diff --git a/src/web-server/models-dev/pricing-resolver.ts b/src/web-server/models-dev/pricing-resolver.ts
index 715e7600..9be07d1b 100644
--- a/src/web-server/models-dev/pricing-resolver.ts
+++ b/src/web-server/models-dev/pricing-resolver.ts
@@ -18,19 +18,19 @@ export interface ModelsDevPricingLookupOptions {
   provider?: string;
 }
 
-const PROVIDER_ALIASES: Record<string, string> = {
-  agy: 'google',
-  antigravity: 'google',
-  claude: 'anthropic',
-  codex: 'openai',
-  copilot: 'github-copilot',
-  gemini: 'google',
-  ghcp: 'github-copilot',
-  github: 'github-copilot',
-  kimi: 'moonshotai',
-  moonshot: 'moonshotai',
-  qwen: 'alibaba',
-};
+const PROVIDER_ALIASES = new Map<string, string>([
+  ['agy', 'google'],
+  ['antigravity', 'google'],
+  ['claude', 'anthropic'],
+  ['codex', 'openai'],
+  ['copilot', 'github-copilot'],
+  ['gemini', 'google'],
+  ['ghcp', 'github-copilot'],
+  ['github', 'github-copilot'],
+  ['kimi', 'moonshotai'],
+  ['moonshot', 'moonshotai'],
+  ['qwen', 'alibaba'],
+]);
 
 function normalizeId(value: string): string {
   return value.trim().toLowerCase();
@@ -45,7 +45,7 @@ export function normalizeModelsDevProviderId(
 ): string | undefined {
   if (!provider) return undefined;
   const normalized = normalizeId(provider);
-  return PROVIDER_ALIASES[normalized] ?? normalized;
+  return PROVIDER_ALIASES.get(normalized) ?? normalized;
 }
 
 function splitProviderPrefix(model: string): { provider?: string; model: string } {
diff --git a/tests/unit/data-aggregator.test.ts b/tests/unit/data-aggregator.test.ts
index e15d468c..5aa90210 100644
--- a/tests/unit/data-aggregator.test.ts
+++ b/tests/unit/data-aggregator.test.ts
@@ -150,6 +150,40 @@ describe('aggregateDailyUsage', () => {
     expect(result[0].modelBreakdowns[0].provider).toBe('github-copilot');
     expect(result[0].modelBreakdowns[0].inputTokens).toBe(3000);
   });
+
+  test('handles provider names inherited from Object.prototype', () => {
+    const entries: RawUsageEntry[] = [
+      createEntry({ model: 'model-a', target: '__proto__' }),
+      createEntry({ model: 'model-b', target: 'constructor' }),
+      createEntry({ model: 'model-c', target: 'toString' }),
+    ];
+
+    const daily = aggregateDailyUsage(entries);
+    const hourly = aggregateHourlyUsage(entries);
+    const monthly = aggregateMonthlyUsage(entries);
+    const session = aggregateSessionUsage(entries);
+
+    expect(daily[0].modelBreakdowns.map((item) => item.provider)).toEqual([
+      '__proto__',
+      'constructor',
+      'tostring',
+    ]);
+    expect(hourly[0].modelBreakdowns.map((item) => item.provider)).toEqual([
+      '__proto__',
+      'constructor',
+      'tostring',
+    ]);
+    expect(monthly[0].modelBreakdowns.map((item) => item.provider)).toEqual([
+      '__proto__',
+      'constructor',
+      'tostring',
+    ]);
+    expect(session[0].modelBreakdowns.map((item) => item.provider)).toEqual([
+      '__proto__',
+      'constructor',
+      'tostring',
+    ]);
+  });
 });
 
 // ============================================================================