diff --git a/privacy/scrubbing_proxy.py b/privacy/scrubbing_proxy.py
index b44874c..39884ca 100755
--- a/privacy/scrubbing_proxy.py
+++ b/privacy/scrubbing_proxy.py
@@ -59,14 +59,21 @@
     presidio_scrub = None
     _PRESIDIO_OK = False
 
-# Curated picker whitelist served at /model-catalog.json. ghost is an UNRESTRICTED harness, so
-# it only offers genuinely unrestricted (open-weight, steerable) models -- the Hermes family.
-# Closed, safety-tuned models (Claude, GPT, Gemini, Grok, Seed) defeat the point: they refuse,
-# moralize, and can't be steered, so they are deliberately NOT offered even though the gateway
-# can serve them. This list is the single source of truth for both the picker and the bridge's
-# allow-list (see _ALLOWED_GATEWAY_MODELS) -- to add a model, it must be actually unrestricted.
+# Curated picker whitelist served at /model-catalog.json. ghost is an UNRESTRICTED harness, so it
+# only offers OPEN-WEIGHT, steerable models. Closed, safety-tuned refusers (Claude, GPT, Gemini,
+# Grok, Seed) are served by the gateway but deliberately excluded -- they refuse/moralize and
+# can't be steered. This list is the single source of truth for both the picker and the bridge's
+# allow-list (_ALLOWED_GATEWAY_MODELS).
+#
+# SUPPORTED-MODEL REFERENCE (gateway-verified by probing /v1/chat/completions, 2026-06-24):
+# the gateway's open-weight models are hermes-4-405b, hermes-4-70b, deepseek-v4-pro, glm-5.2.
+# NOTE: `og-veil models` is INCOMPLETE -- it omits deepseek-v4-pro and glm-5.2 even though the
+# gateway serves them. Do NOT trust that list to add a model; probe the endpoint. The gateway
+# rejects anything it doesn't serve with `Model '<id>' is not supported`.
 _CATALOG_MODELS = [
-    ("nous/hermes-4-405b", "Hermes 4 405B — flagship open model, steerable & unrestricted (default)"),
+    ("nous/hermes-4-405b", "Hermes 4 405B — flagship uncensored open model, most steerable (default)"),
+    ("deepseek/deepseek-v4-pro", "DeepSeek V4 Pro — strongest open reasoning + coding; best for agentic work"),
+    ("z-ai/glm-5.2", "GLM 5.2 — strong open agentic MoE (Z.ai)"),
     ("nous/hermes-4-70b", "Hermes 4 70B — fast, low-cost open-weight model"),
 ]
 
diff --git a/requirements.txt b/requirements.txt
index 2467ff8..5271f56 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,4 +1,8 @@
 # ghost privacy stack -- pinned so the load-bearing OHTTP/HPKE/TEE-verify boundary
 # (opengradient-veil) cannot change under us on a re-install. Bump deliberately.
-opengradient-veil>=0.2.6,<0.3
+# 0.2.7 pulls opengradient SDK 1.1.1, whose model enum includes deepseek-v4-pro.
+opengradient-veil>=0.2.7,<0.3
+# Pin the SDK explicitly too -- pip won't upgrade the transitive dep on its own, and the SDK's
+# TEE_LLM enum is what `og-veil models` reports (1.1.1 adds deepseek-v4-pro).
+opengradient>=1.1.1
 httpx>=0.27
diff --git a/tests/test_scrub.py b/tests/test_scrub.py
index c39580d..48753c3 100644
--- a/tests/test_scrub.py
+++ b/tests/test_scrub.py
@@ -254,12 +254,12 @@ def test_stream_multiline_data_frame_deanonymized():
     assert SECRET in out.decode(), "multi-line/parse path must still de-anon local tool args"
 
 
-def test_catalog_is_unrestricted_only():
-    # ghost must only offer/allow genuinely unrestricted models (Hermes); no closed/refusing ones.
+def test_catalog_is_open_weight_only():
+    # ghost must only offer/allow OPEN-WEIGHT models; no closed/refusing ones.
     allowed = sp._ALLOWED_GATEWAY_MODELS
-    assert allowed == {"hermes-4-405b", "hermes-4-70b"}
+    assert allowed == {"hermes-4-405b", "hermes-4-70b", "deepseek-v4-pro", "glm-5.2"}
     blob = json.dumps(sp._CATALOG_MODELS).lower()
-    for closed in ("claude", "gpt", "gemini", "grok", "openai", "anthropic", "seed"):
+    for closed in ("claude", "gpt-", "gemini", "grok", "anthropic", "seed-"):
         assert closed not in blob, f"closed model '{closed}' must not be in the catalog"