n    ssl_keyfile: SSL key file for HTTPS. See https://www.uvicorn.dev/settings/#https.\n    log_tokenization: Enable logging of parsed prompt tokens.\n    patchmatch: Enable patchmatch inpaint code.\n    models_dir: Path to the models directory.\n    convert_cache_dir: Path to the converted models cache directory (DEPRECATED, but do not delete because it is needed for migration from previous versions).\n    download_cache_dir: Path to the directory that contains dynamically downloaded models.\n    legacy_conf_dir: Path to directory of legacy checkpoint config files.\n    db_dir: Path to InvokeAI databases directory.\n    outputs_dir: Path to directory for outputs.\n    image_subfolder_strategy: Strategy for organizing images into subfolders. 'flat' stores all images in a single folder. 'date' organizes by YYYY/MM/DD. 'type' organizes by image category. 'hash' uses first 2 characters of UUID for filesystem performance.<br>Valid values: `flat`, `date`, `type`, `hash`\n    custom_nodes_dir: Path to directory for custom nodes.\n    style_presets_dir: Path to directory for style presets.\n    workflow_thumbnails_dir: Path to directory for workflow thumbnails.\n    log_handlers: Log handler. Valid options are \"console\", \"file=<path>\", \"syslog=path|address:host:port\", \"http=<url>\".\n    log_format: Log format. Use \"plain\" for text-only, \"color\" for colorized output, \"legacy\" for 2.3-style logging and \"syslog\" for syslog-style.<br>Valid values: `plain`, `color`, `syslog`, `legacy`\n    log_level: Emit logging messages at this level or higher.<br>Valid values: `debug`, `info`, `warning`, `error`, `critical`\n    log_sql: Log SQL queries. `log_level` must be `debug` for this to do anything. Extremely verbose.\n    log_level_network: Log level for network-related messages. 'info' and 'debug' are very verbose.<br>Valid values: `debug`, `info`, `warning`, `error`, `critical`\n    use_memory_db: Use in-memory database. Useful for development.\n    dev_reload: Automatically reload when Python sources are changed. Does not reload node definitions.\n    profile_graphs: Enable graph profiling using `cProfile`.\n    profile_prefix: An optional prefix for profile output files.\n    profiles_dir: Path to profiles output directory.\n    max_cache_ram_gb: The maximum amount of CPU RAM to use for model caching in GB. If unset, the limit will be configured based on the available RAM. In most cases, it is recommended to leave this unset.\n    max_cache_vram_gb: The amount of VRAM to use for model caching in GB. If unset, the limit will be configured based on the available VRAM and the device_working_mem_gb. In most cases, it is recommended to leave this unset.\n    log_memory_usage: If True, a memory snapshot will be captured before and after every model cache operation, and the result will be logged (at debug level). There is a time cost to capturing the memory snapshots, so it is recommended to only enable this feature if you are actively inspecting the model cache's behaviour.\n    model_cache_keep_alive_min: How long to keep models in cache after last use, in minutes. A value of 0 (the default) means models are kept in cache indefinitely. If no model generations occur within the timeout period, the model cache is cleared using the same logic as the 'Clear Model Cache' button.\n    device_working_mem_gb: The amount of working memory to keep available on the compute device (in GB). Has no effect if running on CPU. If you are experiencing OOM errors, try increasing this value.\n    enable_partial_loading: Enable partial loading of models. This enables models to run with reduced VRAM requirements (at the cost of slower speed) by streaming the model from RAM to VRAM as its used. In some edge cases, partial loading can cause models to run more slowly if they were previously being fully loaded into VRAM.\n    keep_ram_copy_of_weights: Whether to keep a full RAM copy of a model's weights when the model is loaded in VRAM. Keeping a RAM copy increases average RAM usage, but speeds up model switching and LoRA patching (assuming there is sufficient RAM). Set this to False if RAM pressure is consistently high.\n    ram: DEPRECATED: This setting is no longer used. It has been replaced by `max_cache_ram_gb`, but most users will not need to use this config since automatic cache size limits should work well in most cases. This config setting will be removed once the new model cache behavior is stable.\n    vram: DEPRECATED: This setting is no longer used. It has been replaced by `max_cache_vram_gb`, but most users will not need to use this config since automatic cache size limits should work well in most cases. This config setting will be removed once the new model cache behavior is stable.\n    lazy_offload: DEPRECATED: This setting is no longer used. Lazy-offloading is enabled by default. This config setting will be removed once the new model cache behavior is stable.\n    pytorch_cuda_alloc_conf: Configure the Torch CUDA memory allocator. This will impact peak reserved VRAM usage and performance. Setting to \"backend:cudaMallocAsync\" works well on many systems. The optimal configuration is highly dependent on the system configuration (device type, VRAM, CUDA driver version, etc.), so must be tuned experimentally.\n    device: Preferred execution device. `auto` will choose the device depending on the hardware platform and the installed torch capabilities.<br>Valid values: `auto`, `cpu`, `cuda`, `mps`, `cuda:N` (where N is a device number)\n    precision: Floating point precision. `float16` will consume half the memory of `float32` but produce slightly lower-quality images. The `auto` setting will guess the proper precision based on your video card and operating system.<br>Valid values: `auto`, `float16`, `bfloat16`, `float32`\n    sequential_guidance: Whether to calculate guidance in serial instead of in parallel, lowering memory requirements.\n    attention_type: Attention type.<br>Valid values: `auto`, `normal`, `xformers`, `sliced`, `torch-sdp`\n    attention_slice_size: Slice size, valid when attention_type==\"sliced\".<br>Valid values: `auto`, `balanced`, `max`, `1`, `2`, `3`, `4`, `5`, `6`, `7`, `8`\n    force_tiled_decode: Whether to enable tiled VAE decode (reduces memory consumption with some performance penalty).\n    pil_compress_level: The compress_level setting of PIL.Image.save(), used for PNG encoding. All settings are lossless. 0 = no compression, 1 = fastest with slightly larger filesize, 9 = slowest with smallest filesize. 1 is typically the best setting.\n    max_queue_size: Maximum number of items in the session queue.\n    clear_queue_on_startup: Empties session queue on startup. If true, disables `max_queue_history`.\n    max_queue_history: Keep the last N completed, failed, and canceled queue items. Older items are deleted on startup. Set to 0 to prune all terminal items. Ignored if `clear_queue_on_startup` is true.\n    allow_nodes: List of nodes to allow. Omit to allow all.\n    deny_nodes: List of nodes to deny. Omit to deny none.\n    node_cache_size: How many cached nodes to keep in memory.\n    hashing_algorithm: Model hashing algorthim for model installs. 'blake3_multi' is best for SSDs. 'blake3_single' is best for spinning disk HDDs. 'random' disables hashing, instead assigning a UUID to models. Useful when using a memory db to reduce model installation time, or if you don't care about storing stable hashes for models. Alternatively, any other hashlib algorithm is accepted, though these are not nearly as performant as blake3.<br>Valid values: `blake3_multi`, `blake3_single`, `random`, `md5`, `sha1`, `sha224`, `sha256`, `sha384`, `sha512`, `blake2b`, `blake2s`, `sha3_224`, `sha3_256`, `sha3_384`, `sha3_512`, `shake_128`, `shake_256`\n    remote_api_tokens: List of regular expression and token pairs used when downloading models from URLs. The download URL is tested against the regex, and if it matches, the token is provided in as a Bearer token.\n    scan_models_on_startup: Scan the models directory on startup, registering orphaned models. This is typically only used in conjunction with `use_memory_db` for testing purposes.\n    unsafe_disable_picklescan: UNSAFE. Disable the picklescan security check during model installation. Recommended only for development and testing purposes. This will allow arbitrary code execution during model installation, so should never be used in production.\n    allow_unknown_models: Allow installation of models that we are unable to identify. If enabled, models will be marked as `unknown` in the database, and will not have any metadata associated with them. If disabled, unknown models will be rejected during installation.\n    multiuser: Enable multiuser support. When disabled, the application runs in single-user mode using a default system account with administrator privileges. When enabled, requires user authentication and authorization.\n    strict_password_checking: Enforce strict password requirements. When True, passwords must contain uppercase, lowercase, and numbers. When False (default), any password is accepted but its strength (weak/moderate/strong) is reported to the user.\n    external_alibabacloud_api_key: API key for Alibaba Cloud DashScope image generation.\n    external_alibabacloud_base_url: Base URL override for Alibaba Cloud DashScope image generation.\n    external_gemini_api_key: API key for Gemini image generation.\n    external_openai_api_key: API key for OpenAI image generation.\n    external_gemini_base_url: Base URL override for Gemini image generation.\n    external_openai_base_url: Base URL override for OpenAI image generation.\n    external_seedream_api_key: API key for Seedream image generation.\n    external_seedream_base_url: Base URL override for Seedream image generation."
+        "description": "Invoke's global app configuration.\n\nTypically, you won't need to interact with this class directly. Instead, use the `get_config` function from `invokeai.app.services.config` to get a singleton config object.\n\nAttributes:\n    host: IP address to bind to. Use `0.0.0.0` to serve to your local network.\n    port: Port to bind to.\n    allow_origins: Allowed CORS origins.\n    allow_credentials: Allow CORS credentials.\n    allow_methods: Methods allowed for CORS.\n    allow_headers: Headers allowed for CORS.\n    ssl_certfile: SSL certificate file for HTTPS. See https://www.uvicorn.dev/settings/#https.\n    ssl_keyfile: SSL key file for HTTPS. See https://www.uvicorn.dev/settings/#https.\n    log_tokenization: Enable logging of parsed prompt tokens.\n    patchmatch: Enable patchmatch inpaint code.\n    models_dir: Path to the models directory.\n    convert_cache_dir: Path to the converted models cache directory (DEPRECATED, but do not delete because it is needed for migration from previous versions).\n    download_cache_dir: Path to the directory that contains dynamically downloaded models.\n    legacy_conf_dir: Path to directory of legacy checkpoint config files.\n    db_dir: Path to InvokeAI databases directory.\n    outputs_dir: Path to directory for outputs.\n    image_subfolder_strategy: Strategy for organizing images into subfolders. 'flat' stores all images in a single folder. 'date' organizes by YYYY/MM/DD. 'type' organizes by image category. 'hash' uses first 2 characters of UUID for filesystem performance.<br>Valid values: `flat`, `date`, `type`, `hash`\n    custom_nodes_dir: Path to directory for custom nodes.\n    style_presets_dir: Path to directory for style presets.\n    workflow_thumbnails_dir: Path to directory for workflow thumbnails.\n    log_handlers: Log handler. Valid options are \"console\", \"file=<path>\", \"syslog=path|address:host:port\", \"http=<url>\".\n    log_format: Log format. Use \"plain\" for text-only, \"color\" for colorized output, \"legacy\" for 2.3-style logging and \"syslog\" for syslog-style.<br>Valid values: `plain`, `color`, `syslog`, `legacy`\n    log_level: Emit logging messages at this level or higher.<br>Valid values: `debug`, `info`, `warning`, `error`, `critical`\n    log_sql: Log SQL queries. `log_level` must be `debug` for this to do anything. Extremely verbose.\n    log_level_network: Log level for network-related messages. 'info' and 'debug' are very verbose.<br>Valid values: `debug`, `info`, `warning`, `error`, `critical`\n    use_memory_db: Use in-memory database. Useful for development.\n    dev_reload: Automatically reload when Python sources are changed. Does not reload node definitions.\n    profile_graphs: Enable graph profiling using `cProfile`.\n    profile_prefix: An optional prefix for profile output files.\n    profiles_dir: Path to profiles output directory.\n    max_cache_ram_gb: The maximum amount of CPU RAM to use for model caching in GB. If unset, the limit will be configured based on the available RAM. In most cases, it is recommended to leave this unset.\n    max_cache_vram_gb: The amount of VRAM to use for model caching in GB. If unset, the limit will be configured based on the available VRAM and the device_working_mem_gb. In most cases, it is recommended to leave this unset.\n    log_memory_usage: If True, a memory snapshot will be captured before and after every model cache operation, and the result will be logged (at debug level). There is a time cost to capturing the memory snapshots, so it is recommended to only enable this feature if you are actively inspecting the model cache's behaviour.\n    model_cache_keep_alive_min: How long to keep models in cache after last use, in minutes. A value of 0 (the default) means models are kept in cache indefinitely. If no model generations occur within the timeout period, the model cache is cleared using the same logic as the 'Clear Model Cache' button.\n    device_working_mem_gb: The amount of working memory to keep available on the compute device (in GB). Has no effect if running on CPU. If you are experiencing OOM errors, try increasing this value.\n    enable_partial_loading: Enable partial loading of models. This enables models to run with reduced VRAM requirements (at the cost of slower speed) by streaming the model from RAM to VRAM as its used. In some edge cases, partial loading can cause models to run more slowly if they were previously being fully loaded into VRAM.\n    keep_ram_copy_of_weights: Whether to keep a full RAM copy of a model's weights when the model is loaded in VRAM. Keeping a RAM copy increases average RAM usage, but speeds up model switching and LoRA patching (assuming there is sufficient RAM). Set this to False if RAM pressure is consistently high.\n    ram: DEPRECATED: This setting is no longer used. It has been replaced by `max_cache_ram_gb`, but most users will not need to use this config since automatic cache size limits should work well in most cases. This config setting will be removed once the new model cache behavior is stable.\n    vram: DEPRECATED: This setting is no longer used. It has been replaced by `max_cache_vram_gb`, but most users will not need to use this config since automatic cache size limits should work well in most cases. This config setting will be removed once the new model cache behavior is stable.\n    lazy_offload: DEPRECATED: This setting is no longer used. Lazy-offloading is enabled by default. This config setting will be removed once the new model cache behavior is stable.\n    pytorch_cuda_alloc_conf: Configure the Torch CUDA memory allocator. This will impact peak reserved VRAM usage and performance. Setting to \"backend:cudaMallocAsync\" works well on many systems. The optimal configuration is highly dependent on the system configuration (device type, VRAM, CUDA driver version, etc.), so must be tuned experimentally.\n    device: Preferred execution device. `auto` will choose the device depending on the hardware platform and the installed torch capabilities.<br>Valid values: `auto`, `cpu`, `cuda`, `mps`, `cuda:N` (where N is a device number)\n    precision: Floating point precision. `float16` will consume half the memory of `float32` but produce slightly lower-quality images. The `auto` setting will guess the proper precision based on your video card and operating system.<br>Valid values: `auto`, `float16`, `bfloat16`, `float32`\n    sequential_guidance: Whether to calculate guidance in serial instead of in parallel, lowering memory requirements.\n    attention_type: Attention type.<br>Valid values: `auto`, `normal`, `xformers`, `sliced`, `torch-sdp`\n    attention_slice_size: Slice size, valid when attention_type==\"sliced\".<br>Valid values: `auto`, `balanced`, `max`, `1`, `2`, `3`, `4`, `5`, `6`, `7`, `8`\n    force_tiled_decode: Whether to enable tiled VAE decode (reduces memory consumption with some performance penalty).\n    pil_compress_level: The compress_level setting of PIL.Image.save(), used for PNG encoding. All settings are lossless. 0 = no compression, 1 = fastest with slightly larger filesize, 9 = slowest with smallest filesize. 1 is typically the best setting.\n    max_queue_size: Maximum number of items in the session queue.\n    clear_queue_on_startup: Empties session queue on startup. If true, disables `max_queue_history`.\n    max_queue_history: Keep the last N completed, failed, and canceled queue items. Older items are deleted on startup. Set to 0 to prune all terminal items. Ignored if `clear_queue_on_startup` is true.\n    allow_nodes: List of nodes to allow. Omit to allow all.\n    deny_nodes: List of nodes to deny. Omit to deny none.\n    node_cache_size: How many cached nodes to keep in memory.\n    hashing_algorithm: Model hashing algorthim for model installs. 'blake3_multi' is best for SSDs. 'blake3_single' is best for spinning disk HDDs. 'random' disables hashing, instead assigning a UUID to models. Useful when using a memory db to reduce model installation time, or if you don't care about storing stable hashes for models. Alternatively, any other hashlib algorithm is accepted, though these are not nearly as performant as blake3.<br>Valid values: `blake3_multi`, `blake3_single`, `random`, `md5`, `sha1`, `sha224`, `sha256`, `sha384`, `sha512`, `blake2b`, `blake2s`, `sha3_224`, `sha3_256`, `sha3_384`, `sha3_512`, `shake_128`, `shake_256`\n    remote_api_tokens: List of regular expression and token pairs used when downloading models from URLs. The download URL is tested against the regex, and if it matches, the token is provided in as a Bearer token.\n    scan_models_on_startup: Scan the models directory on startup, registering orphaned models. This is typically only used in conjunction with `use_memory_db` for testing purposes.\n    allow_private_download_urls: Allow the download queue to fetch from loopback, link-local and private-network addresses. Disabled by default so that a download URL cannot be used to reach services that are only reachable from the server. Enable this only if you install models from a mirror on your own network.\n    download_proxy: Optional HTTP proxy for model downloads. The proxy must enforce the public-address policy because proxy-side DNS cannot be checked by InvokeAI.\n    unsafe_disable_picklescan: UNSAFE. Disable the picklescan security check during model installation. Recommended only for development and testing purposes. This will allow arbitrary code execution during model installation, so should never be used in production.\n    allow_unknown_models: Allow installation of models that we are unable to identify. If enabled, models will be marked as `unknown` in the database, and will not have any metadata associated with them. If disabled, unknown models will be rejected during installation.\n    multiuser: Enable multiuser support. When disabled, the application runs in single-user mode using a default system account with administrator privileges. When enabled, requires user authentication and authorization.\n    strict_password_checking: Enforce strict password requirements. When True, passwords must contain uppercase, lowercase, and numbers. When False (default), any password is accepted but its strength (weak/moderate/strong) is reported to the user.\n    external_alibabacloud_api_key: API key for Alibaba Cloud DashScope image generation.\n    external_alibabacloud_base_url: Base URL override for Alibaba Cloud DashScope image generation.\n    external_gemini_api_key: API key for Gemini image generation.\n    external_openai_api_key: API key for OpenAI image generation.\n    external_gemini_base_url: Base URL override for Gemini image generation.\n    external_openai_base_url: Base URL override for OpenAI image generation.\n    external_seedream_api_key: API key for Seedream image generation.\n    external_seedream_base_url: Base URL override for Seedream image generation."
       },
       "InvokeAIAppConfigWithSetFields": {
         "properties": {
diff --git a/invokeai/frontend/web/src/app/store/store.test.ts b/invokeai/frontend/web/src/app/store/store.test.ts
new file mode 100644
index 00000000000..2ebd62b29ca
--- /dev/null
+++ b/invokeai/frontend/web/src/app/store/store.test.ts
@@ -0,0 +1,27 @@
+import { logout, sessionExpiredLogout } from 'features/auth/store/authSlice';
+import { appInfoApi } from 'services/api/endpoints/appInfo';
+import type { S } from 'services/api/types';
+import { describe, expect, it } from 'vitest';
+
+import { createStore } from './store';
+
+const runtimeConfig = {
+  set_fields: ['models_dir'],
+  config: { models_dir: '/operator-only/models' },
+} as S['InvokeAIAppConfigWithSetFields'];
+
+describe('auth cache isolation', () => {
+  it.each([
+    ['logout', logout],
+    ['session expiry', sessionExpiredLogout],
+  ])('clears API data on %s', async (_label, logOut) => {
+    const store = createStore();
+
+    await store.dispatch(appInfoApi.util.upsertQueryData('getRuntimeConfig', undefined, runtimeConfig));
+    expect(appInfoApi.endpoints.getRuntimeConfig.select()(store.getState()).data).toEqual(runtimeConfig);
+
+    store.dispatch(logOut());
+
+    expect(appInfoApi.endpoints.getRuntimeConfig.select()(store.getState()).data).toBeUndefined();
+  });
+});
diff --git a/invokeai/frontend/web/src/app/store/store.ts b/invokeai/frontend/web/src/app/store/store.ts
index f24d2d0105c..854eaba0f16 100644
--- a/invokeai/frontend/web/src/app/store/store.ts
+++ b/invokeai/frontend/web/src/app/store/store.ts
@@ -1,5 +1,12 @@
 import type { ThunkDispatch, TypedStartListening, UnknownAction } from '@reduxjs/toolkit';
-import { addListener, combineReducers, configureStore, createAction, createListenerMiddleware } from '@reduxjs/toolkit';
+import {
+  addListener,
+  combineReducers,
+  configureStore,
+  createAction,
+  createListenerMiddleware,
+  isAnyOf,
+} from '@reduxjs/toolkit';
 import { logger } from 'app/logging/logger';
 import { errorHandler } from 'app/store/enhancers/reduxRemember/errors';
 import { addAdHocPostProcessingRequestedListener } from 'app/store/middleware/listenerMiddleware/listeners/addAdHocPostProcessingRequestedListener';
@@ -19,7 +26,7 @@ import { addSocketConnectedEventListener } from 'app/store/middleware/listenerMi
 import { deepClone } from 'common/util/deepClone';
 import { merge } from 'es-toolkit';
 import { omit, pick } from 'es-toolkit/compat';
-import { authSliceConfig } from 'features/auth/store/authSlice';
+import { authSliceConfig, logout, sessionExpiredLogout } from 'features/auth/store/authSlice';
 import { changeBoardModalSliceConfig } from 'features/changeBoardModal/store/slice';
 import { canvasSettingsSliceConfig } from 'features/controlLayers/store/canvasSettingsSlice';
 import { canvasSliceConfig } from 'features/controlLayers/store/canvasSlice';
@@ -256,6 +263,14 @@ export const addAppListener = addListener.withTypes<RootState, AppDispatch>();
 
 // To avoid circular dependencies, all listener middleware listeners are added here in the main store setup file.
 const startAppListening = listenerMiddleware.startListening as AppStartListening;
+
+startAppListening({
+  matcher: isAnyOf(logout, sessionExpiredLogout),
+  effect: (_action, { dispatch }) => {
+    dispatch(api.util.resetApiState());
+  },
+});
+
 addImageUploadedFulfilledListener(startAppListening);
 
 // Image deleted
diff --git a/invokeai/frontend/web/src/features/auth/hooks/useIsAdmin.test.ts b/invokeai/frontend/web/src/features/auth/hooks/useIsAdmin.test.ts
new file mode 100644
index 00000000000..af674654be7
--- /dev/null
+++ b/invokeai/frontend/web/src/features/auth/hooks/useIsAdmin.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest';
+
+import { getIsAdmin } from './useIsAdmin';
+
+describe('getIsAdmin', () => {
+  it('treats single-user mode as admin regardless of user', () => {
+    expect(getIsAdmin({ multiuser_enabled: false }, undefined)).toBe(true);
+    expect(getIsAdmin({ multiuser_enabled: false }, null)).toBe(true);
+    expect(getIsAdmin({ multiuser_enabled: false }, { is_admin: false })).toBe(true);
+  });
+
+  it('treats the multiuser admin and the single-user operator alike', () => {
+    expect(getIsAdmin({ multiuser_enabled: true }, { is_admin: true })).toBe(true);
+    expect(getIsAdmin({ multiuser_enabled: false }, { is_admin: false })).toBe(true);
+  });
+
+  it('denies multiuser non-admin or missing user', () => {
+    expect(getIsAdmin({ multiuser_enabled: true }, { is_admin: false })).toBe(false);
+    expect(getIsAdmin({ multiuser_enabled: true }, null)).toBe(false);
+    expect(getIsAdmin({ multiuser_enabled: true }, undefined)).toBe(false);
+  });
+
+  it('denies while setup status is still loading, unless the user is a known admin', () => {
+    // Conservative during the query window: admin surfaces stay hidden rather than flashing in.
+    expect(getIsAdmin(undefined, undefined)).toBe(false);
+    expect(getIsAdmin(undefined, null)).toBe(false);
+    expect(getIsAdmin(undefined, { is_admin: false })).toBe(false);
+    expect(getIsAdmin(undefined, { is_admin: true })).toBe(true);
+  });
+});
diff --git a/invokeai/frontend/web/src/features/auth/hooks/useIsAdmin.ts b/invokeai/frontend/web/src/features/auth/hooks/useIsAdmin.ts
new file mode 100644
index 00000000000..599403ed809
--- /dev/null
+++ b/invokeai/frontend/web/src/features/auth/hooks/useIsAdmin.ts
@@ -0,0 +1,37 @@
+import { useAppSelector } from 'app/store/storeHooks';
+import { selectCurrentUser } from 'features/auth/store/authSlice';
+import { useMemo } from 'react';
+import { useGetSetupStatusQuery } from 'services/api/endpoints/auth';
+
+/**
+ * Returns true if:
+ * - Multiuser mode is disabled (single-user mode = always admin)
+ * - Multiuser mode is enabled AND the user is an admin
+ *
+ * Exported separately from the hook so the predicate can be unit-tested directly.
+ */
+export const getIsAdmin = (
+  setupStatus: { multiuser_enabled: boolean } | undefined,
+  user: { is_admin: boolean } | null | undefined
+): boolean => {
+  // If multiuser is disabled, treat as admin (single-user mode)
+  if (setupStatus && !setupStatus.multiuser_enabled) {
+    return true;
+  }
+
+  // If multiuser is enabled, check if user is admin
+  return user?.is_admin ?? false;
+};
+
+/**
+ * Hook to determine whether the current user holds administrator privileges.
+ *
+ * This mirrors the backend's `AdminUserOrDefault` dependency. Prefer it over reading `multiuser` from
+ * `runtime_config`, which is itself an admin-only route.
+ */
+export const useIsAdmin = (): boolean => {
+  const user = useAppSelector(selectCurrentUser);
+  const { data: setupStatus } = useGetSetupStatusQuery();
+
+  return useMemo(() => getIsAdmin(setupStatus, user), [setupStatus, user]);
+};
diff --git a/invokeai/frontend/web/src/features/customNodes/useIsCustomNodesEnabled.ts b/invokeai/frontend/web/src/features/customNodes/useIsCustomNodesEnabled.ts
index 926e51d5474..44abf6cb209 100644
--- a/invokeai/frontend/web/src/features/customNodes/useIsCustomNodesEnabled.ts
+++ b/invokeai/frontend/web/src/features/customNodes/useIsCustomNodesEnabled.ts
@@ -1,4 +1,5 @@
 import { useAppSelector } from 'app/store/storeHooks';
+import { getIsAdmin } from 'features/auth/hooks/useIsAdmin';
 import { selectCurrentUser } from 'features/auth/store/authSlice';
 import { useMemo } from 'react';
 import { useGetSetupStatusQuery } from 'services/api/endpoints/auth';
@@ -6,6 +7,9 @@ import { useGetSetupStatusQuery } from 'services/api/endpoints/auth';
 /**
  * Pure decision function: determines whether custom node management is enabled.
  *
+ * Custom node management is admin-only, so this delegates to the canonical admin predicate
+ * (`getIsAdmin` in features/auth/hooks/useIsAdmin.ts) rather than carrying its own copy of the rule.
+ *
  * Returns true if:
  * - Multiuser mode is disabled (single-user mode = always admin)
  * - Multiuser mode is enabled AND user is an admin
@@ -13,12 +17,8 @@ import { useGetSetupStatusQuery } from 'services/api/endpoints/auth';
  * Returns false if:
  * - Multiuser mode is enabled AND user is not an admin
  */
-export const getIsCustomNodesEnabled = (multiuserEnabled: boolean, isAdmin: boolean | undefined): boolean => {
-  if (!multiuserEnabled) {
-    return true;
-  }
-  return isAdmin ?? false;
-};
+export const getIsCustomNodesEnabled = (multiuserEnabled: boolean, isAdmin: boolean | undefined): boolean =>
+  getIsAdmin({ multiuser_enabled: multiuserEnabled }, isAdmin === undefined ? undefined : { is_admin: isAdmin });
 
 type CustomNodesPermission = {
   /** Whether setup status has loaded and a permission decision can be made. */
diff --git a/invokeai/frontend/web/src/features/gallery/components/ImageViewer/NoContentForViewer.tsx b/invokeai/frontend/web/src/features/gallery/components/ImageViewer/NoContentForViewer.tsx
index db27a8fcae0..6ed61af5cbb 100644
--- a/invokeai/frontend/web/src/features/gallery/components/ImageViewer/NoContentForViewer.tsx
+++ b/invokeai/frontend/web/src/features/gallery/components/ImageViewer/NoContentForViewer.tsx
@@ -1,9 +1,8 @@
 import type { ButtonProps } from '@invoke-ai/ui-library';
 import { Alert, AlertDescription, AlertIcon, Button, Divider, Flex, Link, Spinner, Text } from '@invoke-ai/ui-library';
-import { useAppSelector } from 'app/store/storeHooks';
 import { IAINoContentFallback } from 'common/components/IAIImageFallback';
 import { InvokeLogoIcon } from 'common/components/InvokeLogoIcon';
-import { selectCurrentUser } from 'features/auth/store/authSlice';
+import { useIsAdmin } from 'features/auth/hooks/useIsAdmin';
 import { LOADING_SYMBOL, useHasImages } from 'features/gallery/hooks/useHasImages';
 import { setInstallModelsTabByName } from 'features/modelManagerV2/store/installModelsStore';
 import { navigationApi } from 'features/ui/layouts/navigation-api';
@@ -18,11 +17,9 @@ export const NoContentForViewer = memo(() => {
   const hasImages = useHasImages();
   const [mainModels, { data }] = useMainModels();
   const { data: setupStatus } = useGetSetupStatusQuery();
-  const user = useAppSelector(selectCurrentUser);
   const { t } = useTranslation();
 
-  const isMultiuser = setupStatus?.multiuser_enabled ?? false;
-  const isAdmin = !isMultiuser || (user?.is_admin ?? false);
+  const isAdmin = useIsAdmin();
   const adminEmail = setupStatus?.admin_email ?? null;
 
   const modelsLoaded = data !== undefined;
diff --git a/invokeai/frontend/web/src/features/modelManagerV2/hooks/useIsModelManagerEnabled.ts b/invokeai/frontend/web/src/features/modelManagerV2/hooks/useIsModelManagerEnabled.ts
index 81b00eb77e5..7746b5d796e 100644
--- a/invokeai/frontend/web/src/features/modelManagerV2/hooks/useIsModelManagerEnabled.ts
+++ b/invokeai/frontend/web/src/features/modelManagerV2/hooks/useIsModelManagerEnabled.ts
@@ -1,29 +1,8 @@
-import { useAppSelector } from 'app/store/storeHooks';
-import { selectCurrentUser } from 'features/auth/store/authSlice';
-import { useMemo } from 'react';
-import { useGetSetupStatusQuery } from 'services/api/endpoints/auth';
+import { useIsAdmin } from 'features/auth/hooks/useIsAdmin';
 
 /**
  * Hook to determine if model manager features should be enabled for the current user.
  *
- * Returns true if:
- * - Multiuser mode is disabled (single-user mode = always admin)
- * - Multiuser mode is enabled AND user is an admin
- *
- * Returns false if:
- * - Multiuser mode is enabled AND user is not an admin
+ * Model management is administrator-only, so this is exactly the admin check.
  */
-export const useIsModelManagerEnabled = (): boolean => {
-  const user = useAppSelector(selectCurrentUser);
-  const { data: setupStatus } = useGetSetupStatusQuery();
-
-  return useMemo(() => {
-    // If multiuser is disabled, treat as admin (single-user mode)
-    if (setupStatus && !setupStatus.multiuser_enabled) {
-      return true;
-    }
-
-    // If multiuser is enabled, check if user is admin
-    return user?.is_admin ?? false;
-  }, [setupStatus, user]);
-};
+export const useIsModelManagerEnabled = (): boolean => useIsAdmin();
diff --git a/invokeai/frontend/web/src/features/modelManagerV2/hooks/useStarterModelsToast.tsx b/invokeai/frontend/web/src/features/modelManagerV2/hooks/useStarterModelsToast.tsx
index 9b76fbbde67..a7229f1a46f 100644
--- a/invokeai/frontend/web/src/features/modelManagerV2/hooks/useStarterModelsToast.tsx
+++ b/invokeai/frontend/web/src/features/modelManagerV2/hooks/useStarterModelsToast.tsx
@@ -1,11 +1,11 @@
 import { Button, Text, useToast } from '@invoke-ai/ui-library';
 import { useAppSelector } from 'app/store/storeHooks';
-import { selectCurrentUser, selectIsAuthenticated } from 'features/auth/store/authSlice';
+import { useIsAdmin } from 'features/auth/hooks/useIsAdmin';
+import { selectIsAuthenticated } from 'features/auth/store/authSlice';
 import { setInstallModelsTabByName } from 'features/modelManagerV2/store/installModelsStore';
 import { navigationApi } from 'features/ui/layouts/navigation-api';
 import { useCallback, useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import { useGetSetupStatusQuery } from 'services/api/endpoints/auth';
 import { useMainModels } from 'services/api/hooks/modelsByType';
 
 const TOAST_ID = 'starterModels';
@@ -16,11 +16,7 @@ export const useStarterModelsToast = () => {
   const [mainModels, { data }] = useMainModels();
   const toast = useToast();
   const isAuthenticated = useAppSelector(selectIsAuthenticated);
-  const { data: setupStatus } = useGetSetupStatusQuery();
-  const user = useAppSelector(selectCurrentUser);
-
-  const isMultiuser = setupStatus?.multiuser_enabled ?? false;
-  const isAdmin = !isMultiuser || (user?.is_admin ?? false);
+  const isAdmin = useIsAdmin();
 
   useEffect(() => {
     // Only show the toast if the user is authenticated
diff --git a/invokeai/frontend/web/src/features/nodes/components/flow/nodes/Invocation/UseCacheCheckbox.tsx b/invokeai/frontend/web/src/features/nodes/components/flow/nodes/Invocation/UseCacheCheckbox.tsx
index 219418f36c4..b0f1fdead32 100644
--- a/invokeai/frontend/web/src/features/nodes/components/flow/nodes/Invocation/UseCacheCheckbox.tsx
+++ b/invokeai/frontend/web/src/features/nodes/components/flow/nodes/Invocation/UseCacheCheckbox.tsx
@@ -1,28 +1,18 @@
 import { Checkbox, FormControl, FormLabel } from '@invoke-ai/ui-library';
-import { useAppDispatch, useAppSelector } from 'app/store/storeHooks';
-import { selectCurrentUser } from 'features/auth/store/authSlice';
+import { useAppDispatch } from 'app/store/storeHooks';
+import { useIsAdmin } from 'features/auth/hooks/useIsAdmin';
 import { useUseCache } from 'features/nodes/hooks/useUseCache';
 import { nodeUseCacheChanged } from 'features/nodes/store/nodesSlice';
 import { NO_FIT_ON_DOUBLE_CLICK_CLASS, NO_PAN_CLASS } from 'features/nodes/types/constants';
 import type { ChangeEvent } from 'react';
-import { memo, useCallback, useMemo } from 'react';
+import { memo, useCallback } from 'react';
 import { useTranslation } from 'react-i18next';
-import { useGetSetupStatusQuery } from 'services/api/endpoints/auth';
 
 const UseCacheCheckbox = ({ nodeId }: { nodeId: string }) => {
   const dispatch = useAppDispatch();
   const useCache = useUseCache();
-  const currentUser = useAppSelector(selectCurrentUser);
-  const { data: setupStatus } = useGetSetupStatusQuery();
-
-  const isVisible = useMemo(() => {
-    // In single-user mode (multiuser disabled), always show the checkbox
-    if (setupStatus && !setupStatus.multiuser_enabled) {
-      return true;
-    }
-    // In multiuser mode, only show the checkbox to admin users
-    return currentUser?.is_admin ?? false;
-  }, [setupStatus, currentUser]);
+  // Node-cache control is admin-only (single-user mode counts as admin).
+  const isVisible = useIsAdmin();
 
   const handleChange = useCallback(
     (e: ChangeEvent<HTMLInputElement>) => {
diff --git a/invokeai/frontend/web/src/features/parameters/components/ModelPicker.tsx b/invokeai/frontend/web/src/features/parameters/components/ModelPicker.tsx
index 6ecbf1c4a64..c32a8a51be7 100644
--- a/invokeai/frontend/web/src/features/parameters/components/ModelPicker.tsx
+++ b/invokeai/frontend/web/src/features/parameters/components/ModelPicker.tsx
@@ -22,7 +22,7 @@ import { buildGroup, getRegex, isGroup, Picker, usePickerContext } from 'common/
 import { useDisclosure } from 'common/hooks/useBoolean';
 import { typedMemo } from 'common/util/typedMemo';
 import { uniq } from 'es-toolkit/compat';
-import { selectCurrentUser } from 'features/auth/store/authSlice';
+import { useIsAdmin } from 'features/auth/hooks/useIsAdmin';
 import { selectLoRAsSlice } from 'features/controlLayers/store/lorasSlice';
 import { selectParamsSlice } from 'features/controlLayers/store/paramsSlice';
 import { MODEL_BASE_TO_COLOR, MODEL_BASE_TO_LONG_NAME, MODEL_BASE_TO_SHORT_NAME } from 'features/modelManagerV2/models';
@@ -91,10 +91,8 @@ const components = {
 const NoOptionsFallback = memo(({ noOptionsText }: { noOptionsText?: string }) => {
   const { t } = useTranslation();
   const { data: setupStatus } = useGetSetupStatusQuery();
-  const user = useAppSelector(selectCurrentUser);
 
-  const isMultiuser = setupStatus?.multiuser_enabled ?? false;
-  const isAdmin = !isMultiuser || (user?.is_admin ?? false);
+  const isAdmin = useIsAdmin();
   const adminEmail = setupStatus?.admin_email ?? null;
 
   if (!isAdmin) {
diff --git a/invokeai/frontend/web/src/features/queue/components/QueueTabContent.tsx b/invokeai/frontend/web/src/features/queue/components/QueueTabContent.tsx
index a2919937ea0..2f888abc34d 100644
--- a/invokeai/frontend/web/src/features/queue/components/QueueTabContent.tsx
+++ b/invokeai/frontend/web/src/features/queue/components/QueueTabContent.tsx
@@ -1,4 +1,5 @@
 import { Box, Flex } from '@invoke-ai/ui-library';
+import { useIsAdmin } from 'features/auth/hooks/useIsAdmin';
 import { memo } from 'react';
 
 import InvocationCacheStatus from './InvocationCacheStatus';
@@ -7,12 +8,16 @@ import QueueStatus from './QueueStatus';
 import QueueTabQueueControls from './QueueTabQueueControls';
 
 const QueueTabContent = () => {
+  // The invocation cache status and its enable/disable/clear mutations are administrator-only on the
+  // backend. Rendering the panel for a non-admin would show zeroed stats and offer buttons that 403.
+  const isAdmin = useIsAdmin();
+
   return (
     <Flex borderRadius="base" w="full" h="full" flexDir="column" gap={2}>
       <Flex gap={2} w="full">
         <QueueTabQueueControls />
         <QueueStatus />
-        <InvocationCacheStatus />
+        {isAdmin && <InvocationCacheStatus />}
       </Flex>
       <Box layerStyle="first" p={2} borderRadius="base" w="full" h="full">
         <QueueList />
diff --git a/invokeai/frontend/web/src/features/queue/hooks/invocationCacheControls.test.ts b/invokeai/frontend/web/src/features/queue/hooks/invocationCacheControls.test.ts
new file mode 100644
index 00000000000..9568b199984
--- /dev/null
+++ b/invokeai/frontend/web/src/features/queue/hooks/invocationCacheControls.test.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  getIsClearInvocationCacheDisabled,
+  getIsDisableInvocationCacheDisabled,
+  getIsEnableInvocationCacheDisabled,
+} from './invocationCacheControls';
+
+const ENABLED_CACHE = { enabled: true, size: 4, hits: 1, misses: 1, max_size: 20 };
+const DISABLED_CACHE = { enabled: false, size: 0, hits: 0, misses: 0, max_size: 20 };
+
+describe('invocation cache controls', () => {
+  describe('non-admin in multiuser mode', () => {
+    // The status route is admin-only, so a non-admin's cacheStatus is always undefined. Without the
+    // admin check that reads as "cache is disabled" and offers an Enable button that always 403s.
+    // (getIsAdmin's own semantics are covered by its colocated test, features/auth/hooks/useIsAdmin.test.ts.)
+    const isAdmin = false;
+
+    it('offers no cache mutation while connected with no status data', () => {
+      expect(getIsEnableInvocationCacheDisabled(isAdmin, true, undefined)).toBe(true);
+      expect(getIsDisableInvocationCacheDisabled(isAdmin, true, undefined)).toBe(true);
+      expect(getIsClearInvocationCacheDisabled(isAdmin, true, undefined)).toBe(true);
+    });
+
+    it('offers no cache mutation even if status data is somehow present', () => {
+      for (const status of [ENABLED_CACHE, DISABLED_CACHE]) {
+        expect(getIsEnableInvocationCacheDisabled(isAdmin, true, status)).toBe(true);
+        expect(getIsDisableInvocationCacheDisabled(isAdmin, true, status)).toBe(true);
+        expect(getIsClearInvocationCacheDisabled(isAdmin, true, status)).toBe(true);
+      }
+    });
+  });
+
+  describe('admin', () => {
+    it('preserves the pre-existing enable/disable/clear semantics', () => {
+      // Enable is offered only when the cache is off and has capacity.
+      expect(getIsEnableInvocationCacheDisabled(true, true, DISABLED_CACHE)).toBe(false);
+      expect(getIsEnableInvocationCacheDisabled(true, true, ENABLED_CACHE)).toBe(true);
+      expect(getIsEnableInvocationCacheDisabled(true, true, { ...DISABLED_CACHE, max_size: 0 })).toBe(true);
+
+      // Disable is offered only when the cache is on.
+      expect(getIsDisableInvocationCacheDisabled(true, true, ENABLED_CACHE)).toBe(false);
+      expect(getIsDisableInvocationCacheDisabled(true, true, DISABLED_CACHE)).toBe(true);
+
+      // Clear is offered only when there is something cached.
+      expect(getIsClearInvocationCacheDisabled(true, true, ENABLED_CACHE)).toBe(false);
+      expect(getIsClearInvocationCacheDisabled(true, true, DISABLED_CACHE)).toBe(true);
+    });
+
+    it('offers nothing while disconnected', () => {
+      expect(getIsEnableInvocationCacheDisabled(true, false, DISABLED_CACHE)).toBe(true);
+      expect(getIsDisableInvocationCacheDisabled(true, false, ENABLED_CACHE)).toBe(true);
+      expect(getIsClearInvocationCacheDisabled(true, false, ENABLED_CACHE)).toBe(true);
+    });
+  });
+});
diff --git a/invokeai/frontend/web/src/features/queue/hooks/invocationCacheControls.ts b/invokeai/frontend/web/src/features/queue/hooks/invocationCacheControls.ts
new file mode 100644
index 00000000000..64573876141
--- /dev/null
+++ b/invokeai/frontend/web/src/features/queue/hooks/invocationCacheControls.ts
@@ -0,0 +1,31 @@
+import type { components } from 'services/api/schema';
+
+type InvocationCacheStatus = components['schemas']['InvocationCacheStatus'];
+
+/**
+ * Disabled-state predicates for the invocation cache controls.
+ *
+ * The invocation cache routes are administrator-only on the backend, so a non-admin must never be
+ * offered any of these mutations: `cacheStatus` is undefined for them (the status route 403s), which
+ * on its own reads as "cache disabled" and would present an active Enable button.
+ *
+ * These are pure so they can be unit-tested without rendering.
+ */
+
+export const getIsEnableInvocationCacheDisabled = (
+  isAdmin: boolean,
+  isConnected: boolean,
+  cacheStatus: InvocationCacheStatus | undefined
+): boolean => !isAdmin || !isConnected || !!cacheStatus?.enabled || cacheStatus?.max_size === 0;
+
+export const getIsDisableInvocationCacheDisabled = (
+  isAdmin: boolean,
+  isConnected: boolean,
+  cacheStatus: InvocationCacheStatus | undefined
+): boolean => !isAdmin || !isConnected || !cacheStatus?.enabled || cacheStatus?.max_size === 0;
+
+export const getIsClearInvocationCacheDisabled = (
+  isAdmin: boolean,
+  isConnected: boolean,
+  cacheStatus: InvocationCacheStatus | undefined
+): boolean => !isAdmin || !isConnected || !cacheStatus?.size;
diff --git a/invokeai/frontend/web/src/features/queue/hooks/useClearInvocationCache.ts b/invokeai/frontend/web/src/features/queue/hooks/useClearInvocationCache.ts
index 90c5a0dd3af..3a28bf50761 100644
--- a/invokeai/frontend/web/src/features/queue/hooks/useClearInvocationCache.ts
+++ b/invokeai/frontend/web/src/features/queue/hooks/useClearInvocationCache.ts
@@ -1,4 +1,6 @@
 import { useStore } from '@nanostores/react';
+import { useIsAdmin } from 'features/auth/hooks/useIsAdmin';
+import { getIsClearInvocationCacheDisabled } from 'features/queue/hooks/invocationCacheControls';
 import { toast } from 'features/toast/toast';
 import { useCallback } from 'react';
 import { useTranslation } from 'react-i18next';
@@ -9,6 +11,7 @@ export const useClearInvocationCache = () => {
   const { t } = useTranslation();
   const { data: cacheStatus } = useGetInvocationCacheStatusQuery();
   const isConnected = useStore($isConnected);
+  const isAdmin = useIsAdmin();
   const [_trigger, { isLoading }] = useClearInvocationCacheMutation({
     fixedCacheKey: 'clearInvocationCache',
   });
@@ -30,5 +33,9 @@ export const useClearInvocationCache = () => {
     }
   }, [_trigger, t]);
 
-  return { trigger, isLoading, isDisabled: !isConnected || !cacheStatus?.size };
+  return {
+    trigger,
+    isLoading,
+    isDisabled: getIsClearInvocationCacheDisabled(isAdmin, isConnected, cacheStatus),
+  };
 };
diff --git a/invokeai/frontend/web/src/features/queue/hooks/useDisableInvocationCache.ts b/invokeai/frontend/web/src/features/queue/hooks/useDisableInvocationCache.ts
index 17ac6bec44a..0d31ca7d4a4 100644
--- a/invokeai/frontend/web/src/features/queue/hooks/useDisableInvocationCache.ts
+++ b/invokeai/frontend/web/src/features/queue/hooks/useDisableInvocationCache.ts
@@ -1,4 +1,6 @@
 import { useStore } from '@nanostores/react';
+import { useIsAdmin } from 'features/auth/hooks/useIsAdmin';
+import { getIsDisableInvocationCacheDisabled } from 'features/queue/hooks/invocationCacheControls';
 import { toast } from 'features/toast/toast';
 import { useCallback } from 'react';
 import { useTranslation } from 'react-i18next';
@@ -9,6 +11,7 @@ export const useDisableInvocationCache = () => {
   const { t } = useTranslation();
   const { data: cacheStatus } = useGetInvocationCacheStatusQuery();
   const isConnected = useStore($isConnected);
+  const isAdmin = useIsAdmin();
   const [_trigger, { isLoading }] = useDisableInvocationCacheMutation({
     fixedCacheKey: 'disableInvocationCache',
   });
@@ -34,6 +37,6 @@ export const useDisableInvocationCache = () => {
     trigger,
     isLoading,
     cacheStatus,
-    isDisabled: !cacheStatus?.enabled || !isConnected || cacheStatus?.max_size === 0,
+    isDisabled: getIsDisableInvocationCacheDisabled(isAdmin, isConnected, cacheStatus),
   };
 };
diff --git a/invokeai/frontend/web/src/features/queue/hooks/useEnableInvocationCache.ts b/invokeai/frontend/web/src/features/queue/hooks/useEnableInvocationCache.ts
index 02fcf444fa0..fb80b1ddd28 100644
--- a/invokeai/frontend/web/src/features/queue/hooks/useEnableInvocationCache.ts
+++ b/invokeai/frontend/web/src/features/queue/hooks/useEnableInvocationCache.ts
@@ -1,4 +1,6 @@
 import { useStore } from '@nanostores/react';
+import { useIsAdmin } from 'features/auth/hooks/useIsAdmin';
+import { getIsEnableInvocationCacheDisabled } from 'features/queue/hooks/invocationCacheControls';
 import { toast } from 'features/toast/toast';
 import { useCallback } from 'react';
 import { useTranslation } from 'react-i18next';
@@ -9,6 +11,7 @@ export const useEnableInvocationCache = () => {
   const { t } = useTranslation();
   const { data: cacheStatus } = useGetInvocationCacheStatusQuery();
   const isConnected = useStore($isConnected);
+  const isAdmin = useIsAdmin();
   const [_trigger, { isLoading }] = useEnableInvocationCacheMutation({
     fixedCacheKey: 'enableInvocationCache',
   });
@@ -33,6 +36,6 @@ export const useEnableInvocationCache = () => {
   return {
     trigger,
     isLoading,
-    isDisabled: cacheStatus?.enabled || !isConnected || cacheStatus?.max_size === 0,
+    isDisabled: getIsEnableInvocationCacheDisabled(isAdmin, isConnected, cacheStatus),
   };
 };
diff --git a/invokeai/frontend/web/src/features/settingsAccordions/components/UpscaleSettingsAccordion/UpscaleWarning.tsx b/invokeai/frontend/web/src/features/settingsAccordions/components/UpscaleSettingsAccordion/UpscaleWarning.tsx
index ff19e7ebb31..5344d329c97 100644
--- a/invokeai/frontend/web/src/features/settingsAccordions/components/UpscaleSettingsAccordion/UpscaleWarning.tsx
+++ b/invokeai/frontend/web/src/features/settingsAccordions/components/UpscaleSettingsAccordion/UpscaleWarning.tsx
@@ -1,6 +1,6 @@
 import { Button, Flex, Link, ListItem, Text, UnorderedList } from '@invoke-ai/ui-library';
 import { useAppDispatch, useAppSelector } from 'app/store/storeHooks';
-import { selectCurrentUser } from 'features/auth/store/authSlice';
+import { useIsAdmin } from 'features/auth/hooks/useIsAdmin';
 import { selectModel } from 'features/controlLayers/store/paramsSlice';
 import { setInstallModelsTabByName } from 'features/modelManagerV2/store/installModelsStore';
 import {
@@ -22,10 +22,8 @@ export const UpscaleWarning = () => {
   const dispatch = useAppDispatch();
   const [modelConfigs, { isLoading }] = useControlNetModels();
   const { data: setupStatus } = useGetSetupStatusQuery();
-  const user = useAppSelector(selectCurrentUser);
 
-  const isMultiuser = setupStatus?.multiuser_enabled ?? false;
-  const isAdmin = !isMultiuser || (user?.is_admin ?? false);
+  const isAdmin = useIsAdmin();
   const adminEmail = setupStatus?.admin_email ?? null;
 
   useEffect(() => {
diff --git a/invokeai/frontend/web/src/features/system/components/AboutModal/AboutModal.tsx b/invokeai/frontend/web/src/features/system/components/AboutModal/AboutModal.tsx
index ed1f7cf4d2f..111bddeaa95 100644
--- a/invokeai/frontend/web/src/features/system/components/AboutModal/AboutModal.tsx
+++ b/invokeai/frontend/web/src/features/system/components/AboutModal/AboutModal.tsx
@@ -15,7 +15,7 @@ import {
   Text,
   useDisclosure,
 } from '@invoke-ai/ui-library';
-import { deepClone } from 'common/util/deepClone';
+import { useIsAdmin } from 'features/auth/hooks/useIsAdmin';
 import DataViewer from 'features/gallery/components/ImageMetadataViewer/DataViewer';
 import { discordLink, githubLink } from 'features/system/store/constants';
 import InvokeLogoYellow from 'public/assets/images/invoke-tag-lrg.svg';
@@ -32,26 +32,22 @@ type AboutModalProps = {
 const AboutModal = ({ children }: AboutModalProps) => {
   const { isOpen, onOpen, onClose } = useDisclosure();
   const { t } = useTranslation();
-  const { data: runtimeConfig } = useGetRuntimeConfigQuery();
+  const isAdmin = useIsAdmin();
+  // The runtime config is administrator-only, so non-admins get a debug blob without the config section.
+  const { data: runtimeConfig } = useGetRuntimeConfigQuery(undefined, { skip: !isAdmin });
   const { data: dependencies } = useGetAppDepsQuery();
   const { data: appVersion } = useGetAppVersionQuery();
 
-  const localData = useMemo(() => {
-    const clonedRuntimeConfig = deepClone(runtimeConfig);
-
-    if (clonedRuntimeConfig && clonedRuntimeConfig.config.remote_api_tokens) {
-      clonedRuntimeConfig.config.remote_api_tokens.forEach((remote_api_token) => {
-        remote_api_token.token = 'REDACTED';
-      });
-    }
-
-    return {
+  const localData = useMemo(
+    () => ({
       version: appVersion?.version,
       dependencies,
-      config: clonedRuntimeConfig?.config,
-      set_config_fields: clonedRuntimeConfig?.set_fields,
-    };
-  }, [appVersion, dependencies, runtimeConfig]);
+      // Credentials in the config are already masked by the server; no client-side redaction needed.
+      config: runtimeConfig?.config,
+      set_config_fields: runtimeConfig?.set_fields,
+    }),
+    [appVersion, dependencies, runtimeConfig]
+  );
 
   return (
     <>
diff --git a/invokeai/frontend/web/src/features/system/components/SettingsModal/SettingsImageSubfolderStrategySelect.tsx b/invokeai/frontend/web/src/features/system/components/SettingsModal/SettingsImageSubfolderStrategySelect.tsx
index b156a50de27..7f986d8249d 100644
--- a/invokeai/frontend/web/src/features/system/components/SettingsModal/SettingsImageSubfolderStrategySelect.tsx
+++ b/invokeai/frontend/web/src/features/system/components/SettingsModal/SettingsImageSubfolderStrategySelect.tsx
@@ -1,7 +1,6 @@
 import type { ComboboxOnChange } from '@invoke-ai/ui-library';
 import { Combobox, FormControl, FormLabel } from '@invoke-ai/ui-library';
-import { useAppSelector } from 'app/store/storeHooks';
-import { selectCurrentUser } from 'features/auth/store/authSlice';
+import { useIsAdmin } from 'features/auth/hooks/useIsAdmin';
 import { toast } from 'features/toast/toast';
 import { memo, useCallback, useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
@@ -38,11 +37,11 @@ export const getImageSubfolderStrategyOption = (strategy: string): ImageSubfolde
 
 export const SettingsImageSubfolderStrategySelect = memo(() => {
   const { t } = useTranslation();
-  const currentUser = useAppSelector(selectCurrentUser);
-  const { data: runtimeConfig } = useGetRuntimeConfigQuery();
+  const isAdmin = useIsAdmin();
+  // runtime_config is an admin-only route; don't fire it for non-admins just to render a disabled control.
+  const { data: runtimeConfig } = useGetRuntimeConfigQuery(undefined, { skip: !isAdmin });
   const [updateRuntimeConfig, { isLoading }] = useUpdateRuntimeConfigMutation();
   const imageSubfolderStrategy: string = runtimeConfig?.config.image_subfolder_strategy ?? 'flat';
-  const canEditRuntimeConfig = runtimeConfig ? !runtimeConfig.config.multiuser || currentUser?.is_admin : false;
 
   const options = useMemo(() => {
     const localizedOptions: ImageSubfolderStrategySelectOption[] = imageSubfolderStrategyOptions.map((option) => ({
@@ -84,15 +83,14 @@ export const SettingsImageSubfolderStrategySelect = memo(() => {
     [imageSubfolderStrategy, t, updateRuntimeConfig]
   );
 
+  if (!isAdmin) {
+    return null;
+  }
+
   return (
     <FormControl>
       <FormLabel>{t('settings.imageSubfolderStrategy')}</FormLabel>
-      <Combobox
-        value={value}
-        options={options}
-        onChange={onChange}
-        isDisabled={!runtimeConfig || !canEditRuntimeConfig || isLoading}
-      />
+      <Combobox value={value} options={options} onChange={onChange} isDisabled={!runtimeConfig || isLoading} />
     </FormControl>
   );
 });
diff --git a/invokeai/frontend/web/src/features/system/components/SettingsModal/SettingsModal.tsx b/invokeai/frontend/web/src/features/system/components/SettingsModal/SettingsModal.tsx
index 8e331645a9b..ad87798d882 100644
--- a/invokeai/frontend/web/src/features/system/components/SettingsModal/SettingsModal.tsx
+++ b/invokeai/frontend/web/src/features/system/components/SettingsModal/SettingsModal.tsx
@@ -21,7 +21,7 @@ import { useAppDispatch, useAppSelector } from 'app/store/storeHooks';
 import { InformationalPopover } from 'common/components/InformationalPopover/InformationalPopover';
 import ScrollableContent from 'common/components/OverlayScrollbars/ScrollableContent';
 import { buildUseBoolean } from 'common/hooks/useBoolean';
-import { selectCurrentUser } from 'features/auth/store/authSlice';
+import { useIsAdmin } from 'features/auth/hooks/useIsAdmin';
 import { selectShouldUseCPUNoise, shouldUseCpuNoiseChanged } from 'features/controlLayers/store/paramsSlice';
 import { ExternalProviderStatusList } from 'features/system/components/SettingsModal/ExternalProviderStatusList';
 import { useRefreshAfterResetModal } from 'features/system/components/SettingsModal/RefreshAfterResetModal';
@@ -88,8 +88,9 @@ const SettingsModal = (props: { children: ReactElement<{ onClick?: () => void }>
 
   const settingsModal = useSettingsModal();
   const refreshModal = useRefreshAfterResetModal();
-  const currentUser = useAppSelector(selectCurrentUser);
-  const { data: runtimeConfig } = useGetRuntimeConfigQuery();
+  const canEditRuntimeConfig = useIsAdmin();
+  // runtime_config is an admin-only route; don't fire it for non-admins just to render disabled controls.
+  const { data: runtimeConfig } = useGetRuntimeConfigQuery(undefined, { skip: !canEditRuntimeConfig });
   const [updateRuntimeConfig, { isLoading: isUpdatingRuntimeConfig }] = useUpdateRuntimeConfigMutation();
   const pendingMaxQueueHistoryRef = useRef<number | null | undefined>(undefined);
 
@@ -107,7 +108,6 @@ const SettingsModal = (props: { children: ReactElement<{ onClick?: () => void }>
   const shouldConfirmOnNewSession = useAppSelector(selectSystemShouldConfirmOnNewSession);
   const shouldShowInvocationProgressDetail = useAppSelector(selectSystemShouldShowInvocationProgressDetail);
   const maxQueueHistory = runtimeConfig?.config.max_queue_history ?? null;
-  const canEditRuntimeConfig = runtimeConfig ? !runtimeConfig.config.multiuser || currentUser?.is_admin : false;
   const [maxQueueHistoryInputState, setMaxQueueHistoryInputState] = useState(() => ({
     source: maxQueueHistory,
     value: formatOptionalInteger(maxQueueHistory),
@@ -311,21 +311,26 @@ const SettingsModal = (props: { children: ReactElement<{ onClick?: () => void }>
                       <FormLabel>{t('settings.enableInvisibleWatermark')}</FormLabel>
                       <Switch isChecked={shouldUseWatermarker} onChange={handleChangeShouldUseWatermarker} />
                     </FormControl>
-                    <FormControl>
-                      <FormLabel>{t('settings.maxQueueHistory')}</FormLabel>
-                      <NumberInput
-                        min={0}
-                        step={1}
-                        value={maxQueueHistoryInput}
-                        onChange={handleChangeMaxQueueHistory}
-                        onBlur={handleBlurMaxQueueHistory}
-                        clampValueOnBlur={false}
-                        isDisabled={!runtimeConfig || !canEditRuntimeConfig || isUpdatingRuntimeConfig}
-                        w="8rem"
-                      >
-                        <NumberInputField onKeyDown={handleKeyDownMaxQueueHistory} />
-                      </NumberInput>
-                    </FormControl>
+                    {/* Admin-only: the backing runtime_config query is skipped for non-admins, so a
+                        rendered-but-disabled input would sit permanently blank. Hide it instead, matching
+                        SettingsImageSubfolderStrategySelect below. */}
+                    {canEditRuntimeConfig && (
+                      <FormControl>
+                        <FormLabel>{t('settings.maxQueueHistory')}</FormLabel>
+                        <NumberInput
+                          min={0}
+                          step={1}
+                          value={maxQueueHistoryInput}
+                          onChange={handleChangeMaxQueueHistory}
+                          onBlur={handleBlurMaxQueueHistory}
+                          clampValueOnBlur={false}
+                          isDisabled={!runtimeConfig || isUpdatingRuntimeConfig}
+                          w="8rem"
+                        >
+                          <NumberInputField onKeyDown={handleKeyDownMaxQueueHistory} />
+                        </NumberInput>
+                      </FormControl>
+                    )}
                     <SettingsImageSubfolderStrategySelect />
                   </StickyScrollable>
 
diff --git a/invokeai/frontend/web/src/services/api/schema.ts b/invokeai/frontend/web/src/services/api/schema.ts
index 7864579706a..4f370b2f95a 100644
--- a/invokeai/frontend/web/src/services/api/schema.ts
+++ b/invokeai/frontend/web/src/services/api/schema.ts
@@ -378,6 +378,9 @@ export type paths = {
          *
          *     These are models that have database entries but their corresponding
          *     weight files have been deleted externally (not via Model Manager).
+         *
+         *     Available to any authenticated user, not just admins: the frontend's model hooks subtract this
+         *     set from the model list so unusable models are kept out of the generation dropdowns.
          */
         get: operations["list_missing_models"];
         put?: never;
@@ -913,94 +916,6 @@ export type paths = {
         patch?: never;
         trace?: never;
     };
-    "/api/v1/download_queue/": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * List Downloads
-         * @description Get a list of active and inactive jobs.
-         */
-        get: operations["list_downloads"];
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        /**
-         * Prune Downloads
-         * @description Prune completed and errored jobs.
-         */
-        patch: operations["prune_downloads"];
-        trace?: never;
-    };
-    "/api/v1/download_queue/i/": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Download
-         * @description Download the source URL to the file or directory indicted in dest.
-         */
-        post: operations["download"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/v1/download_queue/i/{id}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * Get Download Job
-         * @description Get a download job using its ID.
-         */
-        get: operations["get_download_job"];
-        put?: never;
-        post?: never;
-        /**
-         * Cancel Download Job
-         * @description Cancel a download job using its ID.
-         */
-        delete: operations["cancel_download_job"];
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/api/v1/download_queue/i": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        post?: never;
-        /**
-         * Cancel All Download Jobs
-         * @description Cancel all download jobs.
-         */
-        delete: operations["cancel_all_download_jobs"];
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/api/v1/images/upload": {
         parameters: {
             query?: never;
@@ -4180,31 +4095,6 @@ export type components = {
              */
             token: string;
         };
-        /** Body_download */
-        Body_download: {
-            /**
-             * Source
-             * Format: uri
-             * @description download source
-             */
-            source: string;
-            /**
-             * Dest
-             * @description download destination
-             */
-            dest: string;
-            /**
-             * Priority
-             * @description queue priority
-             * @default 10
-             */
-            priority?: number;
-            /**
-             * Access Token
-             * @description token for authorization to download
-             */
-            access_token?: string | null;
-        };
         /** Body_download_images_from_list */
         Body_download_images_from_list: {
             /**
@@ -16219,6 +16109,8 @@ export type components = {
          *         hashing_algorithm: Model hashing algorthim for model installs. 'blake3_multi' is best for SSDs. 'blake3_single' is best for spinning disk HDDs. 'random' disables hashing, instead assigning a UUID to models. Useful when using a memory db to reduce model installation time, or if you don't care about storing stable hashes for models. Alternatively, any other hashlib algorithm is accepted, though these are not nearly as performant as blake3.<br>Valid values: `blake3_multi`, `blake3_single`, `random`, `md5`, `sha1`, `sha224`, `sha256`, `sha384`, `sha512`, `blake2b`, `blake2s`, `sha3_224`, `sha3_256`, `sha3_384`, `sha3_512`, `shake_128`, `shake_256`
          *         remote_api_tokens: List of regular expression and token pairs used when downloading models from URLs. The download URL is tested against the regex, and if it matches, the token is provided in as a Bearer token.
          *         scan_models_on_startup: Scan the models directory on startup, registering orphaned models. This is typically only used in conjunction with `use_memory_db` for testing purposes.
+         *         allow_private_download_urls: Allow the download queue to fetch from loopback, link-local and private-network addresses. Disabled by default so that a download URL cannot be used to reach services that are only reachable from the server. Enable this only if you install models from a mirror on your own network.
+         *         download_proxy: Optional HTTP proxy for model downloads. The proxy must enforce the public-address policy because proxy-side DNS cannot be checked by InvokeAI.
          *         unsafe_disable_picklescan: UNSAFE. Disable the picklescan security check during model installation. Recommended only for development and testing purposes. This will allow arbitrary code execution during model installation, so should never be used in production.
          *         allow_unknown_models: Allow installation of models that we are unable to identify. If enabled, models will be marked as `unknown` in the database, and will not have any metadata associated with them. If disabled, unknown models will be rejected during installation.
          *         multiuser: Enable multiuser support. When disabled, the application runs in single-user mode using a default system account with administrator privileges. When enabled, requires user authentication and authorization.
@@ -16598,6 +16490,17 @@ export type components = {
              * @default false
              */
             scan_models_on_startup?: boolean;
+            /**
+             * Allow Private Download Urls
+             * @description Allow the download queue to fetch from loopback, link-local and private-network addresses. Disabled by default so that a download URL cannot be used to reach services that are only reachable from the server. Enable this only if you install models from a mirror on your own network.
+             * @default false
+             */
+            allow_private_download_urls?: boolean;
+            /**
+             * Download Proxy
+             * @description Optional HTTP proxy for model downloads. The proxy must enforce the public-address policy because proxy-side DNS cannot be checked by InvokeAI.
+             */
+            download_proxy?: string | null;
             /**
              * Unsafe Disable Picklescan
              * @description UNSAFE. Disable the picklescan security check during model installation. Recommended only for development and testing purposes. This will allow arbitrary code execution during model installation, so should never be used in production.
@@ -34843,205 +34746,6 @@ export interface operations {
             };
         };
     };
-    list_downloads: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Successful Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["DownloadJob"][];
-                };
-            };
-        };
-    };
-    prune_downloads: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Successful Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": unknown;
-                };
-            };
-            /** @description All completed jobs have been pruned */
-            204: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description Bad request */
-            400: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
-    download: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["Body_download"];
-            };
-        };
-        responses: {
-            /** @description Successful Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["DownloadJob"];
-                };
-            };
-            /** @description Validation Error */
-            422: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["HTTPValidationError"];
-                };
-            };
-        };
-    };
-    get_download_job: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description ID of the download job to fetch. */
-                id: number;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Success */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["DownloadJob"];
-                };
-            };
-            /** @description The requested download JobID could not be found */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description Validation Error */
-            422: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["HTTPValidationError"];
-                };
-            };
-        };
-    };
-    cancel_download_job: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description ID of the download job to cancel. */
-                id: number;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Successful Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": unknown;
-                };
-            };
-            /** @description Job has been cancelled */
-            204: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description The requested download JobID could not be found */
-            404: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            /** @description Validation Error */
-            422: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["HTTPValidationError"];
-                };
-            };
-        };
-    };
-    cancel_all_download_jobs: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Successful Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": unknown;
-                };
-            };
-            /** @description Download jobs have been cancelled */
-            204: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-        };
-    };
     upload_image: {
         parameters: {
             query: {
diff --git a/invokeai/frontend/web/src/services/events/onModelInstallError.tsx b/invokeai/frontend/web/src/services/events/onModelInstallError.tsx
index 3496ff6ccd5..bfccb05cc25 100644
--- a/invokeai/frontend/web/src/services/events/onModelInstallError.tsx
+++ b/invokeai/frontend/web/src/services/events/onModelInstallError.tsx
@@ -1,6 +1,8 @@
 import { Button, ExternalLink, Spinner, Text } from '@invoke-ai/ui-library';
 import { logger } from 'app/logging/logger';
 import type { AppDispatch, AppGetState } from 'app/store/store';
+import { getIsAdmin } from 'features/auth/hooks/useIsAdmin';
+import { selectCurrentUser } from 'features/auth/store/authSlice';
 import { getPrefixedId } from 'features/controlLayers/konva/util';
 import { discordLink, githubIssuesLink } from 'features/system/store/constants';
 import { toast, toastApi } from 'features/toast/toast';
@@ -9,6 +11,7 @@ import { t } from 'i18next';
 import { useCallback } from 'react';
 import { useTranslation } from 'react-i18next';
 import { api } from 'services/api';
+import { authApi } from 'services/api/endpoints/auth';
 import { modelsApi, useGetHFTokenStatusQuery } from 'services/api/endpoints/models';
 import type { S } from 'services/api/types';
 import { assert } from 'tsafe';
@@ -39,6 +42,12 @@ const getHFTokenStatus = async (dispatch: AppDispatch): Promise<S['HFTokenStatus
   }
 };
 
+const getIsAdminFromState = (getState: AppGetState): boolean => {
+  const setupStatus = authApi.endpoints.getSetupStatus.select()(getState()).data;
+  const user = selectCurrentUser(getState());
+  return getIsAdmin(setupStatus, user);
+};
+
 /**
  * Handles model install error events by logging the error, displaying appropriate toast notifications.
  */
@@ -50,20 +59,25 @@ export const buildOnModelInstallError = (getState: AppGetState, dispatch: AppDis
 
     if (data.error === 'Unauthorized') {
       if (data.source.type === 'hf') {
-        const hfTokenStatus = await getHFTokenStatus(dispatch);
-        if (hfTokenStatus === null) {
-          // This means there was a problem getting the token status, should never happen...
-          log.error('Error getting HF token status');
-        } else {
-          const title = getHFTokenStatusToastTitle(hfTokenStatus);
-          toast({
-            id: UNAUTHORIZED_TOAST_ID,
-            title,
-            description: <HFUnauthorizedToastDescription />,
-            status: 'error',
-            isClosable: true,
-            duration: null,
-          });
+        // Admin-only: the server now addresses model_install_error to admin sockets only, but /hf_login
+        // is an admin-only route and the toast concerns the server-wide HF token that only an admin can
+        // fix. Keep the guard so the client does not depend on that server-side scoping.
+        if (getIsAdminFromState(getState)) {
+          const hfTokenStatus = await getHFTokenStatus(dispatch);
+          if (hfTokenStatus === null) {
+            // This means there was a problem getting the token status, should never happen...
+            log.error('Error getting HF token status');
+          } else {
+            const title = getHFTokenStatusToastTitle(hfTokenStatus);
+            toast({
+              id: UNAUTHORIZED_TOAST_ID,
+              title,
+              description: <HFUnauthorizedToastDescription />,
+              status: 'error',
+              isClosable: true,
+              duration: null,
+            });
+          }
         }
       } else if (data.source.type === 'url') {
         toast({
diff --git a/invokeai/version/invokeai_version.py b/invokeai/version/invokeai_version.py
index 4007688a098..f905f833a3c 100644
--- a/invokeai/version/invokeai_version.py
+++ b/invokeai/version/invokeai_version.py
@@ -1 +1 @@
-__version__ = "6.13.0.post1"
+__version__ = "6.13.8"
diff --git a/scripts/calibrate_qwen_vae_working_memory.py b/scripts/calibrate_qwen_vae_working_memory.py
new file mode 100644
index 00000000000..2f81752aece
--- /dev/null
+++ b/scripts/calibrate_qwen_vae_working_memory.py
@@ -0,0 +1,305 @@
+"""Calibrate the Qwen Image VAE working-memory estimate against measured peak CUDA/HIP memory.
+
+Background
+----------
+``estimate_vae_working_memory_qwen_image`` models peak working memory as a linear function of
+spatial area::
+
+    working_memory = h * w * element_size * scaling_constant
+
+This script measures the *actual* peak reserved memory the VAE consumes during decode/encode across
+a grid of resolutions so the ``scaling_constant`` can be fit from several points instead of one, and
+so we can check whether the pure-linear model holds or whether a super-linear (attention) term
+appears at high resolution.
+
+The estimate is consumed by the model cache via ``free >= estimate`` to decide whether to evict, so
+it MUST be an upper bound: we measure peak *reserved* (not just allocated) memory, the conservative
+quantity that includes caching-allocator overhead and kernel scratch/workspace.
+
+Portability
+-----------
+Backend-agnostic: uses only ``torch.cuda.*``, which works on both NVIDIA/CUDA and AMD/ROCm (HIP)
+builds of PyTorch. Run the SAME script on each backend and compare the ``implied_constant`` columns
+-- the curve *shape* (linear vs. super-linear) is architectural and should match, but the absolute
+constant can differ (cuDNN vs. MIOpen conv workspaces, flash-attention availability, allocator
+rounding). Ship ``max`` across backends plus headroom.
+
+Each (operation, resolution) point is measured in a FRESH SUBPROCESS so the caching allocator's
+fragmentation history from earlier points cannot contaminate the reserved-delta reading. A point
+that OOMs is recorded as ``oom`` rather than aborting the run, so the grid can probe up to the
+card's ceiling safely.
+
+Usage
+-----
+    python scripts/calibrate_qwen_vae_working_memory.py [--vae /path/to/vae_dir] [--csv out.csv]
+
+If ``--vae`` is omitted, the script auto-discovers an ``AutoencoderKLQwenImage`` under
+``$INVOKEAI_ROOT/models``.
+"""
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import torch
+from diffusers.models.autoencoders.autoencoder_kl_qwenimage import AutoencoderKLQwenImage
+
+LATENT_SCALE_FACTOR = 8
+
+# (height, width) pixel-space resolutions. Squares to test linearity in area, plus non-square
+# points (incl. the original 1248x832 calibration point) to confirm area = h*w is the right
+# predictor rather than max(h, w) or perimeter. Subprocess isolation + OOM capture means we can
+# list aggressive resolutions; ones that don't fit are simply recorded as oom.
+DEFAULT_RESOLUTIONS = [
+    (512, 512),
+    (768, 768),
+    (832, 1248),  # original single calibration point (as HxW)
+    (1024, 1024),
+    (1088, 1920),
+    (1280, 1280),
+    (1536, 1024),
+    (1536, 1536),
+    (1792, 1792),
+    (2048, 2048),
+]
+
+
+def discover_vae() -> Path:
+    """Find an AutoencoderKLQwenImage VAE directory under $INVOKEAI_ROOT/models."""
+    root = os.environ.get("INVOKEAI_ROOT")
+    if not root:
+        raise SystemExit("INVOKEAI_ROOT not set; pass --vae explicitly.")
+    models = Path(root) / "models"
+    for config_path in models.glob("*/vae/config.json"):
+        try:
+            cfg = json.loads(config_path.read_text())
+        except Exception:
+            continue
+        if cfg.get("_class_name") == "AutoencoderKLQwenImage":
+            return config_path.parent
+    raise SystemExit(f"No AutoencoderKLQwenImage VAE found under {models}; pass --vae explicitly.")
+
+
+DTYPES = {"float16": torch.float16, "bfloat16": torch.bfloat16, "float32": torch.float32}
+
+
+def _load_vae(vae_path: str, dtype: torch.dtype) -> AutoencoderKLQwenImage:
+    """Load an AutoencoderKLQwenImage from either a diffusers directory or a single .safetensors file.
+
+    Directory: standard ``from_pretrained``.
+    Single file: ``AutoencoderKLQwenImage`` has no single-file converter registered in diffusers,
+    so we instantiate with the default config and load the state dict directly. Two on-disk layouts
+    exist: the diffusers layout (``encoder.conv_in`` / ``down_blocks`` / ``mid_block`` keys, e.g. the
+    weights InvokeAI's VAELoader consumes) and the original Qwen-Image/Wan release layout
+    (``encoder.conv1`` / ``downsamples`` / ``middle`` / ``time_conv`` keys). We try a direct strict
+    load first, and on a key mismatch fall back to diffusers' Wan VAE converter -- the Qwen-Image VAE
+    shares the Wan VAE key structure -- before retrying.
+    """
+    path = Path(vae_path)
+    if not path.is_file():
+        return AutoencoderKLQwenImage.from_pretrained(vae_path, local_files_only=True, torch_dtype=dtype)
+
+    from safetensors.torch import load_file
+
+    sd = load_file(str(path))
+    for k in list(sd.keys()):
+        if sd[k].is_floating_point():
+            sd[k] = sd[k].to(dtype)
+
+    vae = AutoencoderKLQwenImage()
+    try:
+        # diffusers-layout checkpoint: keys already match the model. State dict was converted to
+        # `dtype` above and is assigned in place, so params carry the correct dtype.
+        vae.load_state_dict(sd, strict=True, assign=True)
+    except RuntimeError:
+        # Original Qwen-Image/Wan release layout: convert keys to the diffusers layout, then retry.
+        from diffusers.loaders.single_file_utils import convert_wan_vae_to_diffusers
+
+        converted = convert_wan_vae_to_diffusers(sd)
+        for k in list(converted.keys()):
+            if converted[k].is_floating_point():
+                converted[k] = converted[k].to(dtype)
+        vae.load_state_dict(converted, strict=True, assign=True)
+    return vae
+
+
+def _build_input(operation: str, h: int, w: int, z_dim: int, dtype: torch.dtype) -> torch.Tensor:
+    """Construct the 5D (B, C, num_frames, H, W) input the invocation feeds the VAE.
+
+    decode: latents at latent resolution (H/8, W/8) with z_dim channels.
+    encode: image at pixel resolution (H, W) with 3 channels.
+    These mirror QwenImageLatentsToImageInvocation / QwenImageImageToLatentsInvocation exactly.
+    """
+    device = torch.device("cuda")
+    if operation == "decode":
+        return torch.randn(1, z_dim, 1, h // LATENT_SCALE_FACTOR, w // LATENT_SCALE_FACTOR, device=device, dtype=dtype)
+    return torch.randn(1, 3, 1, h, w, device=device, dtype=dtype)
+
+
+@torch.inference_mode()
+def measure_one(vae_path: str, operation: str, h: int, w: int, dtype: torch.dtype) -> dict:
+    """Measure peak reserved-memory growth for a single decode/encode. Runs in a child process."""
+    vae = _load_vae(vae_path, dtype)
+    vae.to("cuda")
+    vae.disable_tiling()  # Qwen invocations never tile; match that.
+
+    param = next(vae.parameters())
+    dtype = param.dtype
+    element_size = param.element_size()
+    z_dim = int(vae.config.z_dim)
+
+    x = _build_input(operation, h, w, z_dim, dtype)
+
+    torch.cuda.synchronize()
+    torch.cuda.empty_cache()
+    torch.cuda.reset_peak_memory_stats()
+    baseline_reserved = torch.cuda.memory_reserved()
+
+    # Measure the COLD first call -- it includes conv-algorithm-search / attention workspace
+    # allocation, which is exactly what the real (single-shot) invocation pays.
+    try:
+        if operation == "decode":
+            vae.decode(x, return_dict=False)
+        else:
+            vae.encode(x).latent_dist.mode()
+        torch.cuda.synchronize()
+    except (torch.cuda.OutOfMemoryError, RuntimeError) as e:
+        if "out of memory" not in str(e).lower():
+            raise
+        return {"operation": operation, "h": h, "w": w, "oom": True}
+
+    peak_reserved = torch.cuda.max_memory_reserved()
+    peak_allocated = torch.cuda.max_memory_allocated()
+    reserved_delta = peak_reserved - baseline_reserved
+
+    area = h * w
+    return {
+        "operation": operation,
+        "h": h,
+        "w": w,
+        "area": area,
+        "element_size": element_size,
+        "dtype": str(dtype),
+        "reserved_delta": reserved_delta,
+        "allocated_peak": peak_allocated,
+        "reserved_baseline": baseline_reserved,
+        # The constant as the estimator parameterizes it: mem = area * element_size * k
+        "implied_constant": reserved_delta / (area * element_size),
+        "oom": False,
+    }
+
+
+def run_grid(vae_path: str, resolutions: list[tuple[int, int]], dtype_name: str, csv_path: Path | None) -> None:
+    rows: list[dict] = []
+    print(f"VAE: {vae_path}")
+    print(
+        f"torch {torch.__version__} | device {torch.cuda.get_device_name(0)} | hip={torch.version.hip} | dtype={dtype_name}\n"
+    )
+    print(f"{'op':6} {'HxW':>11} {'area':>10} {'reserved(GiB)':>14} {'alloc(GiB)':>11} {'implied_k':>10}")
+    print("-" * 70)
+
+    for operation in ("decode", "encode"):
+        for h, w in resolutions:
+            # Fresh subprocess per point for an uncontaminated reserved-memory reading.
+            proc = subprocess.run(
+                [
+                    sys.executable,
+                    __file__,
+                    "--single",
+                    operation,
+                    str(h),
+                    str(w),
+                    "--vae",
+                    vae_path,
+                    "--dtype",
+                    dtype_name,
+                ],
+                capture_output=True,
+                text=True,
+            )
+            line = proc.stdout.strip().splitlines()[-1] if proc.stdout.strip() else ""
+            try:
+                row = json.loads(line)
+            except Exception:
+                print(f"{operation:6} {f'{h}x{w}':>11}  FAILED: {proc.stderr.strip().splitlines()[-1:]}")
+                continue
+            rows.append(row)
+            if row.get("oom"):
+                print(f"{operation:6} {f'{h}x{w}':>11} {h * w:>10}  {'OOM':>14}")
+                continue
+            gib = 1024**3
+            print(
+                f"{operation:6} {f'{h}x{w}':>11} {row['area']:>10} "
+                f"{row['reserved_delta'] / gib:>14.3f} {row['allocated_peak'] / gib:>11.3f} "
+                f"{row['implied_constant']:>10.1f}"
+            )
+
+    # Summary: the shippable constant is the MAX implied constant over fitting points (upper bound).
+    print("\n=== summary (max implied constant = candidate scaling_constant, before headroom) ===")
+    for operation in ("decode", "encode"):
+        ks = [r["implied_constant"] for r in rows if r["operation"] == operation and not r.get("oom")]
+        if ks:
+            print(
+                f"{operation:6}: n={len(ks)}  min_k={min(ks):.1f}  max_k={max(ks):.1f}  "
+                f"-> use >= {max(ks):.0f} (+headroom)"
+            )
+
+    if csv_path:
+        import csv
+
+        fieldnames = [
+            "operation",
+            "h",
+            "w",
+            "area",
+            "element_size",
+            "dtype",
+            "reserved_delta",
+            "allocated_peak",
+            "reserved_baseline",
+            "implied_constant",
+            "oom",
+        ]
+        with csv_path.open("w", newline="") as f:
+            writer = csv.DictWriter(f, fieldnames=fieldnames, extrasaction="ignore")
+            writer.writeheader()
+            for r in rows:
+                writer.writerow(r)
+        print(f"\nWrote {csv_path}")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument(
+        "--vae",
+        type=str,
+        default=None,
+        help="Path to an AutoencoderKLQwenImage diffusers dir OR a single .safetensors checkpoint.",
+    )
+    parser.add_argument("--csv", type=str, default=None, help="Optional path to write the raw results as CSV.")
+    parser.add_argument(
+        "--dtype",
+        choices=list(DTYPES),
+        default="float16",
+        help="Compute dtype. Default float16 to match InvokeAI's default precision on CUDA/ROCm.",
+    )
+    # Internal: measure a single point in this process and print one JSON line.
+    parser.add_argument("--single", nargs=3, metavar=("OP", "H", "W"), default=None, help=argparse.SUPPRESS)
+    args = parser.parse_args()
+
+    vae_path = args.vae or str(discover_vae())
+    dtype = DTYPES[args.dtype]
+
+    if args.single:
+        op, h, w = args.single[0], int(args.single[1]), int(args.single[2])
+        print(json.dumps(measure_one(vae_path, op, h, w, dtype)))
+        return
+
+    run_grid(vae_path, DEFAULT_RESOLUTIONS, args.dtype, Path(args.csv) if args.csv else None)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/app/invocations/test_qwen_image_working_memory.py b/tests/app/invocations/test_qwen_image_working_memory.py
new file mode 100644
index 00000000000..f3dfbe970df
--- /dev/null
+++ b/tests/app/invocations/test_qwen_image_working_memory.py
@@ -0,0 +1,136 @@
+"""Test that Qwen Image VAE invocations properly estimate and request working memory."""
+
+from contextlib import nullcontext
+from unittest.mock import MagicMock, patch
+
+import pytest
+import torch
+from diffusers.models.autoencoders.autoencoder_kl_qwenimage import AutoencoderKLQwenImage
+
+from invokeai.app.invocations.qwen_image_image_to_latents import QwenImageImageToLatentsInvocation
+from invokeai.app.invocations.qwen_image_latents_to_image import QwenImageLatentsToImageInvocation
+from invokeai.backend.util.vae_working_memory import estimate_vae_working_memory_qwen_image
+
+
+class TestQwenImageWorkingMemoryEstimate:
+    """Lock in the per-backend scaling constants calibrated in scripts/calibrate_qwen_vae_working_memory.py.
+
+    These differ by backend because the Qwen VAE is attention-heavy: ROCm falls back to math attention
+    (O(area^2), much higher memory) while CUDA uses Flash/efficient attention. A regression that swaps
+    the constants would reintroduce the ROCm OOM (under-estimate) or needlessly over-budget CUDA.
+    """
+
+    # (operation, latent_h, latent_w) -> the estimator scales pixel area (latent * 8 for decode,
+    # raw for encode) by element_size and the constant.
+    @pytest.mark.parametrize(
+        "operation, is_rocm, expected_constant",
+        [
+            ("decode", True, 5500),
+            ("decode", False, 2900),
+            ("encode", True, 6300),
+            ("encode", False, 1600),
+        ],
+    )
+    def test_constant_selected_per_backend(self, operation, is_rocm, expected_constant):
+        mock_vae = MagicMock(spec=AutoencoderKLQwenImage)
+        mock_vae.parameters.return_value = iter([torch.zeros(1, dtype=torch.float16)])  # element_size == 2
+
+        # decode receives latents (pixel area = latent area * 8^2); encode receives a pixel image.
+        if operation == "decode":
+            image_tensor = torch.zeros(1, 16, 1, 64, 64)
+            h = w = 64 * 8
+        else:
+            image_tensor = torch.zeros(1, 3, 1, 512, 512)
+            h = w = 512
+
+        hip_value = "7.1.0" if is_rocm else None
+        with patch("torch.version.hip", hip_value):
+            result = estimate_vae_working_memory_qwen_image(
+                operation=operation, image_tensor=image_tensor, vae=mock_vae
+            )
+
+        assert result == h * w * 2 * expected_constant
+
+
+class TestQwenImageWorkingMemory:
+    """Test that Qwen Image VAE invocations request working memory before decode/encode."""
+
+    def _mock_vae_info(self):
+        """Build a mocked AutoencoderKLQwenImage and its LoadedModel wrapper."""
+        mock_vae = MagicMock(spec=AutoencoderKLQwenImage)
+
+        # Create mock parameter for dtype detection
+        mock_param = torch.zeros(1)
+        mock_vae.parameters.return_value = iter([mock_param])
+
+        # Create mock vae_info with a model_on_device context manager yielding (None, vae)
+        mock_vae_info = MagicMock()
+        mock_vae_info.model = mock_vae
+
+        mock_cm = MagicMock()
+        mock_cm.__enter__ = MagicMock(return_value=(None, mock_vae))
+        mock_cm.__exit__ = MagicMock(return_value=None)
+        mock_vae_info.model_on_device = MagicMock(return_value=mock_cm)
+
+        return mock_vae, mock_vae_info
+
+    def test_qwen_latents_to_image_requests_working_memory(self):
+        """QwenImageLatentsToImageInvocation estimates decode memory and passes it to the cache."""
+        mock_vae, mock_vae_info = self._mock_vae_info()
+
+        # Mock the context
+        mock_context = MagicMock()
+        mock_context.models.load.return_value = mock_vae_info
+
+        # Mock latents (5D: B, C, num_frames, H, W)
+        mock_latents = torch.zeros(1, 16, 1, 64, 64)
+        mock_context.tensors.load.return_value = mock_latents
+
+        estimation_path = "invokeai.app.invocations.qwen_image_latents_to_image.estimate_vae_working_memory_qwen_image"
+        seamless_path = "invokeai.app.invocations.qwen_image_latents_to_image.SeamlessExt.static_patch_model"
+
+        with (
+            patch(estimation_path) as mock_estimate,
+            patch(seamless_path, return_value=nullcontext()),
+        ):
+            expected_memory = 1024 * 1024 * 10000  # 10GB
+            mock_estimate.return_value = expected_memory
+
+            invocation = QwenImageLatentsToImageInvocation.model_construct(
+                latents=MagicMock(latents_name="test_latents"),
+                vae=MagicMock(vae=MagicMock(), seamless_axes=["x", "y"]),
+            )
+
+            try:
+                invocation.invoke(mock_context)
+            except Exception:
+                # Downstream decode math fails under mocking; we only care that the cache was
+                # asked to reserve the estimated working memory before entering the device context.
+                pass
+
+            mock_estimate.assert_called_once()
+            assert mock_estimate.call_args.kwargs["operation"] == "decode"
+            mock_vae_info.model_on_device.assert_called_once_with(working_mem_bytes=expected_memory)
+
+    def test_qwen_image_to_latents_requests_working_memory(self):
+        """QwenImageImageToLatentsInvocation estimates encode memory and passes it to the cache."""
+        mock_vae, mock_vae_info = self._mock_vae_info()
+
+        mock_image_tensor = torch.zeros(1, 3, 512, 512)
+
+        estimation_path = "invokeai.app.invocations.qwen_image_image_to_latents.estimate_vae_working_memory_qwen_image"
+
+        with patch(estimation_path) as mock_estimate:
+            expected_memory = 1024 * 1024 * 5000  # 5GB
+            mock_estimate.return_value = expected_memory
+
+            try:
+                QwenImageImageToLatentsInvocation.vae_encode(mock_vae_info, mock_image_tensor)
+            except Exception:
+                # Downstream encode math fails under mocking; we only care that the cache was
+                # asked to reserve the estimated working memory before entering the device context.
+                pass
+
+            mock_estimate.assert_called_once()
+            assert mock_estimate.call_args.kwargs["operation"] == "encode"
+            mock_vae_info.model_on_device.assert_called_once_with(working_mem_bytes=expected_memory)
diff --git a/tests/app/routers/conftest.py b/tests/app/routers/conftest.py
index 73cd38e45f3..dee7c907c77 100644
--- a/tests/app/routers/conftest.py
+++ b/tests/app/routers/conftest.py
@@ -3,8 +3,8 @@
 Note: This conftest intentionally does NOT redefine `mock_services` / `mock_invoker`
 to avoid shadowing the project-level fixtures in `tests/conftest.py`. Instead, the
 `enable_multiuser` fixture below injects MagicMock services for the routers that
-have no real backing service in the default mock_services (download_queue,
-style_preset_image_files, model_relationships, model_manager).
+have no real backing service in the default mock_services (style_preset_image_files,
+model_relationships, model_manager).
 
 WARNING for future authors: `enable_multiuser` *unconditionally* replaces several
 services on `mock_invoker.services` with MagicMocks. If you add a router test that
@@ -49,13 +49,14 @@ def __init__(self, invoker: Invoker) -> None:
 _PATCHED_API_DEPENDENCIES_MODULES = (
     "invokeai.app.api.auth_dependencies",
     "invokeai.app.api.routers.auth",
-    "invokeai.app.api.routers.download_queue",
     "invokeai.app.api.routers.style_presets",
     "invokeai.app.api.routers.model_relationships",
     "invokeai.app.api.routers.utilities",
     "invokeai.app.api.routers.virtual_boards",
     "invokeai.app.api.routers.images",
     "invokeai.app.api.routers._access",
+    "invokeai.app.api.routers.model_manager",
+    "invokeai.app.api.routers.app_info",
 )
 
 
@@ -101,7 +102,6 @@ def enable_multiuser(monkeypatch: Any, mock_invoker: Invoker):
     mock_invoker.services.configuration.multiuser = True
 
     # Replace services that are None in the default mock_services with MagicMocks.
-    mock_invoker.services.download_queue = MagicMock()
     mock_invoker.services.style_preset_image_files = MagicMock()
     mock_invoker.services.model_relationships = MagicMock()
     mock_invoker.services.model_manager = MagicMock()
diff --git a/tests/app/routers/test_app_info.py b/tests/app/routers/test_app_info.py
index da493cee457..94b46b2f2ee 100644
--- a/tests/app/routers/test_app_info.py
+++ b/tests/app/routers/test_app_info.py
@@ -38,6 +38,7 @@ def test_get_external_provider_statuses(monkeypatch: Any, mock_invoker: Invoker,
     }
 
     monkeypatch.setattr("invokeai.app.api.routers.app_info.ApiDependencies", MockApiDependencies(mock_invoker))
+    monkeypatch.setattr("invokeai.app.api.auth_dependencies.ApiDependencies", MockApiDependencies(mock_invoker))
     monkeypatch.setattr(mock_invoker.services.external_generation, "get_provider_statuses", lambda: statuses)
 
     response = client.get("/api/v1/app/external_providers/status")
diff --git a/tests/app/routers/test_download_queue_router.py b/tests/app/routers/test_download_queue_router.py
deleted file mode 100644
index b3976f051f5..00000000000
--- a/tests/app/routers/test_download_queue_router.py
+++ /dev/null
@@ -1,112 +0,0 @@
-"""Router-level tests for /api/v1/download_queue.
-
-Covers:
-- Auth gating (CurrentUserOrDefault on read/per-job, AdminUserOrDefault on prune & cancel-all).
-- Bug regression: `dest` path validation must reject absolute paths and '..' segments
-  BEFORE the queue service is invoked.
-"""
-
-from typing import Any
-from unittest.mock import MagicMock
-
-import pytest
-from fastapi import status
-from fastapi.testclient import TestClient
-
-from invokeai.app.services.download import DownloadJob
-from invokeai.app.services.invoker import Invoker
-
-
-def _make_job(id: int = 1) -> DownloadJob:
-    from pathlib import Path
-
-    return DownloadJob(id=id, source="http://example.com/file.bin", dest=Path("models/file.bin"))
-
-
-# ----------------------------- Auth gating -----------------------------
-
-
-@pytest.mark.parametrize(
-    ("method", "path"),
-    [
-        ("GET", "/api/v1/download_queue/"),
-        ("PATCH", "/api/v1/download_queue/"),
-        ("POST", "/api/v1/download_queue/i/"),
-        ("GET", "/api/v1/download_queue/i/1"),
-        ("DELETE", "/api/v1/download_queue/i/1"),
-        ("DELETE", "/api/v1/download_queue/i"),
-    ],
-)
-def test_routes_require_auth_in_multiuser_mode(enable_multiuser: Any, client: TestClient, method: str, path: str):
-    response = client.request(method, path, json={"source": "http://x/y", "dest": "models/x"})
-    assert response.status_code == status.HTTP_401_UNAUTHORIZED
-
-
-def test_list_downloads_as_regular_user(client: TestClient, user1_token: str, mock_invoker: Invoker):
-    mock_invoker.services.download_queue.list_jobs = MagicMock(return_value=[])
-    r = client.get("/api/v1/download_queue/", headers={"Authorization": f"Bearer {user1_token}"})
-    assert r.status_code == status.HTTP_200_OK
-    assert r.json() == []
-
-
-def test_prune_downloads_forbidden_for_regular_user(client: TestClient, user1_token: str, mock_invoker: Invoker):
-    r = client.patch("/api/v1/download_queue/", headers={"Authorization": f"Bearer {user1_token}"})
-    assert r.status_code == status.HTTP_403_FORBIDDEN
-    mock_invoker.services.download_queue.prune_jobs.assert_not_called()
-
-
-def test_prune_downloads_allowed_for_admin(client: TestClient, admin_token: str, mock_invoker: Invoker):
-    r = client.patch("/api/v1/download_queue/", headers={"Authorization": f"Bearer {admin_token}"})
-    assert r.status_code == status.HTTP_204_NO_CONTENT
-    mock_invoker.services.download_queue.prune_jobs.assert_called_once()
-
-
-def test_cancel_all_forbidden_for_regular_user(client: TestClient, user1_token: str, mock_invoker: Invoker):
-    r = client.delete("/api/v1/download_queue/i", headers={"Authorization": f"Bearer {user1_token}"})
-    assert r.status_code == status.HTTP_403_FORBIDDEN
-    mock_invoker.services.download_queue.cancel_all_jobs.assert_not_called()
-
-
-def test_cancel_all_allowed_for_admin(client: TestClient, admin_token: str, mock_invoker: Invoker):
-    r = client.delete("/api/v1/download_queue/i", headers={"Authorization": f"Bearer {admin_token}"})
-    assert r.status_code == status.HTTP_204_NO_CONTENT
-    mock_invoker.services.download_queue.cancel_all_jobs.assert_called_once()
-
-
-# ----------------------------- Bug D regression: dest validation -----------------------------
-
-
-@pytest.mark.parametrize(
-    "bad_dest",
-    [
-        "/etc/passwd",
-        "C:/Windows/System32",
-        "models/../../etc/passwd",
-        "..",
-        "",
-        "   ",
-    ],
-)
-def test_download_rejects_unsafe_dest_before_service_call(
-    client: TestClient, user1_token: str, mock_invoker: Invoker, bad_dest: str
-):
-    """Absolute paths, '..' segments, and empty strings must produce 400 and
-    must NOT invoke the download_queue service."""
-    r = client.post(
-        "/api/v1/download_queue/i/",
-        json={"source": "http://example.com/file.bin", "dest": bad_dest},
-        headers={"Authorization": f"Bearer {user1_token}"},
-    )
-    assert r.status_code == status.HTTP_400_BAD_REQUEST
-    mock_invoker.services.download_queue.download.assert_not_called()
-
-
-def test_download_accepts_relative_dest(client: TestClient, user1_token: str, mock_invoker: Invoker):
-    mock_invoker.services.download_queue.download = MagicMock(return_value=_make_job())
-    r = client.post(
-        "/api/v1/download_queue/i/",
-        json={"source": "http://example.com/file.bin", "dest": "models/sd15.safetensors"},
-        headers={"Authorization": f"Bearer {user1_token}"},
-    )
-    assert r.status_code == status.HTTP_200_OK
-    mock_invoker.services.download_queue.download.assert_called_once()
diff --git a/tests/app/routers/test_model_manager.py b/tests/app/routers/test_model_manager.py
index 3260b539bb3..95db8fc4b79 100644
--- a/tests/app/routers/test_model_manager.py
+++ b/tests/app/routers/test_model_manager.py
@@ -57,6 +57,7 @@ def test_model_manager_external_config_round_trip(
 
     invoker = DummyInvoker(services)
     monkeypatch.setattr("invokeai.app.api.routers.model_manager.ApiDependencies", MockApiDependencies(invoker))
+    monkeypatch.setattr("invokeai.app.api.auth_dependencies.ApiDependencies", MockApiDependencies(invoker))
 
     response = client.get("/api/v2/models/", params={"model_type": ModelType.ExternalImageGenerator.value})
 
@@ -99,6 +100,7 @@ def test_model_manager_external_config_preserves_custom_panel_schema(
 
     invoker = DummyInvoker(services)
     monkeypatch.setattr("invokeai.app.api.routers.model_manager.ApiDependencies", MockApiDependencies(invoker))
+    monkeypatch.setattr("invokeai.app.api.auth_dependencies.ApiDependencies", MockApiDependencies(invoker))
 
     response = client.get("/api/v2/models/i/external_custom_schema")
 
@@ -130,6 +132,7 @@ def test_model_manager_external_starter_model_applies_panel_schema_overrides(
 
     invoker = DummyInvoker(services)
     monkeypatch.setattr("invokeai.app.api.routers.model_manager.ApiDependencies", MockApiDependencies(invoker))
+    monkeypatch.setattr("invokeai.app.api.auth_dependencies.ApiDependencies", MockApiDependencies(invoker))
 
     response = client.get("/api/v2/models/i/external_starter_schema")
 
@@ -160,6 +163,7 @@ def test_model_manager_gemini_starter_model_applies_reference_and_resolution_ove
 
     invoker = DummyInvoker(services)
     monkeypatch.setattr("invokeai.app.api.routers.model_manager.ApiDependencies", MockApiDependencies(invoker))
+    monkeypatch.setattr("invokeai.app.api.auth_dependencies.ApiDependencies", MockApiDependencies(invoker))
 
     response = client.get("/api/v2/models/i/external_gemini_schema")
 
diff --git a/tests/app/routers/test_model_manager_authorization.py b/tests/app/routers/test_model_manager_authorization.py
new file mode 100644
index 00000000000..5fa3bc1b55f
--- /dev/null
+++ b/tests/app/routers/test_model_manager_authorization.py
@@ -0,0 +1,352 @@
+"""Tests for API-level authorization on model-manager and app-info read endpoints.
+
+These cover the security fix for GH #9365: in multi-user mode a number of model-management and app-info read
+routes carried no auth dependency at all, so an unauthenticated network attacker could reach them. The highest
+impact was `GET /api/v2/models/scan_folder`, which enumerates an attacker-chosen filesystem path.
+"""
+
+from pathlib import Path
+from typing import Any
+from unittest.mock import MagicMock
+
+import pytest
+from fastapi import status
+from fastapi.testclient import TestClient
+
+from invokeai.app.services.config.config_default import InvokeAIAppConfig, URLRegexTokenPair
+from invokeai.app.services.invoker import Invoker
+from invokeai.backend.model_manager.configs.main import Main_Checkpoint_SD1_Config
+from invokeai.backend.model_manager.taxonomy import (
+    BaseModelType,
+    ModelFormat,
+    ModelSourceType,
+    ModelType,
+    ModelVariantType,
+    SchedulerPredictionType,
+)
+from tests.app.routers.conftest import _auth
+
+# (method, path) for routes that must reject unauthenticated callers in multiuser mode.
+PROTECTED_ROUTES = [
+    ("get", "/api/v2/models/scan_folder?scan_path=/etc"),
+    ("get", "/api/v2/models/"),
+    ("get", "/api/v2/models/missing"),
+    ("get", "/api/v2/models/get_by_attrs?name=x&type=main&base=sd-1"),
+    ("get", "/api/v2/models/get_by_hash?hash=x"),
+    ("get", "/api/v2/models/i/some-key"),
+    ("get", "/api/v2/models/hugging_face?hugging_face_repo=x/y"),
+    ("get", "/api/v2/models/starter_models"),
+    ("get", "/api/v2/models/stats"),
+    ("get", "/api/v2/models/hf_login"),
+    ("get", "/api/v1/app/runtime_config"),
+    ("get", "/api/v1/app/app_deps"),
+    ("get", "/api/v1/app/patchmatch_status"),
+    ("get", "/api/v1/app/external_providers/status"),
+    ("get", "/api/v1/app/external_providers/config"),
+    ("get", "/api/v1/app/logging"),
+    ("post", "/api/v1/app/logging"),
+    ("get", "/api/v1/app/invocation_cache/status"),
+    ("delete", "/api/v1/app/invocation_cache"),
+    ("put", "/api/v1/app/invocation_cache/enable"),
+    ("put", "/api/v1/app/invocation_cache/disable"),
+    ("post", "/api/v1/images/"),
+]
+
+# Routes that must additionally reject authenticated non-admin users.
+ADMIN_ONLY_ROUTES = [
+    ("get", "/api/v2/models/scan_folder?scan_path=/etc"),
+    ("get", "/api/v2/models/hugging_face?hugging_face_repo=x/y"),
+    ("get", "/api/v2/models/starter_models"),
+    ("get", "/api/v2/models/stats"),
+    ("get", "/api/v2/models/hf_login"),
+    ("get", "/api/v1/app/external_providers/config"),
+    ("get", "/api/v1/app/runtime_config"),
+    ("get", "/api/v1/app/logging"),
+    ("post", "/api/v1/app/logging"),
+    ("get", "/api/v1/app/invocation_cache/status"),
+    ("delete", "/api/v1/app/invocation_cache"),
+    ("put", "/api/v1/app/invocation_cache/enable"),
+    ("put", "/api/v1/app/invocation_cache/disable"),
+]
+
+
+@pytest.mark.parametrize(("method", "path"), PROTECTED_ROUTES)
+def test_route_rejects_unauthenticated(
+    method: str, path: str, enable_multiuser: Any, setup_jwt_secret: None, client: TestClient
+) -> None:
+    """In multiuser mode, no Authorization header must yield 401 - never a 200 or a data-bearing error."""
+    response = getattr(client, method)(path)
+    assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+
+@pytest.mark.parametrize(("method", "path"), ADMIN_ONLY_ROUTES)
+def test_route_rejects_non_admin(
+    method: str, path: str, enable_multiuser: Any, client: TestClient, user1_token: str
+) -> None:
+    """Model-management routes are administrator-only, per the documented multi-user model."""
+    response = getattr(client, method)(path, headers=_auth(user1_token))
+    assert response.status_code == status.HTTP_403_FORBIDDEN
+
+
+def test_scan_folder_allows_admin(enable_multiuser: Any, client: TestClient, admin_token: str) -> None:
+    """An admin still reaches the handler - 400 here is the scan failing, not the auth layer rejecting."""
+    response = client.get(
+        "/api/v2/models/scan_folder?scan_path=/nonexistent_xyz",
+        headers=_auth(admin_token),
+    )
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+
+
+def test_scan_folder_missing_param_is_a_clean_400(enable_multiuser: Any, client: TestClient, admin_token: str) -> None:
+    """Omitting scan_path must not crash: the None default is guarded before pathlib.Path() sees it."""
+    response = client.get("/api/v2/models/scan_folder", headers=_auth(admin_token))
+    assert response.status_code == status.HTTP_400_BAD_REQUEST
+
+
+def test_scan_folder_is_not_an_existence_oracle(
+    enable_multiuser: Any, client: TestClient, admin_token: str, tmp_path: Path
+) -> None:
+    """A nonexistent path and an existing non-directory must be indistinguishable from the response.
+
+    Bounded to tmp_path fixtures - scanning real host paths ('/', '/etc') makes runtime depend on the host
+    filesystem and can walk enormous trees on permissive CI runners.
+    """
+    not_a_dir = tmp_path / "weights.ckpt"
+    not_a_dir.write_text("not a directory")
+
+    for p in (tmp_path / "does_not_exist", not_a_dir):
+        response = client.get(f"/api/v2/models/scan_folder?scan_path={p}", headers=_auth(admin_token))
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert response.json()["detail"] == f"The search path '{p}' could not be scanned"
+
+
+def test_scan_folder_mid_scan_failure_is_a_generic_500(
+    enable_multiuser: Any, client: TestClient, admin_token: str, tmp_path: Path, monkeypatch: Any
+) -> None:
+    """A failure after path validation is a server fault: 500, with the details only in the server log.
+
+    By that point is_dir() has already confirmed existence, so a distinct status leaks nothing new - and it
+    preserves the caller-error vs server-fault distinction for the admin and for retrying clients.
+    """
+
+    class ExplodingSearch:
+        def search(self, path: Path) -> None:
+            raise PermissionError("permission denied inside the tree")
+
+    monkeypatch.setattr("invokeai.app.api.routers.model_manager.ModelSearch", ExplodingSearch)
+
+    response = client.get(f"/api/v2/models/scan_folder?scan_path={tmp_path}", headers=_auth(admin_token))
+    assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
+    # The response must not echo the exception - details go to the server log only.
+    assert "PermissionError" not in response.text
+    assert "permission denied" not in response.text
+
+
+def test_create_image_upload_entry_requires_auth_before_the_501_stub(
+    enable_multiuser: Any, client: TestClient, user1_token: str
+) -> None:
+    """The unimplemented upload-entry endpoint must authenticate first, so that implementing it later
+    cannot silently ship an unauthenticated state-mutating route (the 401 side is in PROTECTED_ROUTES)."""
+    response = client.post(
+        "/api/v1/images/",
+        headers=_auth(user1_token),
+        json={"width": 512, "height": 512},
+    )
+    assert response.status_code == status.HTTP_501_NOT_IMPLEMENTED
+
+
+# (method, path) pairs that are deliberately public. Everything else must carry an auth dependency.
+#
+# - auth bootstrap: reachable pre-login by construction
+# - binary <img src>/thumbnail routes: browsers cannot attach a Bearer header to <img> requests; closing
+#   these needs a signed-URL or cookie scheme (tracked separately, see PR #9367)
+# - version: intentionally public
+# - docs/redoc: API documentation
+PUBLIC_ROUTES = {
+    ("GET", "/api/v1/app/version"),
+    ("POST", "/api/v1/auth/login"),
+    ("POST", "/api/v1/auth/setup"),
+    ("GET", "/api/v1/auth/status"),
+    ("GET", "/api/v1/images/i/{image_name}/full"),
+    ("HEAD", "/api/v1/images/i/{image_name}/full"),
+    ("GET", "/api/v1/images/i/{image_name}/thumbnail"),
+    ("GET", "/api/v1/workflows/i/{workflow_id}/thumbnail"),
+    ("GET", "/api/v2/models/i/{key}/image"),
+    ("GET", "/docs"),
+    ("GET", "/redoc"),
+}
+
+
+def _routes_without_auth() -> set[tuple[str, str]]:
+    """Every (method, path) in the app whose dependency tree contains no auth dependency."""
+    from fastapi.routing import APIRoute
+
+    from invokeai.app.api import auth_dependencies
+    from invokeai.app.api_app import app
+
+    auth_functions = {auth_dependencies.get_current_user, auth_dependencies.get_current_user_or_default}
+
+    def has_auth(dependant: Any) -> bool:
+        if dependant.call in auth_functions:
+            return True
+        return any(has_auth(sub) for sub in dependant.dependencies)
+
+    return {
+        (method, route.path)
+        for route in app.routes
+        if isinstance(route, APIRoute) and not has_auth(route.dependant)
+        for method in route.methods
+    }
+
+
+def test_every_route_is_authenticated_or_explicitly_public() -> None:
+    """Default-deny: a new route without an auth dependency must be a conscious, allowlisted decision.
+
+    GH #9365 happened because auth was opt-in per route and nothing failed when a route lacked it. A
+    hand-maintained list of protected routes cannot catch the next unauthenticated route; walking the app's
+    actual dependency trees can.
+    """
+    unauthenticated = _routes_without_auth()
+
+    unlisted = unauthenticated - PUBLIC_ROUTES
+    assert not unlisted, (
+        f"Routes without an auth dependency that are not on the public allowlist: {sorted(unlisted)}. "
+        "Add an auth dependency (CurrentUserOrDefault / AdminUserOrDefault), or - only for routes that must "
+        "be public - add them to PUBLIC_ROUTES with a justification."
+    )
+
+    # Keep the allowlist honest: an entry that gained auth (or disappeared) must be removed.
+    stale = PUBLIC_ROUTES - unauthenticated
+    assert not stale, f"PUBLIC_ROUTES entries that are no longer unauthenticated routes: {sorted(stale)}"
+
+
+def test_regular_user_can_still_list_models(
+    enable_multiuser: Any, client: TestClient, user1_token: str, mock_invoker: Invoker
+) -> None:
+    """Listing models is needed for ordinary generation, so it must stay available to non-admins."""
+    # model_manager is a MagicMock from the enable_multiuser fixture; give the store a real, empty result set.
+    mock_invoker.services.model_manager.store.search_by_attr.return_value = []
+
+    response = client.get("/api/v2/models/", headers=_auth(user1_token))
+    assert response.status_code == status.HTTP_200_OK
+    assert response.json() == {"models": []}
+
+
+def _sd1_checkpoint(key: str, path: str) -> Main_Checkpoint_SD1_Config:
+    return Main_Checkpoint_SD1_Config(
+        key=key,
+        path=path,
+        name=key,
+        format=ModelFormat.Checkpoint,
+        base=BaseModelType.StableDiffusion1,
+        type=ModelType.Main,
+        config_path="/tmp/foo.yaml",
+        variant=ModelVariantType.Normal,
+        hash="111222333444",
+        file_size=8192,
+        source=path,
+        source_type=ModelSourceType.Path,
+        prediction_type=SchedulerPredictionType.Epsilon,
+    )
+
+
+def test_non_admin_can_filter_out_missing_models(
+    enable_multiuser: Any,
+    client: TestClient,
+    user1_token: str,
+    mock_invoker: Invoker,
+    tmp_path: Path,
+    monkeypatch: Any,
+) -> None:
+    """A non-admin must be able to read `/missing`, or missing models stay in their generation dropdowns.
+
+    The frontend's model hooks (`modelsByType.ts`) subtract `/missing` from `/`. If `/missing` 403s the
+    subtraction silently becomes a no-op and every missing model is offered for selection, failing only
+    when execution tries to load its absent files.
+    """
+    (tmp_path / "present.ckpt").write_text("weights")
+    present = _sd1_checkpoint("present-key", "present.ckpt")
+    absent = _sd1_checkpoint("absent-key", "absent.ckpt")
+
+    # models_path is a read-only derived property, so patch it on the class for the duration of the test.
+    monkeypatch.setattr(InvokeAIAppConfig, "models_path", property(lambda _self: tmp_path))
+    mock_invoker.services.model_images = MagicMock()
+    mock_invoker.services.model_manager.store.all_models.return_value = [present, absent]
+    mock_invoker.services.model_manager.store.search_by_attr.return_value = [present, absent]
+
+    missing = client.get("/api/v2/models/missing", headers=_auth(user1_token))
+    assert missing.status_code == status.HTTP_200_OK
+    missing_keys = {m["key"] for m in missing.json()["models"]}
+    assert missing_keys == {"absent-key"}
+
+    all_models = client.get("/api/v2/models/", headers=_auth(user1_token))
+    assert all_models.status_code == status.HTTP_200_OK
+
+    # This mirrors what the frontend hooks do with the two responses.
+    selectable = {m["key"] for m in all_models.json()["models"]} - missing_keys
+    assert selectable == {"present-key"}
+
+
+def test_runtime_config_redacts_secrets() -> None:
+    """API keys and download bearer tokens must never be serialized to a client."""
+    from invokeai.app.api.routers.app_info import REDACTED_SECRET, _redact_config_secrets
+
+    config = InvokeAIAppConfig(
+        external_openai_api_key="sk-super-secret",
+        external_gemini_base_url="https://example.invalid",
+        remote_api_tokens=[URLRegexTokenPair(url_regex="example.com", token="bearer-secret")],
+        download_proxy="http://proxy-user:proxy-secret@proxy.example:3128",
+    )
+    redacted = _redact_config_secrets(config)
+
+    assert redacted.external_openai_api_key == REDACTED_SECRET
+    assert redacted.remote_api_tokens is not None
+    assert redacted.remote_api_tokens[0].token == REDACTED_SECRET
+    # Non-secret fields are untouched, and the original config is not mutated.
+    assert redacted.remote_api_tokens[0].url_regex == "example.com"
+    assert redacted.external_gemini_base_url == "https://example.invalid"
+    assert redacted.download_proxy == REDACTED_SECRET
+    assert config.external_openai_api_key == "sk-super-secret"
+    assert config.remote_api_tokens is not None
+    assert config.remote_api_tokens[0].token == "bearer-secret"
+    assert config.download_proxy == "http://proxy-user:proxy-secret@proxy.example:3128"
+
+
+def test_runtime_config_response_has_no_secrets(
+    enable_multiuser: Any, client: TestClient, admin_token: str, monkeypatch: Any
+) -> None:
+    """End-to-end: even an admin's browser never receives the raw credentials."""
+    config = InvokeAIAppConfig(
+        external_openai_api_key="sk-super-secret",
+        remote_api_tokens=[URLRegexTokenPair(url_regex="example.com", token="bearer-secret")],
+    )
+    monkeypatch.setattr("invokeai.app.api.routers.app_info.get_config", lambda: config)
+
+    response = client.get("/api/v1/app/runtime_config", headers=_auth(admin_token))
+    assert response.status_code == status.HTTP_200_OK
+    assert "sk-super-secret" not in response.text
+    assert "bearer-secret" not in response.text
+
+
+def test_runtime_config_patch_response_has_no_secrets(
+    enable_multiuser: Any, client: TestClient, admin_token: str, monkeypatch: Any, tmp_path: Path
+) -> None:
+    """PATCH echoes the updated config back, so it must redact exactly as GET does.
+
+    Otherwise an admin changing an unrelated setting pulls the raw credentials into the browser's
+    RTK Query cache, defeating the server-side masking on GET.
+    """
+    config = InvokeAIAppConfig(
+        external_openai_api_key="sk-super-secret",
+        remote_api_tokens=[URLRegexTokenPair(url_regex="example.com", token="bearer-secret")],
+    )
+    config._config_file = tmp_path / "invokeai.yaml"
+    monkeypatch.setattr("invokeai.app.api.routers.app_info.get_config", lambda: config)
+
+    response = client.patch("/api/v1/app/runtime_config", json={"max_queue_history": 5}, headers=_auth(admin_token))
+    assert response.status_code == status.HTTP_200_OK
+    assert response.json()["config"]["max_queue_history"] == 5
+    assert "sk-super-secret" not in response.text
+    assert "bearer-secret" not in response.text
+    # The in-memory config itself must keep the real values - masking is response-only.
+    assert config.external_openai_api_key == "sk-super-secret"
diff --git a/tests/app/services/download/test_download_queue.py b/tests/app/services/download/test_download_queue.py
index edf3c115ac4..14d400aece0 100644
--- a/tests/app/services/download/test_download_queue.py
+++ b/tests/app/services/download/test_download_queue.py
@@ -5,13 +5,15 @@
 from contextlib import contextmanager
 from pathlib import Path
 from typing import Any, Generator, Optional
+from unittest.mock import MagicMock, patch
 
 import pytest
 from pydantic.networks import AnyHttpUrl
+from requests import Response
 from requests.sessions import Session
-from requests_testadapter import TestAdapter
+from requests_testadapter import TestAdapter, TestSession
 
-from invokeai.app.services.config import get_config
+from invokeai.app.services.config import InvokeAIAppConfig, get_config
 from invokeai.app.services.config.config_default import URLRegexTokenPair
 from invokeai.app.services.download import DownloadJob, DownloadJobStatus, DownloadQueueService, MultiFileDownloadJob
 from invokeai.app.services.events.events_common import (
@@ -21,6 +23,8 @@
     DownloadProgressEvent,
     DownloadStartedEvent,
 )
+from invokeai.app.util import ssrf
+from invokeai.app.util.ssrf import UnsafeDownloadURLException
 from invokeai.backend.model_manager.metadata import HuggingFaceMetadataFetch, ModelMetadataWithFiles, RemoteModelFile
 from tests.test_nodes import TestEventService
 
@@ -355,3 +359,182 @@ def test_tokens(tmp_path: Path, mm2_session: Session):
         assert job1.access_token == "cv_12345"
         assert job2.access_token is None
         queue.stop()
+
+
+# ---------------- Advisory regression: SSRF guard in the download worker ----------------
+
+
+def test_production_queue_uses_guarded_session_by_default() -> None:
+    queue = DownloadQueueService(app_config=InvokeAIAppConfig(allow_private_download_urls=False))
+    try:
+        assert isinstance(queue._requests.get_adapter("https://example.com"), ssrf.SsrfGuardedAdapter)
+        assert queue._requests.trust_env is True
+    finally:
+        queue._requests.close()
+
+
+def test_production_queue_allows_explicit_private_download_opt_in() -> None:
+    queue = DownloadQueueService(app_config=InvokeAIAppConfig(allow_private_download_urls=True))
+    try:
+        assert not isinstance(queue._requests.get_adapter("https://example.com"), ssrf.SsrfGuardedAdapter)
+    finally:
+        queue._requests.close()
+
+
+def test_production_queue_accepts_explicit_download_proxy() -> None:
+    queue = DownloadQueueService(
+        app_config=InvokeAIAppConfig(
+            allow_private_download_urls=False,
+            download_proxy="http://proxy.internal:3128",
+        )
+    )
+    try:
+        assert ssrf.proxies_in_effect(queue._requests) == {
+            "http": "http://proxy.internal:3128",
+            "https": "http://proxy.internal:3128",
+        }
+    finally:
+        queue._requests.close()
+
+
+def test_private_opt_in_still_honors_explicit_download_proxy(monkeypatch: Any) -> None:
+    """allow_private_download_urls=True must not silently drop an explicitly configured
+    download_proxy: the two settings are independent. The proxy is applied at request
+    level because that is the only level that beats ambient *_PROXY variables in a
+    plain (unguarded) Session."""
+    monkeypatch.setenv("HTTP_PROXY", "http://ambient.invalid:9")
+    monkeypatch.setenv("HTTPS_PROXY", "http://ambient.invalid:9")
+    queue = DownloadQueueService(
+        app_config=InvokeAIAppConfig(
+            allow_private_download_urls=True,
+            download_proxy="http://proxy.internal:3128",
+        )
+    )
+    try:
+        assert queue._request_proxies == {
+            "http": "http://proxy.internal:3128",
+            "https": "http://proxy.internal:3128",
+        }
+        # The explicit proxy must win over the ambient variables in requests' merge order.
+        merged = queue._requests.merge_environment_settings(
+            "https://example.com/x", queue._request_proxies, None, None, None
+        )
+        assert merged["proxies"]["https"] == "http://proxy.internal:3128"
+    finally:
+        queue._requests.close()
+
+
+@pytest.mark.timeout(timeout=10, method="thread")
+def test_download_refuses_non_public_source(tmp_path: Path) -> None:
+    """A job whose source points at loopback errors out without issuing the request."""
+    source = AnyHttpUrl("http://127.0.0.1:19191/proof.txt")
+    session = TestSession()
+    session.mount(str(source), TestAdapter(b"secret", status=200))
+
+    queue = DownloadQueueService(requests_session=session)
+    queue.start()
+    try:
+        job = queue.download(source=source, dest=tmp_path)
+        queue.join()
+    finally:
+        queue.stop()
+
+    assert job.status == DownloadJobStatus.ERROR
+    assert "UnsafeDownloadURLException" in (job.error_type or "")
+    assert not any(tmp_path.iterdir())
+
+
+@pytest.mark.timeout(timeout=10, method="thread")
+def test_download_refuses_redirect_to_non_public_address(tmp_path: Path) -> None:
+    """A public URL must not be able to bounce the worker onto a private address."""
+    source = AnyHttpUrl("https://test.com/redirector")
+    session = TestSession()
+    session.mount(
+        str(source),
+        TestAdapter(b"", status=302, headers={"Location": "http://169.254.169.254/latest/meta-data/"}),
+    )
+    session.mount("http://169.254.169.254/", TestAdapter(b"cloud-credentials", status=200))
+
+    queue = DownloadQueueService(requests_session=session)
+    queue.start()
+    try:
+        job = queue.download(source=source, dest=tmp_path)
+        queue.join()
+    finally:
+        queue.stop()
+
+    assert job.status == DownloadJobStatus.ERROR
+    assert "UnsafeDownloadURLException" in (job.error_type or "")
+    assert not any(tmp_path.iterdir())
+
+
+def test_rejected_redirect_closes_streamed_response() -> None:
+    queue = DownloadQueueService(requests_session=TestSession())
+    response = Response()
+    response.status_code = 302
+    response.url = "https://public.example/redirect"
+    response.headers["Location"] = "http://127.0.0.1/private"
+    response.raw = MagicMock()
+
+    with pytest.raises(UnsafeDownloadURLException):
+        queue._reject_unsafe_redirect(response)
+
+    response.raw.close.assert_called_once()
+
+
+@pytest.mark.timeout(timeout=10, method="thread")
+def test_download_refuses_multi_hop_redirect_to_non_public_address(tmp_path: Path) -> None:
+    """Every redirect response must be checked, not only the first hop."""
+    source = AnyHttpUrl("https://test.com/redirector-1")
+    second_hop = "https://test.com/redirector-2"
+    session = TestSession()
+    session.mount(
+        str(source),
+        TestAdapter(b"", status=302, headers={"Location": second_hop}),
+    )
+    session.mount(
+        second_hop,
+        TestAdapter(b"", status=302, headers={"Location": "http://169.254.169.254/latest/meta-data/"}),
+    )
+
+    queue = DownloadQueueService(requests_session=session)
+    queue.start()
+    try:
+        job = queue.download(source=source, dest=tmp_path)
+        queue.join()
+    finally:
+        queue.stop()
+
+    assert job.status == DownloadJobStatus.ERROR
+    assert "UnsafeDownloadURLException" in (job.error_type or "")
+    assert not any(tmp_path.iterdir())
+
+
+@pytest.mark.timeout(timeout=10, method="thread")
+def test_download_allows_non_public_source_when_opted_in(tmp_path: Path) -> None:
+    source = AnyHttpUrl("http://127.0.0.1:19191/mirror.safetensors")
+    session = TestSession()
+    session.mount(str(source), TestAdapter(b"model-bytes", status=200))
+
+    config = get_config()
+    with patch.object(config, "allow_private_download_urls", True):
+        queue = DownloadQueueService(app_config=config, requests_session=session)
+        queue.start()
+        try:
+            job = queue.download(source=source, dest=tmp_path / "mirror.safetensors")
+            queue.join()
+        finally:
+            queue.stop()
+
+    assert job.status == DownloadJobStatus.COMPLETED
+    assert (tmp_path / "mirror.safetensors").read_bytes() == b"model-bytes"
+
+
+@pytest.mark.parametrize(
+    "filename",
+    ["../evil", "..\\evil", "sub/evil", "sub\\evil", "C:\\evil", "C:evil", "/evil", ".", "..", ""],
+)
+def test_content_disposition_filename_must_be_one_safe_component(filename: str) -> None:
+    """The remote server picks this name; it must never be able to leave `dest`."""
+    queue = DownloadQueueService()
+    assert queue._validate_filename("/tmp", filename) is False
diff --git a/tests/app/services/model_install/test_model_install.py b/tests/app/services/model_install/test_model_install.py
index 4ce779aff51..07271df28b8 100644
--- a/tests/app/services/model_install/test_model_install.py
+++ b/tests/app/services/model_install/test_model_install.py
@@ -9,6 +9,7 @@
 import time
 import uuid
 from pathlib import Path
+from types import SimpleNamespace
 from typing import Any, Dict
 
 import pytest
@@ -323,6 +324,56 @@ def test_simple_download(mm2_installer: ModelInstallServiceBase, mm2_app_config:
     assert isinstance(bus.events[4], ModelInstallCompleteEvent)  # install completed
 
 
+@pytest.mark.timeout(timeout=10, method="thread")
+def test_wait_for_installs_waits_for_download_completion_to_enqueue_install(
+    mm2_installer: ModelInstallServiceBase, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Do not report all installs done between download-cache removal and install enqueue."""
+    assert isinstance(mm2_installer, ModelInstallService)
+    job = ModelInstallJob(
+        id=123,
+        source=URLModelSource(url=Url("https://www.test.foo/download/test_embedding.safetensors")),
+        local_path=tmp_path,
+    )
+    with mm2_installer._lock:
+        mm2_installer._download_cache[job.id] = job
+    monkeypatch.setattr(mm2_installer, "_signal_job_downloads_done", lambda install_job: None)
+    mm2_installer._wait_for_restore_complete()
+
+    wait_finished = threading.Event()
+
+    def wait_for_installs() -> None:
+        mm2_installer.wait_for_installs(timeout=2)
+        wait_finished.set()
+
+    wait_thread = threading.Thread(target=wait_for_installs)
+    wait_thread.start()
+
+    enqueue_started = threading.Event()
+    release_enqueue = threading.Event()
+
+    def blocked_enqueue(install_job: ModelInstallJob) -> None:
+        assert install_job is job
+        enqueue_started.set()
+        assert release_enqueue.wait(timeout=2)
+
+    monkeypatch.setattr(mm2_installer, "_put_in_queue", blocked_enqueue)
+    callback_thread = threading.Thread(
+        target=mm2_installer._download_complete_callback,
+        args=(SimpleNamespace(id=job.id),),
+    )
+    callback_thread.start()
+    assert enqueue_started.wait(timeout=2)
+    assert not wait_finished.wait(timeout=0.5)
+
+    release_enqueue.set()
+    callback_thread.join(timeout=2)
+    wait_thread.join(timeout=2)
+    assert not callback_thread.is_alive()
+    assert not wait_thread.is_alive()
+    assert wait_finished.is_set()
+
+
 def test_import_waits_for_startup_restore(
     mm2_app_config: InvokeAIAppConfig,
     mm2_record_store,
diff --git a/tests/app/test_invocation_event_socketio.py b/tests/app/test_invocation_event_socketio.py
new file mode 100644
index 00000000000..2ddbc280817
--- /dev/null
+++ b/tests/app/test_invocation_event_socketio.py
@@ -0,0 +1,133 @@
+"""Tests for socket routing of model and download events in multiuser mode.
+
+Model install and download events carry the source URL and the server-side path a file is
+being written to, so they are routed to the admin room rather than broadcast. Model load
+events carry neither and drive the loading-models spinner in every client, so they stay
+broadcast.
+"""
+
+from unittest.mock import AsyncMock
+
+import pytest
+from fastapi import FastAPI
+from pydantic.networks import AnyHttpUrl
+
+from invokeai.app.api.sockets import SocketIO
+from invokeai.app.services.events.events_common import (
+    DownloadStartedEvent,
+    ModelInstallStartedEvent,
+)
+from invokeai.app.services.model_install.model_install_common import URLModelSource
+
+
+@pytest.fixture
+def anyio_backend() -> str:
+    return "asyncio"
+
+
+def _make_model_config():
+    from invokeai.backend.model_manager.configs.factory import AnyModelConfigValidator
+
+    return AnyModelConfigValidator.validate_python(
+        {
+            "key": "model-key-1",
+            "hash": "hash-1",
+            "path": "/models/some-model",
+            "name": "some-model",
+            "base": "sd-1",
+            "type": "vae",
+            "format": "diffusers",
+            "source": "/models/some-model",
+            "source_type": "path",
+            "file_size": 1024,
+        }
+    )
+
+
+@pytest.mark.anyio
+async def test_model_load_events_remain_broadcast() -> None:
+    from invokeai.app.services.events.events_common import ModelLoadCompleteEvent, ModelLoadStartedEvent
+
+    socketio = SocketIO(FastAPI())
+    socketio._sio.emit = AsyncMock()
+
+    config = _make_model_config()
+    started = ModelLoadStartedEvent.build(config)
+    complete = ModelLoadCompleteEvent.build(config)
+
+    await socketio._handle_model_event(("model_load_started", started))
+    await socketio._handle_model_event(("model_load_complete", complete))
+
+    socketio._sio.emit.assert_any_await(event="model_load_started", data=started.model_dump(mode="json"))
+    socketio._sio.emit.assert_any_await(event="model_load_complete", data=complete.model_dump(mode="json"))
+    assert socketio._sio.emit.await_count == 2
+
+
+def _download_event() -> DownloadStartedEvent:
+    return DownloadStartedEvent(source="https://example.com/model", download_path="/cache/model")
+
+
+def _install_event() -> ModelInstallStartedEvent:
+    return ModelInstallStartedEvent(id=1, source=URLModelSource(url=AnyHttpUrl("https://example.com/model")))
+
+
+@pytest.mark.anyio
+async def test_download_and_model_install_events_are_admin_only() -> None:
+    socketio = SocketIO(FastAPI())
+    socketio._sio.emit = AsyncMock()
+    socketio._socket_users = {
+        "admin-sid": {"user_id": "admin-1", "is_admin": True},
+        "user-sid": {"user_id": "user-1", "is_admin": False},
+    }
+
+    download_event = _download_event()
+    install_event = _install_event()
+
+    await socketio._handle_model_event(("download_started", download_event))
+    await socketio._handle_model_event(("model_install_started", install_event))
+
+    socketio._sio.emit.assert_any_await(
+        event="download_started", data=download_event.model_dump(mode="json"), to=["admin-sid"]
+    )
+    socketio._sio.emit.assert_any_await(
+        event="model_install_started", data=install_event.model_dump(mode="json"), to=["admin-sid"]
+    )
+    assert socketio._sio.emit.await_count == 2
+
+
+@pytest.mark.anyio
+async def test_admin_receives_install_events_before_subscribing_to_a_queue() -> None:
+    """The "admin" room is only entered on queue subscription.
+
+    A socket that has connected but not yet sent `subscribe_queue` is in no rooms, so
+    addressing these events to the room would drop them for the whole connect/subscribe
+    window - and permanently for any client that never subscribes.
+    """
+    socketio = SocketIO(FastAPI())
+    socketio._sio.emit = AsyncMock()
+    socketio._sio.enter_room = AsyncMock()
+    # State after _handle_connect only: user info recorded, no rooms joined.
+    socketio._socket_users = {"admin-sid": {"user_id": "admin-1", "is_admin": True}}
+
+    event = _install_event()
+    await socketio._handle_model_event(("model_install_started", event))
+
+    socketio._sio.emit.assert_awaited_once_with(
+        event="model_install_started", data=event.model_dump(mode="json"), to=["admin-sid"]
+    )
+    socketio._sio.enter_room.assert_not_awaited()
+
+
+@pytest.mark.anyio
+async def test_install_events_are_dropped_when_no_admin_is_connected() -> None:
+    """An empty recipient list must not fall through to a broadcast.
+
+    python-socketio indexes `room[0]` for a list, so passing `[]` would also raise.
+    """
+    socketio = SocketIO(FastAPI())
+    socketio._sio.emit = AsyncMock()
+    socketio._socket_users = {"user-sid": {"user_id": "user-1", "is_admin": False}}
+
+    await socketio._handle_model_event(("model_install_started", _install_event()))
+
+    socketio._sio.emit.assert_not_awaited()
diff --git a/tests/app/util/test_ssrf.py b/tests/app/util/test_ssrf.py
new file mode 100644
index 00000000000..4cd5f82df7e
--- /dev/null
+++ b/tests/app/util/test_ssrf.py
@@ -0,0 +1,346 @@
+"""Unit tests for the download-URL SSRF guard."""
+
+import http.server
+import ipaddress
+import logging
+import threading
+from typing import Any, Generator
+
+import pytest
+import requests
+from requests import Request
+from requests.models import PreparedRequest
+from requests.utils import select_proxy
+
+from invokeai.app.util import ssrf
+from invokeai.app.util.ssrf import UnsafeDownloadURLException, build_guarded_session, validate_download_url
+
+
+@pytest.fixture
+def fake_dns(monkeypatch: Any):
+    """Resolve hostnames from a table so the tests never touch a real resolver."""
+    table: dict[str, list[str]] = {}
+
+    def _resolve(host: str, port: int | None):
+        if host not in table:
+            raise OSError(f"no fake DNS record for {host}")
+        return [ipaddress.ip_address(a) for a in table[host]]
+
+    monkeypatch.setattr(ssrf, "_resolve", _resolve)
+    return table
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "http://127.0.0.1/x",
+        "http://127.1.2.3/x",
+        "https://10.0.0.1/x",
+        "http://172.16.4.5/x",
+        "http://192.168.1.1/x",
+        "http://169.254.169.254/latest/meta-data/",  # cloud metadata
+        "http://0.0.0.0/x",
+        "http://[::1]/x",
+        "http://[fe80::1]/x",
+        "http://[fc00::1]/x",
+        "http://[::ffff:127.0.0.1]/x",  # IPv4-mapped loopback
+        "http://[::ffff:10.0.0.1]/x",
+        "http://[2002:7f00:0001::]/x",  # 6to4-wrapped 127.0.0.1
+        "http://0177.0.0.1/x",  # legacy octal IPv4 literal for 127.0.0.1
+        "http://0177.0.0.1./x",  # trailing-dot legacy octal literal
+        "http://2130706433/x",  # integer literal
+        "http://100.64.0.1/x",  # RFC 6598 shared address space -- not is_private
+        "http://198.18.0.1/x",  # benchmarking range -- not is_reserved
+        # `requests` percent-decodes unreserved characters in the host before connecting,
+        # so these reach loopback / the metadata service.
+        "http://127%2e0%2e0%2e1/x",
+        "http://169.254.169%2e254/latest/meta-data/",
+        "http://%31%30.0.0.5/x",
+        # IPv6 wrappers that reach an IPv4 destination. These are all `is_global == True`,
+        # so a "not is_global" test on its own lets them through.
+        "http://[64:ff9b::a9fe:a9fe]/latest/meta-data/",  # NAT64 for 169.254.169.254
+        "http://[64:ff9b::a00:1]/x",  # NAT64 for 10.0.0.1
+        "http://[64:ff9b:1::7f00:1]/x",  # NAT64 local-use prefix for 127.0.0.1
+        "http://[::127.0.0.1]/x",  # IPv4-compatible loopback
+        "http://[5f00::1]/x",  # unallocated
+        "http://[ff02::1]/x",  # link-local all-nodes multicast
+        # Teredo: the embedded client is public, but the wrapper itself is not global.
+        "http://[2001:0:53aa:64c:0:5bfe:5f00:1]/x",
+    ],
+)
+def test_rejects_non_public_addresses(url: str):
+    with pytest.raises(UnsafeDownloadURLException):
+        validate_download_url(url)
+
+
+@pytest.mark.parametrize(
+    "url",
+    ["http://93.184.216.34/x", "https://8.8.8.8/x", "http://[2606:4700:4700::1111]/x"],
+)
+def test_allows_public_literals(url: str):
+    validate_download_url(url)
+
+
+def test_allows_public_ipv4_mapped_ipv6_literal():
+    validate_download_url("http://[::ffff:8.8.8.8]/x")
+
+
+def test_rejects_invalid_port_before_dns():
+    with pytest.raises(UnsafeDownloadURLException, match="invalid port"):
+        validate_download_url("http://example.com:65536/x")
+
+
+def test_rejects_hostname_resolving_to_loopback(fake_dns: dict[str, list[str]]):
+    fake_dns["localtest.me"] = ["127.0.0.1"]
+    with pytest.raises(UnsafeDownloadURLException):
+        validate_download_url("http://localtest.me/x")
+
+
+@pytest.mark.parametrize("host", ["0177.0.0.1", "0177.0.0.1.", "2130706433", "0x7f000001", "127.0.0.1."])
+def test_rejects_legacy_ipv4_literal_without_dns(monkeypatch: Any, host: str):
+    """Legacy numeric IPv4 spellings must not depend on resolver normalization."""
+
+    def fail_resolve(host: str, port: int | None) -> list[ipaddress.IPv4Address]:
+        raise AssertionError(f"unexpected DNS lookup for numeric host {host}")
+
+    monkeypatch.setattr(ssrf, "_resolve", fail_resolve)
+    with pytest.raises(UnsafeDownloadURLException):
+        validate_download_url(f"http://{host}/x")
+
+
+def test_rejects_hostname_with_any_non_public_record(fake_dns: dict[str, list[str]]):
+    """A split-horizon name must not slip through on the strength of its public record."""
+    fake_dns["mixed.example.com"] = ["93.184.216.34", "127.0.0.1"]
+    with pytest.raises(UnsafeDownloadURLException):
+        validate_download_url("http://mixed.example.com/x")
+
+
+def test_blocked_address_error_hides_resolved_ip(fake_dns: dict[str, list[str]], caplog: Any):
+    fake_dns["private.example.com"] = ["10.0.0.7"]
+    with pytest.raises(UnsafeDownloadURLException) as excinfo:
+        validate_download_url("http://private.example.com/x")
+
+    assert "10.0.0.7" not in str(excinfo.value)
+    assert "10.0.0.7" in caplog.text
+
+
+def test_allows_hostname_resolving_to_public_address(fake_dns: dict[str, list[str]]):
+    fake_dns["cdn.example.com"] = ["93.184.216.34", "2606:4700:4700::1111"]
+    validate_download_url("http://cdn.example.com/x")
+
+
+def test_unresolvable_host_is_left_to_the_http_client(fake_dns: dict[str, list[str]]):
+    """We share a resolver with `requests`; if we cannot resolve it, neither can it."""
+    validate_download_url("http://no-such-host.invalid/x")
+
+
+@pytest.mark.parametrize("url", ["file:///etc/passwd", "ftp://example.com/x", "gopher://example.com/x"])
+def test_rejects_non_http_schemes(url: str):
+    with pytest.raises(UnsafeDownloadURLException):
+        validate_download_url(url)
+
+
+def test_opt_in_allows_private_addresses():
+    validate_download_url("http://127.0.0.1/x", allow_private_urls=True)
+
+
+def test_opt_in_still_rejects_bad_schemes():
+    with pytest.raises(UnsafeDownloadURLException):
+        validate_download_url("file:///etc/passwd", allow_private_urls=True)
+
+
+# --------------- Socket-level guard: the check that survives rebinding ---------------
+
+
+class _Handler(http.server.BaseHTTPRequestHandler):
+    def do_GET(self):  # noqa: N802
+        body = b"internal-only"
+        self.send_response(200)
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, *args):
+        pass
+
+
+@pytest.fixture
+def loopback_server() -> Generator[int, None, None]:
+    srv = http.server.HTTPServer(("127.0.0.1", 0), _Handler)
+    threading.Thread(target=srv.serve_forever, daemon=True).start()
+    try:
+        yield srv.server_address[1]
+    finally:
+        srv.shutdown()
+
+
+def _unsafe_in_chain(exc: BaseException) -> bool:
+    seen = exc
+    while seen is not None:
+        if isinstance(seen, UnsafeDownloadURLException):
+            return True
+        seen = seen.__cause__ or seen.__context__
+    return False
+
+
+def test_guarded_session_refuses_loopback(loopback_server: int):
+    session = build_guarded_session()
+    with pytest.raises(Exception) as excinfo:
+        session.get(f"http://127.0.0.1:{loopback_server}/x", timeout=5)
+    assert _unsafe_in_chain(excinfo.value)
+
+
+def test_guarded_session_blocks_dns_rebinding(loopback_server: int, monkeypatch: Any):
+    """The up-front check sees a public record; the socket still lands on loopback.
+
+    An attacker who controls the zone can answer our lookup and the HTTP client's lookup
+    differently, so only the connected-socket check can catch this.
+    """
+    monkeypatch.setattr(ssrf, "_resolve", lambda host, port: [ipaddress.ip_address("93.184.216.34")])
+
+    url = f"http://localhost:{loopback_server}/x"
+    validate_download_url(url)  # up-front check is fooled, by construction
+
+    session = build_guarded_session()
+    with pytest.raises(Exception) as excinfo:
+        session.get(url, timeout=5)
+    assert _unsafe_in_chain(excinfo.value)
+
+
+def test_guarded_session_blocks_percent_encoded_host(loopback_server: int, monkeypatch: Any):
+    """Even with the up-front check disabled, `%6cocalhost` cannot reach loopback."""
+    monkeypatch.setattr(ssrf, "_host_spellings", lambda host: [host])
+    url = f"http://%6cocalhost:{loopback_server}/x"
+    validate_download_url(url)  # unresolvable as spelled -> fails open, by construction
+
+    session = build_guarded_session()
+    with pytest.raises(Exception) as excinfo:
+        session.get(url, timeout=5)
+    assert _unsafe_in_chain(excinfo.value)
+
+
+def test_guarded_session_is_installed_for_both_schemes():
+    session = build_guarded_session()
+    for prefix in ("http://", "https://"):
+        adapter = session.get_adapter(prefix + "example.com")
+        assert isinstance(adapter, ssrf.SsrfGuardedAdapter)
+        assert adapter.poolmanager.pool_classes_by_scheme["http"] is ssrf._GuardedHTTPConnectionPool
+        assert adapter.poolmanager.pool_classes_by_scheme["https"] is ssrf._GuardedHTTPSConnectionPool
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "http://100.63.255.255/x",  # just below the shared address space
+        "http://100.128.0.1/x",  # just above it
+        "http://[2606:4700:4700::1111]/x",
+    ],
+)
+def test_public_neighbours_of_blocked_ranges_still_allowed(url: str):
+    """The `is_global` tightening must not spill over into genuinely public space."""
+    validate_download_url(url)
+
+
+# ----------------------------- Proxy visibility -----------------------------
+
+
+def test_guarded_session_ignores_environment_proxy(monkeypatch: Any, caplog: Any):
+    """Ambient proxies must not move destination resolution outside the socket guard."""
+    monkeypatch.setenv("HTTP_PROXY", "http://proxy.internal:3128")
+    session = build_guarded_session()
+    assert session.trust_env is True
+    assert ssrf.proxies_in_effect(session) == {}
+    assert session.merge_environment_settings("https://example.com", {}, None, None, None)["proxies"] == {}
+
+    logger = logging.getLogger("test-ssrf-proxy")
+    with caplog.at_level(logging.WARNING, logger="test-ssrf-proxy"):
+        ssrf.warn_if_proxied(session, logger)
+    assert "proxy settings are ignored" in caplog.text
+
+
+def test_guarded_session_preserves_environment_ca_bundle(monkeypatch: Any):
+    ca_bundle = "/tmp/invokeai-test-ca.pem"
+    monkeypatch.setenv("REQUESTS_CA_BUNDLE", ca_bundle)
+    session = build_guarded_session()
+    settings = session.merge_environment_settings("https://example.com", {}, None, None, None)
+    assert settings["verify"] == ca_bundle
+
+
+def test_guarded_session_preserves_environment_netrc(monkeypatch: Any, tmp_path: Any):
+    netrc = tmp_path / "netrc"
+    netrc.write_text("machine example.com login netrc-user password netrc-pass\n")
+    monkeypatch.setenv("NETRC", str(netrc))
+    prepared = build_guarded_session().prepare_request(Request("GET", "https://example.com/file.bin"))
+    assert prepared.headers["Authorization"] == "Basic bmV0cmMtdXNlcjpuZXRyYy1wYXNz"
+
+
+def test_guarded_session_supports_explicit_proxy(monkeypatch: Any):
+    monkeypatch.setenv("HTTPS_PROXY", "http://ambient.internal:3128")
+    session = build_guarded_session(proxy="http://proxy.internal:3128")
+    assert ssrf.proxies_in_effect(session) == {
+        "http": "http://proxy.internal:3128",
+        "https": "http://proxy.internal:3128",
+    }
+    assert session.merge_environment_settings("https://example.com", {}, None, None, None)["proxies"] == {
+        "http": "http://proxy.internal:3128",
+        "https": "http://proxy.internal:3128",
+    }
+    request = PreparedRequest()
+    request.prepare(method="GET", url="https://example.com/file.bin")
+    assert session.rebuild_proxies(request, {}) == {}
+    assert session.rebuild_proxies(request, session.proxies) == session.proxies
+
+    captured: dict[str, Any] = {}
+
+    def capture_send(_session: requests.Session, _request: PreparedRequest, **kwargs: Any) -> None:
+        captured.update(kwargs)
+
+    monkeypatch.setattr(requests.Session, "send", capture_send)
+    session.send(request)
+    assert captured["proxies"] == session.proxies
+
+
+def test_no_warning_without_a_proxy(monkeypatch: Any, caplog: Any):
+    for var in ("HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "http_proxy", "https_proxy", "all_proxy"):
+        monkeypatch.delenv(var, raising=False)
+    session = build_guarded_session()
+    assert ssrf.proxies_in_effect(session) == {}
+
+    logger = logging.getLogger("test-ssrf-noproxy")
+    with caplog.at_level(logging.WARNING, logger="test-ssrf-noproxy"):
+        ssrf.warn_if_proxied(session, logger)
+    assert caplog.text == ""
+
+
+@pytest.mark.parametrize("var", ["ALL_PROXY", "all_proxy", "HTTP_PROXY", "http_proxy"])
+def test_proxy_detection_covers_every_env_spelling(monkeypatch: Any, var: str):
+    """`ALL_PROXY` becomes the key "all", which requests honours as a catch-all.
+
+    Filtering `getproxies()` by scheme silently missed it, so the warning did not fire in
+    the setup where it matters most.
+    """
+    for name in ("HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "http_proxy", "https_proxy", "all_proxy"):
+        monkeypatch.delenv(name, raising=False)
+    monkeypatch.setenv(var, "http://proxy.internal:3128")
+
+    session = ssrf.requests.Session()
+    detected = ssrf.proxies_in_effect(session)
+    assert detected, f"{var} was not detected"
+    assert select_proxy("http://example.com/x", detected) == "http://proxy.internal:3128"
+
+
+@pytest.mark.parametrize(
+    ("url", "blocked"),
+    [
+        ("http://[2a01:1:2:3:0:5efe:a00:1]/x", True),  # ISATAP wrapping 10.0.0.1
+        ("http://[2a01:1:2:3:200:5efe:7f00:1]/x", True),  # ISATAP wrapping 127.0.0.1
+        ("http://[2a01:1:2:3:0:5efe:5db8:d822]/x", False),  # ISATAP wrapping a public v4
+        ("http://[64:ff9b::a9fe:a9fe]/x", True),  # NAT64 WKP -- caught as ::/8 reserved
+    ],
+)
+def test_ipv6_transition_wrappers(url: str, blocked: bool):
+    if blocked:
+        with pytest.raises(UnsafeDownloadURLException):
+            validate_download_url(url)
+    else:
+        validate_download_url(url)