diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d6f45e3..5294fbc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,16 @@ jobs:
         run: npm run compile
 
       - name: 🔎 Lint source and maintenance docs
-        run: npm run lint
+        env:
+          # The `shellcheck` npm package downloads its binary from GitHub
+          # releases on first run (flaky in CI), and its SHELLCHECKJS_BIN
+          # validator requires a user-writable binary. Install via apt and
+          # point it at a writable copy in the runner's temp dir.
+          SHELLCHECKJS_BIN: ${{ runner.temp }}/shellcheck
+        run: |
+          sudo apt-get update && sudo apt-get install -y shellcheck
+          cp /usr/bin/shellcheck "$SHELLCHECKJS_BIN"
+          npm run lint
 
       - name: 🎨 Check formatting
         run: npm run format:check
diff --git a/src/extension.ts b/src/extension.ts
index 6bb7e44..43caccb 100644
--- a/src/extension.ts
+++ b/src/extension.ts
@@ -2049,6 +2049,15 @@ class OpenCodeProvider implements vscode.LanguageModelChatProvider<OpenCodeModel
     // (issue #106, see step 2 below).
     if (apiKey) {
       await this.markByokGroupConfigured();
+    } else if (opts.configuration !== undefined) {
+      // A group call with a non-undefined configuration that carries no API
+      // key is a per-model configuration group (only `settings`, no key —
+      // e.g. a `reasoningEffort` picked in the model picker). VS Code
+      // resolves its configuration to `{}` here. The groupless call already
+      // served the models via SecretStorage, so serving them again would
+      // duplicate every model (issue #131). The per-model settings still
+      // apply at request time via `modelConfiguration`.
+      return [];
     }
 
     // 2. Fall back to the extension's own secret storage when BYOK did not