diff --git a/packages/backend/src/identity/identity.ts b/packages/backend/src/identity/identity.ts
index 0715b08..d36b514 100644
--- a/packages/backend/src/identity/identity.ts
+++ b/packages/backend/src/identity/identity.ts
@@ -1675,13 +1675,13 @@ export class IdentityService {
             for (let suffix = 2; slugTaken.get(id); suffix += 1) id = `${base}-${suffix}`;
             insertOffering.run(id, modelId, connection.id, modelId, owner.id, now, now);
             offering = { id };
-          }
-          const grants = oldGrants.all(connection.id, modelId) as Array<{
-            subjectType: "user" | "team";
-            subjectId: string;
-          }>;
-          for (const grant of grants) {
-            copyGrant.run(offering.id, grant.subjectType, grant.subjectId, owner.id, now);
+            const grants = oldGrants.all(connection.id, modelId) as Array<{
+              subjectType: "user" | "team";
+              subjectId: string;
+            }>;
+            for (const grant of grants) {
+              copyGrant.run(offering.id, grant.subjectType, grant.subjectId, owner.id, now);
+            }
           }
         }
       }
diff --git a/packages/backend/src/identity/roles-model-offerings.integration.test.ts b/packages/backend/src/identity/roles-model-offerings.integration.test.ts
index e63269a..3ead685 100644
--- a/packages/backend/src/identity/roles-model-offerings.integration.test.ts
+++ b/packages/backend/src/identity/roles-model-offerings.integration.test.ts
@@ -397,6 +397,26 @@ describe("roles, capabilities, and model offerings", () => {
     expect(company).not.toHaveProperty("backendId");
     expect(company).not.toHaveProperty("upstreamModelId");
 
+    expect(offerings).toContainEqual(expect.objectContaining({ id: "allowed-model" }));
+    expect(
+      (
+        await backend.app.request(
+          "http://localhost/api/identity/model-offerings/allowed-model/entitlements",
+          {
+            method: "PUT",
+            headers: headers(owner.token, true),
+            body: JSON.stringify({ entitlements: [] }),
+          },
+        )
+      ).status,
+    ).toBe(200);
+    const afterRevocation = await value<Array<{ id: string }>>(
+      await backend.app.request("http://localhost/api/host/model-offerings", {
+        headers: headers(member.token),
+      }),
+    );
+    expect(afterRevocation.map((offering) => offering.id)).not.toContain("allowed-model");
+
     // Re-running migration is idempotent and cannot widen the exact legacy grant.
     await backend.app.request("http://localhost/api/host/models", {
       headers: headers(member.token),