diff --git a/CHANGELOG.md b/CHANGELOG.md
index ff47e9757a..49668a6214 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -167,6 +167,7 @@ _Living section — regenerated 2026-08-12 from all cycle commits (cycle open `e
 
 ### 🐛 Bug Fixes
 
+- **providers**: honor `PATCH /api/providers/[id]` so `omniroute providers rotate` stops 405ing (the OpenAPI spec and CLI already use PATCH) (PR #10366)
 - **executors**: fix internal timeout misclassified as client disconnect (499) for 7 niche executors — pass TimeoutError reason to controller.abort() (#8197 side-finding)
 - test(combo): guard auto/best-free never leaks the combo name as a model (#7754)
 - fix(vision-bridge): describe-model no longer returns unreachable "openai/gpt-4o-mini" when every vision-capable provider is unreachable on the instance — returns null instead and surfaces a clear error (#8430)
diff --git a/src/app/api/providers/[id]/route.ts b/src/app/api/providers/[id]/route.ts
index adb5840fa0..562dad0744 100644
--- a/src/app/api/providers/[id]/route.ts
+++ b/src/app/api/providers/[id]/route.ts
@@ -376,6 +376,15 @@ export async function PUT(request: Request, { params }: { params: Promise<{ id:
   }
 }
 
+// PATCH /api/providers/[id] - Update connection (partial)
+// The OpenAPI spec and the CLI (`omniroute providers rotate`, generated
+// api-commands) both use PATCH, but only PUT was implemented — PATCH requests
+// 405'd. PATCH and PUT share the same update semantics here (the schema only
+// applies provided fields), so delegate to the PUT handler.
+export async function PATCH(request: Request, ctx: { params: Promise<{ id: string }> }) {
+  return PUT(request, ctx);
+}
+
 // DELETE /api/providers/[id] - Delete connection
 export async function DELETE(request: Request, { params }: { params: Promise<{ id: string }> }) {
   const authError = await requireManagementAuth(request);
diff --git a/tests/unit/providers-route-patch-method.test.ts b/tests/unit/providers-route-patch-method.test.ts
new file mode 100644
index 0000000000..23b3dcd5af
--- /dev/null
+++ b/tests/unit/providers-route-patch-method.test.ts
@@ -0,0 +1,66 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+// Regression test for the providers-route PATCH gap: the OpenAPI spec and the
+// CLI (`omniroute providers rotate`, generated api-commands) both use
+// PATCH /api/providers/[id], but the route only implemented PUT — PATCH
+// requests 405'd and `providers rotate --new-key` silently failed while
+// reporting success. See PR fix: the route now exports a PATCH handler that
+// delegates to PUT (both apply the same partial-update schema).
+
+async function loadRoute() {
+  return await import(new URL("../../src/app/api/providers/[id]/route.ts", import.meta.url));
+}
+
+test("providers [id] route exports a PATCH handler (CLI rotate 405 regression)", async () => {
+  const route = await loadRoute();
+  assert.equal(
+    typeof route.PATCH,
+    "function",
+    "PATCH handler must exist — CLI rotate sends PATCH per the OpenAPI spec"
+  );
+});
+
+test("PATCH handler delegates to PUT (same partial-update semantics)", async () => {
+  const route = await loadRoute();
+  // The PATCH export delegates to PUT; both share the same update logic and
+  // are distinct function references (wrapper). A fixed status expectation is
+  // environment-dependent: management auth is enforced on dev (PUT returns 401
+  // without a credential) but NOT in the CI unit-test env, where the flow
+  // falls through to "Connection not found" (404) for an unknown id. So assert
+  // on delegation equivalence instead: PATCH must never 405 (the regression)
+  // and must return the exact same status as PUT for the same input.
+  const ctx = { params: Promise.resolve({ id: "test-id" }) };
+  // Fresh Request per invocation: PUT reads the body via request.json(),
+  // which consumes the body stream — reusing one Request for both calls would
+  // give the second call an empty body (400 validation) vs the first (404
+  // not-found), a false mismatch. Identical inputs must produce identical
+  // statuses.
+  const patchRequest = new Request("http://localhost/api/providers/test-id", {
+    method: "PATCH",
+    body: JSON.stringify({ name: "x" }),
+  });
+  const putRequest = new Request("http://localhost/api/providers/test-id", {
+    method: "PUT",
+    body: JSON.stringify({ name: "x" }),
+  });
+  const patchResult = await route.PATCH(patchRequest, ctx);
+  const putResult = await route.PUT(putRequest, ctx);
+  assert.ok(patchResult, "PATCH should return a response, not 405");
+  assert.notEqual(
+    patchResult.status,
+    405,
+    "PATCH must be routed — before the fix Next.js returned 405 Method Not Allowed"
+  );
+  assert.equal(
+    patchResult.status,
+    putResult.status,
+    "PATCH must delegate to PUT's handler (identical status for the same input)"
+  );
+});
+
+test("providers [id] route still exports PUT and DELETE handlers", async () => {
+  const route = await loadRoute();
+  assert.equal(typeof route.PUT, "function");
+  assert.equal(typeof route.DELETE, "function");
+});