@@ -50,7 +50,7 @@ const unsupportedExperimental = [
   "primary_tools",
   "continue_loop_on_deny",
 ] as const
-const unsupportedProvider = ["id", "whitelist", "blacklist"] as const
+const unsupportedProvider = ["id"] as const
 const unsupportedModel = ["release_date", "attachment", "reasoning", "temperature", "experimental"] as const
 const LegacyAutoupdate = Schema.Literals([true, false, "notify"])
 
@@ -175,6 +175,7 @@ export function normalize(input: unknown): Result {
     isRecord(input.provider) || isRecord(input.providers),
     diagnostics,
   )
+  diagnoseModelWildcardSettings(encoded.providers, diagnostics)
 
   const toolRules = migrateTools(input.tools, diagnostics)
   const permissionRules = migratePermissions(input.permission, diagnostics)
@@ -534,6 +535,8 @@ function migrateProviders(value: unknown, diagnostics: Diagnostic[]) {
   const candidates = Object.entries(value).flatMap(([name, raw]) => {
     const path = ["provider", name]
     diagnoseProviderUnsupported(raw, path, diagnostics)
+    if (name === "google-vertex-anthropic" && isRecord(raw))
+      unsupportedIfPresent(raw, "whitelist", [...path, "whitelist"], diagnostics)
     if (invalidProviderOverlays(raw, path, diagnostics)) return []
     const provider = decodeValue(ConfigProviderV1.Info, raw, path, diagnostics)
     if (provider === undefined) return []
@@ -567,6 +570,23 @@ function invalidProviderOverlays(value: unknown, path: string[], diagnostics: Di
   return headersInvalid || bodyInvalid
 }
 
+function diagnoseModelWildcardSettings(value: unknown, diagnostics: Diagnostic[]) {
+  if (!isRecord(value)) return
+  Object.entries(value).forEach(([name, provider]) => {
+    if (!isRecord(provider) || !isRecord(provider.models)) return
+    const wildcard = provider.models[ConfigProvider.ModelWildcard]
+    if (!isRecord(wildcard)) return
+    Object.keys(wildcard).forEach((key) => {
+      if (key === "disabled") return
+      diagnostics.push({
+        kind: "unsupported",
+        path: ["providers", name, "models", ConfigProvider.ModelWildcard, key],
+        message: "ignored setting not supported on the model wildcard",
+      })
+    })
+  })
+}
+
 function diagnoseProviderUnsupported(value: unknown, path: string[], diagnostics: Diagnostic[]) {
   if (!isRecord(value)) return
   unsupportedProvider.forEach((key) => unsupportedIfPresent(value, key, [...path, key], diagnostics))
 
@@ -74,8 +74,10 @@ export const Plugin = define({
         })
         const definitions = new Map<string, { readonly inherit: boolean; readonly base?: Model.Info }>()
         for (const [id, config] of Object.entries(item.models ?? {})) {
+          if (id === ConfigProvider.ModelWildcard) continue
           const base = source?.models.get(config.modelID ?? id) ?? source?.models.get(id)
           const inherit = changed || !current?.models.has(id)
+          if (!base && !current?.models.has(id) && isToggleOnly(config)) continue
           // Bind the source at this point in the provider fold. Later source edits/removal
           // and its credential availability must not change an already-defined alias.
           definitions.set(id, { inherit, base: base && structuredClone(base) })
@@ -99,8 +101,16 @@ export const Plugin = define({
       if (configuredDefault !== undefined) models.default.set(configuredDefault.providerID, configuredDefault.model)
       for (const [item, definition] of sources.models) {
         const providerID = definition.providerID
+        const wildcard = item.models?.[ConfigProvider.ModelWildcard]
+        if (wildcard?.disabled !== undefined)
+          for (const model of models.list(providerID))
+            models.update(providerID, model.id, (draft) => {
+              draft.enabled = !wildcard.disabled
+            })
         for (const [id, config] of Object.entries(item.models ?? {})) {
+          if (id === ConfigProvider.ModelWildcard) continue
           const source = definition.models.get(id)
+          if (!source?.base && !models.get(providerID, id) && isToggleOnly(config)) continue
           const inherit = source?.inherit || !models.get(providerID, id)
           models.update(providerID, id, (model) => {
             if (inherit && source?.base) {
@@ -163,6 +173,13 @@ export const Plugin = define({
   }),
 })
 
+function isToggleOnly(config: { readonly disabled?: boolean }) {
+  return (
+    config.disabled !== undefined &&
+    Object.entries(config).every(([key, value]) => key === "disabled" || value === undefined)
+  )
+}
+
 function configuredProviders(entries: readonly Entry[]) {
   return entries
     .filter((entry): entry is Document => entry.type === "document")
 
@@ -274,6 +274,7 @@ export const OpencodePlugin = define<HttpClient.HttpClient | Bus.Service | Manag
         })
 
         for (const [modelID, config] of Object.entries(item.models ?? {})) {
+          if (modelID === ConfigProvider.ModelWildcard) continue
           const base = source?.models.get(config.modelID ?? modelID) ?? source?.models.get(modelID)
           providers.models.update(providerID, modelID, (model) => {
             Object.assign(model, structuredClone(base ?? model))
 
@@ -1,6 +1,7 @@
 export * as ConfigMigrateV1 from "./migrate.js"
 
 import { ConfigAgent } from "@opencode/schema/config/agent"
+import { ConfigProvider } from "@opencode/schema/config/provider"
 import { Schema } from "effect"
 import { ConfigAgentV1 } from "./agent.js"
 import { ConfigCommandV1 } from "./command.js"
@@ -118,12 +119,30 @@ function migrateStandardProvider(info: ConfigProviderV1.Info) {
     settings: info.api ? { ...options.settings, baseURL: info.api } : info.options ? options.settings : undefined,
     headers: info.options && options.headers,
     body: info.options && options.body,
-    models:
-      info.models &&
-      Object.fromEntries(Object.entries(info.models).map(([name, model]) => [name, migrateModel(model)])),
+    models: withModelFilters(migrateModels(info), info),
   }
 }
 
+function migrateModels(info: ConfigProviderV1.Info) {
+  return (
+    info.models && Object.fromEntries(Object.entries(info.models).map(([name, model]) => [name, migrateModel(model)]))
+  )
+}
+
+function withModelFilters<Model extends { readonly disabled?: boolean }>(
+  models: Record<string, Model> | undefined,
+  filters: Pick<ConfigProviderV1.Info, "whitelist" | "blacklist">,
+) {
+  if (!filters.whitelist && !filters.blacklist) return models
+  const result: Record<string, Model | { disabled: boolean }> = { ...models }
+  if (filters.whitelist) {
+    result[ConfigProvider.ModelWildcard] = { ...result[ConfigProvider.ModelWildcard], disabled: true }
+    for (const name of filters.whitelist) result[name] = { ...result[name], disabled: false }
+  }
+  for (const name of filters.blacklist ?? []) result[name] = { ...result[name], disabled: true }
+  return result
+}
+
 function migrateAzureCognitiveServicesProvider(info: ConfigProviderV1.Info) {
   const standard = migrateStandardProvider(info)
   const migrated = {
@@ -143,19 +162,22 @@ function migrateAzureCognitiveServicesProvider(info: ConfigProviderV1.Info) {
 function migrateGoogleVertexAnthropicProvider(info: ConfigProviderV1.Info) {
   const migrated = migrateStandardProvider(info)
   const packageName = migrated.package ?? Provider.aisdk("@ai-sdk/google-vertex/anthropic")
+  const models = migrateModels(info)
   return {
     ...migrated,
     // The current Google Vertex provider includes Gemini and Claude. Keep the Anthropic SDK on Claude models
     // instead of changing the package inherited by every model on the provider.
     package: undefined,
-    models:
-      migrated.models &&
-      Object.fromEntries(
-        Object.entries(migrated.models).map(([name, model]) => [
-          name,
-          model.package ? model : { ...model, package: packageName },
-        ]),
-      ),
+    models: withModelFilters(
+      models &&
+        Object.fromEntries(
+          Object.entries(models).map(([name, model]) => [
+            name,
+            model.package ? model : { ...model, package: packageName },
+          ]),
+        ),
+      { blacklist: info.blacklist },
+    ),
   }
 }
 
 
@@ -503,6 +503,69 @@ describe("ConfigNormalize", () => {
     })
   })
 
+  test("migrates legacy provider whitelist and blacklist to model overrides", () => {
+    const result = normalized({
+      provider: {
+        allowed: { whitelist: ["first", "second"], blacklist: ["second"], models: { first: { name: "First" } } },
+        blocked: { blacklist: ["third"] },
+      },
+    })
+    expect(result.encoded.providers).toEqual({
+      allowed: {
+        models: {
+          "*": { disabled: true },
+          first: { name: "First", disabled: false },
+          second: { disabled: true },
+        },
+      },
+      blocked: { models: { third: { disabled: true } } },
+    })
+    expect(result.diagnostics).toEqual([])
+  })
+
+  test("keeps legacy Google Vertex Anthropic filters off Gemini models", () => {
+    const result = normalized({
+      provider: {
+        "google-vertex-anthropic": {
+          whitelist: ["claude"],
+          blacklist: ["claude", "missing"],
+          models: { claude: { name: "Claude" } },
+        },
+      },
+    })
+    expect(result.encoded.providers).toEqual({
+      "google-vertex": {
+        models: {
+          claude: { name: "Claude", package: "aisdk:@ai-sdk/google-vertex/anthropic", disabled: true },
+          missing: { disabled: true },
+        },
+      },
+    })
+    expect(result.diagnostics).toEqual([
+      {
+        kind: "unsupported",
+        path: ["provider", "google-vertex-anthropic", "whitelist"],
+        message: "omitted unsupported legacy setting",
+      },
+    ])
+  })
+
+  test("reports settings other than disabled on the model wildcard without changing them", () => {
+    const result = normalized({
+      providers: { custom: { models: { "*": { disabled: true, name: "All" }, first: { name: "First" } } } },
+    })
+    expect(result.encoded.providers).toEqual({
+      custom: { models: { "*": { disabled: true, name: "All" }, first: { name: "First" } } },
+    })
+    expect(result.diagnostics).toEqual([
+      {
+        kind: "unsupported",
+        path: ["providers", "custom", "models", "*", "name"],
+        message: "ignored setting not supported on the model wildcard",
+      },
+    ])
+  })
+
   test("reports unsupported legacy settings without including their values", () => {
     const secret = "do-not-log-this-value"
     const result = normalized({
@@ -527,7 +590,6 @@ describe("ConfigNormalize", () => {
       ["logLevel"],
       ["agent", "reviewer", "name"],
       ["provider", "custom", "id"],
-      ["provider", "custom", "whitelist"],
       ["provider", "custom", "models", "model", "release_date"],
       ["provider", "custom", "models", "model", "status"],
       ["provider", "custom", "models", "model", "interleaved"],
 
@@ -766,4 +766,36 @@ describe("ConfigProviderPlugin.Plugin", () => {
       }),
     ),
   )
+  it.effect("applies a wildcard model override before explicit models", () =>
+    Effect.gen(function* () {
+      const providers = yield* Provider.Service
+      const models = yield* Model.Service
+      const providerID = Provider.ID.make("custom")
+      const first = Model.ID.make("first")
+      const second = Model.ID.make("second")
+      yield* providers.transform((editor) => {
+        editor.update(providerID, () => {})
+        editor.models.update(providerID, first, () => {})
+        editor.models.update(providerID, second, () => {})
+      })
+      yield* addPlugin([
+        new Document({
+          type: "document",
+          info: decode({
+            providers: {
+              custom: {
+                models: { "*": { disabled: true }, second: { disabled: false }, missing: { disabled: false } },
+              },
+            },
+          }),
+        }),
+      ])
+
+      expect((yield* providers.get(providerID))?.activation).toBe("enabled")
+      expect((yield* models.get(providerID, first))?.enabled).toBe(false)
+      expect((yield* models.get(providerID, second))?.enabled).toBe(true)
+      expect(yield* models.get(providerID, Model.ID.make("*"))).toBeUndefined()
+      expect(yield* models.get(providerID, Model.ID.make("missing"))).toBeUndefined()
+    }),
+  )
 })
@@ -452,6 +452,7 @@ describe("OpencodePlugin", () => {
                         settings: { baseURL: `${origin}/anthropic` },
                       },
                       disabled: { name: "Disabled", disabled: true },
+                      "*": { disabled: true },
                     },
                   },
                 },
@@ -554,6 +555,7 @@ describe("OpencodePlugin", () => {
               ?.settings?.baseURL,
           ).toBe("https://upstream.example/v1")
           expect(yield* models.get(Provider.ID.openai, Model.ID.make("api-model"))).toBeUndefined()
+          expect(yield* models.get(Provider.ID.make("remote"), Model.ID.make("*"))).toBeUndefined()
 
           yield* credentials.update(initial.id, { label: "Renamed" })
           yield* Effect.yieldNow
 
@@ -90,6 +90,8 @@ class Model extends Schema.Class<Model>("Config.Model")({
   limit: Limit.pipe(optional),
 }) {}
 
+export const ModelWildcard = "*"
+
 export class Info extends Schema.Class<Info>("Config.Provider")({
   canonical: Provider.ID.pipe(optional),
   name: Schema.String.pipe(optional),
 
@@ -82,6 +82,8 @@ Both options take an array of model IDs — the same IDs shown in the `/models`
 - `whitelist` keeps only the listed models and hides the rest.
 - You can combine them: `whitelist` narrows the set, then `blacklist` removes entries from it.
 
+In the `providers` format, the same is expressed with model overrides: `"*": { "disabled": true }` disables every model of the provider, and explicit entries such as `"claude-sonnet-4-20250514": { "disabled": false }` re-enable individual models.
+
 ---
 
 ## OpenCode Zen