diff --git a/backend/windmill-api/src/ai.rs b/backend/windmill-api/src/ai.rs
index 2cc61e1eb3..a92a9830f4 100644
--- a/backend/windmill-api/src/ai.rs
+++ b/backend/windmill-api/src/ai.rs
@@ -717,7 +717,14 @@ async fn proxy(
                                         // one-time grant and the instance's daily cap have room.
                                         // Errors once the grant is spent, the day is capped, or the
                                         // user already has a request in flight; None otherwise.
-                                        if let Some((free_credentials, lease)) =
+                                        //
+                                        // Service accounts (synthetic `*.sa.wm.dev` identities) are
+                                        // excluded: a workspace admin can create/impersonate them in
+                                        // bulk, and each distinct email would otherwise mint its own
+                                        // grant and let one tenant drain the instance-wide daily cap.
+                                        let free = if authed.email.ends_with(".sa.wm.dev") {
+                                            None
+                                        } else {
                                             crate::ai_free_tier_oss::resolve_free_tier_credentials(
                                                 &provider,
                                                 &db,
@@ -725,7 +732,8 @@ async fn proxy(
                                                 &authed.email,
                                             )
                                             .await?
-                                        {
+                                        };
+                                        if let Some((free_credentials, lease)) = free {
                                             free_lease = Some(lease);
                                             break 'cred free_credentials;
                                         }