diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b15185198..b335aad72 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -161,6 +161,8 @@ jobs:
             ${{ runner.os }}-go-releaser-
       - name: Install modules
         run: go mod tidy
+      - name: run openapi generator
+        run: bash shared/management/http/api/generate.sh
       - name: check git status
         run: git --no-pager diff --exit-code
       - name: Set up QEMU
diff --git a/shared/management/http/api/generate.sh b/shared/management/http/api/generate.sh
index 3770ea90f..ba29a6905 100755
--- a/shared/management/http/api/generate.sh
+++ b/shared/management/http/api/generate.sh
@@ -11,6 +11,6 @@ fi
 old_pwd=$(pwd)
 script_path=$(dirname $(realpath "$0"))
 cd "$script_path"
-go install github.com/oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen@latest
+go install github.com/oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen@v2.7.1
 oapi-codegen --config cfg.yaml openapi.yml
 cd "$old_pwd"
diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index f8c687b7b..196a0c6b1 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -3086,24 +3086,6 @@ components:
         - enabled
         - auth
         - meta
-      allOf:
-        # When private=true, access_groups must be present and non-empty,
-        # and the service mode must be "http". The bearer-auth mutex is
-        # enforced at the service-validation layer
-        # (validatePrivateRequirements) because it sits in a nested
-        # ServiceAuthConfig and isn't cleanly expressible here.
-        - if:
-            required: [private]
-            properties:
-              private:
-                const: true
-          then:
-            required: [access_groups]
-            properties:
-              access_groups:
-                minItems: 1
-              mode:
-                const: http
     ServiceMeta:
       type: object
       properties:
@@ -3191,23 +3173,6 @@ components:
         - name
         - domain
         - enabled
-      allOf:
-        # Mirror of the Service conditional: when private=true the
-        # request must carry a non-empty access_groups list and the
-        # mode must be "http". The bearer-auth mutex is enforced at the
-        # service-validation layer (validatePrivateRequirements).
-        - if:
-            required: [private]
-            properties:
-              private:
-                const: true
-          then:
-            required: [access_groups]
-            properties:
-              access_groups:
-                minItems: 1
-              mode:
-                const: http
     ServiceTargetOptions:
       type: object
       properties:
diff --git a/shared/management/http/api/types.gen.go b/shared/management/http/api/types.gen.go
index d7945e448..ed5060a86 100644
--- a/shared/management/http/api/types.gen.go
+++ b/shared/management/http/api/types.gen.go
@@ -1,6 +1,6 @@
 // Package api provides primitives to interact with the openapi HTTP API.
 //
-// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.7.0 DO NOT EDIT.
+// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.7.1 DO NOT EDIT.
 package api
 
 import (