diff --git a/tests/test_config_factory.py b/tests/test_config_factory.py
index 6cf8dcd4006..2343b0e8cca 100644
--- a/tests/test_config_factory.py
+++ b/tests/test_config_factory.py
@@ -375,6 +375,31 @@ def test_strip_parent_engine_args_reports_only_surprising_parent_overrides(self)
         }
         assert overridden == ["tensor_parallel_size"]
 
+    def test_strip_parent_engine_args_keeps_allowed_media_access_controls(self):
+        from dataclasses import fields as dc_fields
+
+        from vllm.engine.arg_utils import EngineArgs
+
+        parent_fields = {f.name: f for f in dc_fields(EngineArgs)}
+        filtered, overridden = strip_parent_engine_args(
+            {
+                "model": "some/model",
+                "stage_configs_path": "/tmp/stages.yaml",
+                "allowed_local_media_path": "/data/qwentts",
+                "allowed_media_domains": ["example.com"],
+            },
+            parent_fields=parent_fields,
+            keep_keys={"allowed_local_media_path", "allowed_media_domains"},
+            strip_keys={"stage_configs_path"},
+            no_warn_keys={"model"},
+        )
+
+        assert filtered == {
+            "allowed_local_media_path": "/data/qwentts",
+            "allowed_media_domains": ["example.com"],
+        }
+        assert overridden == []
+
 
 class TestPipelineYamlParsing:
     """Tests for pipeline YAML file parsing (@ZJY0516)."""
diff --git a/vllm_omni/engine/async_omni_engine.py b/vllm_omni/engine/async_omni_engine.py
index a26102d05a3..d616bdc729f 100644
--- a/vllm_omni/engine/async_omni_engine.py
+++ b/vllm_omni/engine/async_omni_engine.py
@@ -105,7 +105,13 @@
 # Fields that must survive the "equal to default → strip" filter because
 # diffusion stages need them even when equal to vllm's default value
 # (e.g. colocate worker setup relies on worker_extension_cls being forwarded).
-_PARENT_ARGS_KEEP: frozenset[str] = frozenset({"worker_extension_cls"})
+_PARENT_ARGS_KEEP: frozenset[str] = frozenset(
+    {
+        "worker_extension_cls",
+        "allowed_local_media_path",
+        "allowed_media_domains",
+    }
+)
 
 # Omni orchestrator-level fields consumed by ``_resolve_stage_configs`` that
 # must never leak into per-stage EngineArgs (``stage_configs_path`` would