diff --git a/.speakeasy/out.openapi.yaml b/.speakeasy/out.openapi.yaml
index 339949af..34838b60 100644
--- a/.speakeasy/out.openapi.yaml
+++ b/.speakeasy/out.openapi.yaml
@@ -25278,10 +25278,6 @@ components:
       description: 'API key as bearer token in Authorization header'
       scheme: 'bearer'
       type: 'http'
-    bearer:
-      description: 'API key as bearer token in Authorization header'
-      scheme: 'bearer'
-      type: 'http'
 externalDocs:
   description: 'OpenRouter Documentation'
   url: 'https://openrouter.ai/docs'
@@ -33526,8 +33522,6 @@ paths:
               schema:
                 $ref: '#/components/schemas/InternalServerResponse'
           description: 'Internal Server Error - Unexpected server error'
-      security:
-        - bearer: []
       summary: 'List models filtered by user provider preferences, privacy settings, and guardrails'
       tags:
         - 'Models'
diff --git a/.speakeasy/overlays/fix-models-user-security.overlay.yaml b/.speakeasy/overlays/fix-models-user-security.overlay.yaml
new file mode 100644
index 00000000..f15a55d1
--- /dev/null
+++ b/.speakeasy/overlays/fix-models-user-security.overlay.yaml
@@ -0,0 +1,21 @@
+overlay: 1.0.0
+x-speakeasy-jsonpath: rfc9535
+info:
+  title: Use the global apiKey scheme for GET /models/user
+  version: 0.0.0
+actions:
+  # `bearer` and `apiKey` are byte-identical schemes (http/bearer, same description),
+  # but only `apiKey` is the document-level default. Because listModelsUser named the
+  # other one, global security could not be hoisted and the generator emitted a
+  # required per-operation `security=` argument on models.list_for_user() — the only
+  # method in the SDK that ignores the client-level api_key. Dropping the override
+  # lets the operation inherit `security: [apiKey]` like the other 94 operations.
+  - target: $.paths["/models/user"].get.security
+    description: Drop the per-operation bearer override so /models/user inherits global apiKey security
+    remove: true
+  # With that override gone, `bearer` has zero references left in the document.
+  # Removing it means a future monorepo sync that points an operation at `bearer`
+  # fails generation loudly instead of silently shipping a second required credential.
+  - target: $.components.securitySchemes.bearer
+    description: Remove the now-unreferenced duplicate of the apiKey security scheme
+    remove: true
diff --git a/.speakeasy/workflow.yaml b/.speakeasy/workflow.yaml
index 8e51a85a..14b95a01 100644
--- a/.speakeasy/workflow.yaml
+++ b/.speakeasy/workflow.yaml
@@ -12,6 +12,7 @@ sources:
             - location: .speakeasy/overlays/boolean-query-params.overlay.yaml
             - location: .speakeasy/overlays/fix-nullable-pagination.overlay.yaml
             - location: .speakeasy/overlays/deprecated-beta-responses-alias.overlay.yaml
+            - location: .speakeasy/overlays/fix-models-user-security.overlay.yaml
         output: .speakeasy/out.openapi.yaml
         registry:
             location: registry.speakeasyapi.dev/openrouter/sdk/open-router-chat-completions-api