coder · dannykopping · May 22, 2026 · May 22, 2026
diff --git a/cli/server.go b/cli/server.go
@@ -1006,26 +1006,26 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 			notificationReportGenerator := reports.NewReportGenerator(ctx, logger.Named("notifications.report_generator"), options.Database, options.NotificationsEnqueuer, quartz.NewReal())
 			defer notificationReportGenerator.Close()

-			// We use a separate coderAPICloser so the Enterprise API
-			// can have its own close functions. This is cleaner
-			// than abstracting the Coder API itself.
-			coderAPI, coderAPICloser, err := newAPI(ctx, options)
-			if err != nil {
-				return xerrors.Errorf("create coder API: %w", err)
-			}
-
-			// Runs unconditionally so operators can seed providers via
-			// env without enabling the bridge or proxy features.
+			// Seed providers before newAPI so the aibridgeproxyd inside
+			// the enterprise closure observes env-configured providers
+			// at init.
 			if err := coderd.SeedAIProvidersFromEnv(
 				ctx,
 				options.Database,
 				vals.AI.BridgeConfig,
-				options.Auditor,
 				logger.Named("aibridge.envseed"),
 			); err != nil {
 				return xerrors.Errorf("seed ai providers from env: %w", err)
 			}

+			// We use a separate coderAPICloser so the Enterprise API
+			// can have its own close functions. This is cleaner
+			// than abstracting the Coder API itself.
+			coderAPI, coderAPICloser, err := newAPI(ctx, options)
+			if err != nil {
+				return xerrors.Errorf("create coder API: %w", err)
+			}
+
 			// In-memory aibridge daemon. Registered on coderd so chatd can
 			// dispatch LLM requests via the in-process transport without
 			// crossing the gated /api/v2/aibridge HTTP route. The HTTP route

diff --git a/coderd/ai_providers_migrate.go b/coderd/ai_providers_migrate.go
@@ -15,7 +15,6 @@ import (
 	"cdr.dev/slog/v3"
 	"github.com/coder/coder/v2/aibridge"
 	aibridgeutils "github.com/coder/coder/v2/aibridge/utils"
-	"github.com/coder/coder/v2/coderd/audit"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/db2sdk"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
@@ -45,7 +44,6 @@ func SeedAIProvidersFromEnv(
 	ctx context.Context,
 	db database.Store,
 	cfg codersdk.AIBridgeConfig,
-	auditor audit.Auditor,
 	logger slog.Logger,
 ) error {
 	desired, err := providersFromEnv(ctx, cfg, logger)
@@ -178,25 +176,19 @@ func SeedAIProvidersFromEnv(
 	}

 	for _, row := range insertedProviders {
-		audit.BackgroundAudit(sysCtx, &audit.BackgroundAuditParams[database.AIProvider]{
-			Audit:  auditor,
-			Log:    logger,
-			Action: database.AuditActionCreate,
-			New:    row,
-		})
+		logger.Info(sysCtx, "env-seeded ai provider",
+			slog.F("provider_id", row.ID),
+			slog.F("name", row.Name),
+			slog.F("type", row.Type),
+			slog.F("base_url", row.BaseUrl),
+		)
 	}
 	for _, keyRow := range insertedKeys {
-		// Mask the plaintext key before it enters the audit pipeline;
-		// the audit policy on api_key relies on the masked rendering
-		// so plaintext never reaches a backend.
-		auditRow := keyRow
-		auditRow.APIKey = aibridgeutils.MaskSecret(auditRow.APIKey)
-		audit.BackgroundAudit(sysCtx, &audit.BackgroundAuditParams[database.AIProviderKey]{
-			Audit:  auditor,
-			Log:    logger,
-			Action: database.AuditActionCreate,
-			New:    auditRow,
-		})
+		logger.Info(sysCtx, "env-seeded ai provider key",
+			slog.F("key_id", keyRow.ID),
+			slog.F("provider_id", keyRow.ProviderID),
+			slog.F("api_key", aibridgeutils.MaskSecret(keyRow.APIKey)),
+		)
 	}
 	return nil
 }