diff --git a/v3/generator/operations/operations.go b/v3/generator/operations/operations.go
index 69e5d3224..01c15d856 100644
--- a/v3/generator/operations/operations.go
+++ b/v3/generator/operations/operations.go
@@ -438,6 +438,9 @@ type RequestTmpl struct {
 	JSONResponseTarget string
 	ContentType        string
 	QueryParams        map[string]string
+	// SkipAuth is true for operations that must be called without credentials
+	// (e.g. list-zones which returns public data and should not trigger IAM enforcement).
+	SkipAuth bool
 }
 
 // serializeRequest serializes the openAPI spec into the request template.
@@ -446,6 +449,7 @@ func serializeRequest(path, httpMethod, funcName string, op *v3.Operation) (*Req
 		Name:        funcName,
 		OperationID: op.OperationId,
 		HTTPMethod:  strings.ToUpper(httpMethod),
+		SkipAuth:    op.OperationId == "list-zones",
 	}
 	p.Comment = renderDoc(op)
 	params := getParameters(op, funcName)
diff --git a/v3/generator/operations/request.tmpl b/v3/generator/operations/request.tmpl
index c4ce37908..4484c0015 100644
--- a/v3/generator/operations/request.tmpl
+++ b/v3/generator/operations/request.tmpl
@@ -32,13 +32,15 @@ func (c Client) {{ .Name }}({{ .Params }}) {{ .ValueReturn }} {
 		return nil, fmt.Errorf("{{ .Name }}: execute request editors: %w", err)
 	}
 
-	if err := c.signRequest(request); err != nil {
-		return nil, fmt.Errorf("{{ .Name }}: sign request: %w", err)
-	}
+        {{ if not .SkipAuth }}
+        if err := c.signRequest(request); err != nil {
+                return nil, fmt.Errorf("{{ .Name }}: sign request: %w", err)
+        }
+        {{ end }}
 
-	if c.trace {
-		dumpRequest(request, "{{ .OperationID }}")
-	}
+        if c.trace {
+                dumpRequest(request, "{{ .OperationID }}")
+        }
 
 	response, err := c.httpClient.Do(request)
 	if err != nil {
diff --git a/v3/operations.go b/v3/operations.go
index 40661f6be..41fee5c17 100755
--- a/v3/operations.go
+++ b/v3/operations.go
@@ -18839,10 +18839,6 @@ func (c Client) ListZones(ctx context.Context) (*ListZonesResponse, error) {
 		return nil, fmt.Errorf("ListZones: execute request editors: %w", err)
 	}
 
-	if err := c.signRequest(request); err != nil {
-		return nil, fmt.Errorf("ListZones: sign request: %w", err)
-	}
-
 	if c.trace {
 		dumpRequest(request, "list-zones")
 	}