diff --git a/services/nginx/app/routes/subusersRoute.php b/services/nginx/app/routes/subusersRoute.php
index b98cf369..57af3b0c 100644
--- a/services/nginx/app/routes/subusersRoute.php
+++ b/services/nginx/app/routes/subusersRoute.php
@@ -119,10 +119,11 @@ class subusersRoute
 
         $permissions = [];
         foreach ($raw as $permission) {
+            $permission = is_string($permission) ? strtoupper(trim($permission)) : $permission;
             if (!is_string($permission) || subusers_permission_node_key::tryFrom($permission) === null) {
                 $response->error('Unknown permission key: ' . (string)$permission, 400);
             }
-            $permissions[] = strtoupper(trim($permission));
+            $permissions[] = $permission;
         }
 
         return array_values(array_unique($permissions));
diff --git a/services/nginx/app/tests/Support/legacy_test_manifest.php b/services/nginx/app/tests/Support/legacy_test_manifest.php
index 1cba8a65..a0779c73 100644
--- a/services/nginx/app/tests/Support/legacy_test_manifest.php
+++ b/services/nginx/app/tests/Support/legacy_test_manifest.php
@@ -30,5 +30,6 @@ return [
     ['path' => 'tests/slackModule/SlackModuleTest.php', 'classification' => 'manual-external', 'type' => 'script', 'reason' => 'Requires a configured Slack webhook and department webhook cache state.'],
     ['path' => 'tests/subusers/SelfservePermissionInitTest.php', 'classification' => 'unit', 'type' => 'script'],
     ['path' => 'tests/subusers/SubusersRoutePermissionLinkTest.php', 'classification' => 'unit', 'type' => 'script'],
+    ['path' => 'tests/subusers/SubusersRoutePermissionsPayloadTest.php', 'classification' => 'unit', 'type' => 'script'],
     ['path' => 'tests/subusers/SubuserUserGrantInitTest.php', 'classification' => 'unit', 'type' => 'script'],
 ];
diff --git a/services/nginx/app/tests/subusers/SubusersRoutePermissionsPayloadTest.php b/services/nginx/app/tests/subusers/SubusersRoutePermissionsPayloadTest.php
new file mode 100644
index 00000000..af52c868
--- /dev/null
+++ b/services/nginx/app/tests/subusers/SubusersRoutePermissionsPayloadTest.php
@@ -0,0 +1,33 @@
+<?php
+
+if (!defined('WD')) {
+    define('WD', dirname(__DIR__, 2));
+}
+
+function ok($message): void { echo "\n\033[32m✔ $message\033[0m\n"; }
+function fail($message): void { echo "\n\033[31m✖ $message\033[0m\n"; exit(1); }
+
+$routeFile = WD . '/routes/subusersRoute.php';
+if (!file_exists($routeFile)) {
+    fail('subusersRoute.php not found');
+}
+
+$code = file_get_contents($routeFile);
+if ($code === false) {
+    fail('Unable to read subusersRoute.php');
+}
+
+$normalized = preg_replace('/\s+/', ' ', $code);
+
+$normalizesBeforeEnumLookup = 'permission = is_string($permission) ? strtoupper(trim($permission)) : $permission; if (!is_string($permission) || subusers_permission_node_key::tryFrom($permission) === null)';
+if (strpos($normalized, $normalizesBeforeEnumLookup) === false) {
+    fail('Expected permissions payload parser to normalize permission keys before enum validation');
+}
+
+$dedupesNormalizedPermissions = 'return array_values(array_unique($permissions));';
+if (strpos($normalized, $dedupesNormalizedPermissions) === false) {
+    fail('Expected permissions payload parser to deduplicate normalized permission keys');
+}
+
+ok('Subusers route normalizes mixed-case permission payloads before validation and dedupe');
+echo "\nSubusersRoutePermissionsPayloadTest completed.\n";