diff --git a/cmd/serve/s3/s3_test.go b/cmd/serve/s3/s3_test.go
index 2baf487f3..1eea39916 100644
--- a/cmd/serve/s3/s3_test.go
+++ b/cmd/serve/s3/s3_test.go
@@ -308,6 +308,34 @@ func TestListBucketsAuthProxy(t *testing.T) {
 	testListBuckets(t, cases, true)
 }
 
+// TestNewServerPerServerAuthProxy checks that a per-server proxyOpt.AuthProxy
+// enables proxy mode even when the process-global proxy.Opt.AuthProxy is empty,
+// which is the normal case when the server is configured via serve/start.
+func TestNewServerPerServerAuthProxy(t *testing.T) {
+	fstest.Initialise()
+
+	// Ensure the global is empty so we only test the per-server option.
+	assert.Equal(t, "", proxy.Opt.AuthProxy)
+
+	f, err := fs.NewFs(context.Background(), "testdata")
+	require.NoError(t, err)
+
+	opt := Opt
+	opt.AuthKey = []string{"access-key,secret-key"}
+	opt.HTTP.ListenAddr = []string{endpoint}
+
+	proxyOpt := proxy.Opt
+	proxyOpt.AuthProxy = "/path/to/auth/proxy"
+
+	w, err := newServer(context.Background(), f, &opt, &vfscommon.Opt, &proxyOpt)
+	require.NoError(t, err)
+	defer func() {
+		assert.NoError(t, w.Shutdown())
+	}()
+	assert.True(t, w.provider.IsProxy(), "expected auth proxy to be enabled by per-server option")
+	assert.Nil(t, w.provider.VFS(), "expected no fixed VFS when auth proxy is in use")
+}
+
 func TestRc(t *testing.T) {
 	servetest.TestRc(t, rc.Params{
 		"type":           "s3",
diff --git a/cmd/serve/s3/server.go b/cmd/serve/s3/server.go
index d7935e41d..6b5a58f74 100644
--- a/cmd/serve/s3/server.go
+++ b/cmd/serve/s3/server.go
@@ -74,9 +74,9 @@ func newServer(ctx context.Context, f fs.Fs, opt *Options, vfsOpt *vfscommon.Opt
 		fs.Debugf(f, "Using hash %v for ETag", w.etagHashType)
 	}
 
-	if len(opt.AuthKey) == 0 {
+	if len(opt.AuthKey) == 0 && !w.provider.IsProxy() {
 		fs.Logf("serve s3", "No auth provided so allowing anonymous access")
-	} else {
+	} else if len(opt.AuthKey) > 0 {
 		w.s3Secret = getAuthSecret(opt.AuthKey)
 	}