diff --git a/mcp-config/sync.sh b/mcp-config/sync.sh
index d405838..50100e3 100644
--- a/mcp-config/sync.sh
+++ b/mcp-config/sync.sh
@@ -212,10 +212,21 @@ _mcp_sync_refresh() {
   #     context limit, and won't know a model can call tools). /model/info has
   #     them. Best-effort: a key still scoped to llm_api_routes 403s here, and
   #     we fall back to names-only, exactly as before.
+  # VERSIONED PATH FIRST. LiteLLM serves this metadata at both /model/info and
+  # /v1/model/info, but a virtual key's allowed_routes is matched on the exact
+  # path — granting "/v1/model/info" does NOT also grant "/model/info". Since
+  # MCP_SYNC_GATEWAY has no /v1 suffix, the unversioned path is what this used
+  # to request, so a key scoped to the versioned route still got a 403 and
+  # still silently fell back to names-only. Try both, versioned first, so it
+  # works whichever way the key is scoped.
   _info=""
   if [ -n "${LITELLM_KEY:-}" ]; then
-    _info="$(curl -fsS -m 8 -H "Authorization: Bearer $LITELLM_KEY" \
-      "$MCP_SYNC_GATEWAY/model/info" 2>/dev/null)" || _info=""
+    for _mi_path in /v1/model/info /model/info; do
+      _info="$(curl -fsS -m 8 -H "Authorization: Bearer $LITELLM_KEY" \
+        "$MCP_SYNC_GATEWAY$_mi_path" 2>/dev/null)" || _info=""
+      [ -n "$_info" ] && break
+    done
+    unset _mi_path
   fi
 
   # 3. Merge and deploy. python3 validates the base (don't clobber good config