diff --git a/transports/bifrost-http/server/server.go b/transports/bifrost-http/server/server.go
index 8bfe2678515..20bd41dcf19 100644
--- a/transports/bifrost-http/server/server.go
+++ b/transports/bifrost-http/server/server.go
@@ -250,6 +250,9 @@ type BifrostHTTPServer struct {
 	Client *bifrost.Bifrost
 	Config *lib.Config
 
+	KeySelector   schemas.KeySelector   // embedder key-selection policy; nil keeps core's default
+	KeyPoolFilter schemas.KeyPoolFilter // embedder key-pool filter; nil keeps core's default
+
 	// HTTPClientFactory hands out clients for outbound traffic other than provider
 	// inference (webhooks, skills, plugin downloads, MCP, catalog sync) that honour
 	// the global proxy for their purpose and follow proxy changes live.
@@ -3270,6 +3273,9 @@ func startSkillsOrphanCleanupWorker(ctx context.Context, config *lib.Config, sho
 // 3. Initializes the Bifrost client with the configuration
 // 4. Sets up HTTP routes for text and chat completions
 //
+// KeySelector and KeyPoolFilter are passed to core here, so an embedder must
+// set them before calling Bootstrap.
+//
 // The server exposes the following endpoints:
 //   - POST /v1/text/completions: For text completion requests
 //   - POST /v1/chat/completions: For chat completion requests
@@ -3419,6 +3425,8 @@ func (s *BifrostHTTPServer) Bootstrap(ctx context.Context) error {
 		Logger:             logger,
 		KVStore:            s.Config.KVStore,
 		ModelCatalog:       s.Config.ModelCatalog,
+		KeySelector:        s.KeySelector,
+		KeyPoolFilter:      s.KeyPoolFilter,
 	})
 	if err != nil {
 		return fmt.Errorf("failed to initialize bifrost: %v", err)
diff --git a/transports/changelog.md b/transports/changelog.md
index 7010f7cb53f..df237fc4bb6 100644
--- a/transports/changelog.md
+++ b/transports/changelog.md
@@ -1,6 +1,7 @@
 ## Features
 
 - **Azure Blob Storage** - Added log payload and skills-file storage with default Azure identity or connection-string authentication, JSON/gzip and Parquet support, and config-file/Helm configuration. Structured environment and vault references can omit `value`.
+- **Key Selection Hooks for Embedders** - `BifrostHTTPServer` gains `KeySelector` and `KeyPoolFilter`, passed to core on `Bootstrap`, so a program embedding the HTTP server can supply its own key-selection policy. Unset, core's defaults apply [@jeremym-tanium](https://github.com/jeremym-tanium)
 
 ## 🔒 Security