diff --git a/.github/workflows/nightly-images.yml b/.github/workflows/nightly-images.yml
index 49b967d..8dfe233 100644
--- a/.github/workflows/nightly-images.yml
+++ b/.github/workflows/nightly-images.yml
@@ -63,7 +63,7 @@ jobs:
       fail-fast: false
       matrix:
         variant: [antigravity, claude, codex, copilot, cursor, devin, gemini,
-                  grok, hermes, kiro, mimocode, opencode, pi]
+                  grok, kiro, mimocode, opencode, pi]
         arch: [amd64, arm64]
         include:
           - arch: amd64
@@ -88,12 +88,6 @@ jobs:
 
       - name: Resolve the latest CLI version and the base digest
         id: meta
-        env:
-          # Used only for the Hermes cross-repo Contents API request. An
-          # authenticated API fetch avoids the shared-runner 429s seen on
-          # raw.githubusercontent.com (run 33565582163), while the resolved
-          # commit below keeps the installer and checkout immutable.
-          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
 
@@ -103,23 +97,13 @@ jobs:
           # below was verified against the live endpoint before being wired in:
           #   npm registry /latest document ....... claude codex copilot gemini
           #                                         opencode mimocode pi
-          #   GitHub releases/latest .............. antigravity hermes
+          #   GitHub releases/latest .............. antigravity
           #   install script's embedded version ... cursor
           #   cli/current/manifest.json ........... devin (also carries sha256)
           #   GCS channel version file ............ grok
           #   vendor `latest` download URL ........ kiro (version learned from
           #                                         the built image afterwards)
           CLI_SHA256=""
-          CLI_REF=""
-          # Dockerfile.nightly mounts this build-context file without copying it
-          # into the final image. Non-Hermes jobs still need the path to exist.
-          printf '#!/bin/sh\nexit 1\n' > .nightly-hermes-install.sh
-
-          github_api() {
-            curl -fsSL --retry 3 --retry-all-errors \
-              -H "Authorization: Bearer $GH_TOKEN" \
-              -H 'X-GitHub-Api-Version: 2022-11-28' "$@"
-          }
 
           case "${{ matrix.variant }}" in
             claude)
@@ -138,35 +122,6 @@ jobs:
               CLI_VERSION=$(curl -fsSL --retry 3 https://registry.npmjs.org/@earendil-works/pi-coding-agent/latest | jq -r .version) ;;
             antigravity)
               CLI_VERSION=$(curl -fsSL --retry 3 https://api.github.com/repos/google-antigravity/antigravity-cli/releases/latest | jq -r .tag_name) ;;
-            hermes)
-              RELEASE=$(github_api https://api.github.com/repos/NousResearch/hermes-agent/releases/latest)
-              CLI_VERSION=$(echo "$RELEASE" | jq -r .tag_name)
-
-              # Dereference an annotated (possibly nested) release tag to its
-              # immutable commit. Fetch both the installer and source checkout
-              # from this SHA, never from the movable tag name.
-              REF=$(github_api "https://api.github.com/repos/NousResearch/hermes-agent/git/ref/tags/${CLI_VERSION}")
-              REF_TYPE=$(echo "$REF" | jq -r .object.type)
-              CLI_REF=$(echo "$REF" | jq -r .object.sha)
-              for _ in 1 2 3; do
-                [ "$REF_TYPE" = "tag" ] || break
-                REF=$(github_api "https://api.github.com/repos/NousResearch/hermes-agent/git/tags/${CLI_REF}")
-                REF_TYPE=$(echo "$REF" | jq -r .object.type)
-                CLI_REF=$(echo "$REF" | jq -r .object.sha)
-              done
-              [ "$REF_TYPE" = "commit" ] || {
-                echo "FAIL: Hermes release $CLI_VERSION did not resolve to a commit" >&2
-                exit 1
-              }
-
-              github_api -H 'Accept: application/vnd.github.raw+json' \
-                "https://api.github.com/repos/NousResearch/hermes-agent/contents/scripts/install.sh?ref=${CLI_REF}" \
-                > .nightly-hermes-install.sh
-              [ "$(head -1 .nightly-hermes-install.sh)" = '#!/bin/bash' ] || {
-                echo "FAIL: Hermes installer response is not the expected script" >&2
-                exit 1
-              }
-              chmod 755 .nightly-hermes-install.sh ;;
             cursor)
               # The install script embeds the version it would install; there is
               # no separate version index. Anchored to the download URL shape so
@@ -194,16 +149,11 @@ jobs:
               echo "FAIL: invalid CLI version for ${{ matrix.variant }}: $CLI_VERSION" >&2
               exit 1 ;;
           esac
-          if [ -n "$CLI_REF" ] && ! echo "$CLI_REF" | grep -qE '^[0-9a-f]{40}$'; then
-            echo "FAIL: invalid immutable ref for ${{ matrix.variant }}: $CLI_REF" >&2
-            exit 1
-          fi
           {
             echo "cli_version=$CLI_VERSION"
             echo "cli_sha256=$CLI_SHA256"
-            echo "cli_ref=$CLI_REF"
           } >> "$GITHUB_OUTPUT"
-          echo "Resolved ${{ matrix.variant }} CLI -> $CLI_VERSION${CLI_REF:+ @ $CLI_REF}"
+          echo "Resolved ${{ matrix.variant }} CLI -> $CLI_VERSION"
 
           # The base is the same pre-beta variant the release channel builds
           # from. Pin the *index* (manifest-list) digest, not one arch's
@@ -259,7 +209,6 @@ jobs:
             VARIANT=${{ matrix.variant }}
             CLI_VERSION=${{ steps.meta.outputs.cli_version }}
             CLI_SHA256=${{ steps.meta.outputs.cli_sha256 }}
-            CLI_REF=${{ steps.meta.outputs.cli_ref }}
           cache-from: type=gha,scope=nightly-${{ matrix.variant }}-${{ matrix.arch }}
           cache-to: type=gha,scope=nightly-${{ matrix.variant }}-${{ matrix.arch }},mode=max
           provenance: false
@@ -271,7 +220,6 @@ jobs:
         env:
           IMAGE: openab-pty:nightly-candidate
           CLI_VERSION: ${{ steps.meta.outputs.cli_version }}
-          CLI_REF: ${{ steps.meta.outputs.cli_ref }}
         run: |
           set -euo pipefail
 
@@ -331,14 +279,6 @@ jobs:
             devin)       GOT="$(docker exec pty devin --version)" ;;
             gemini)      GOT="$(docker exec pty gemini --version)" ;;
             grok)        GOT="$(docker exec pty grok --version)" ;;
-            hermes)
-              HEAD=$(docker exec pty git -c safe.directory=/usr/local/lib/hermes-agent \
-                -C /usr/local/lib/hermes-agent rev-parse HEAD)
-              [ "$HEAD" = "$CLI_REF" ] || {
-                echo "FAIL: Hermes checkout is $HEAD, expected resolved release commit $CLI_REF" >&2
-                exit 1
-              }
-              GOT="$CLI_VERSION @ $HEAD ($(docker exec pty hermes-acp --version))" ;;
             kiro)        GOT="$(docker exec pty kiro-cli --version)" ;;
             mimocode)    GOT="$(docker exec pty mimo --version)" ;;
             opencode)    GOT="$(docker exec pty opencode --version)" ;;
@@ -375,7 +315,6 @@ jobs:
             VARIANT=${{ matrix.variant }}
             CLI_VERSION=${{ steps.meta.outputs.cli_version }}
             CLI_SHA256=${{ steps.meta.outputs.cli_sha256 }}
-            CLI_REF=${{ steps.meta.outputs.cli_ref }}
           cache-from: type=gha,scope=nightly-${{ matrix.variant }}-${{ matrix.arch }}
           provenance: false
 
@@ -421,7 +360,7 @@ jobs:
       fail-fast: false
       matrix:
         variant: [antigravity, claude, codex, copilot, cursor, devin, gemini,
-                  grok, hermes, kiro, mimocode, opencode, pi]
+                  grok, kiro, mimocode, opencode, pi]
     permissions:
       contents: read
       packages: write
diff --git a/.gitignore b/.gitignore
index 46b3cca..4c6e0cb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,5 +2,3 @@ dist/
 .build/
 target/
 *.xcodeproj
-
-.nightly-hermes-install.sh
diff --git a/Dockerfile.nightly b/Dockerfile.nightly
index ff3420e..5ce2e5c 100644
--- a/Dockerfile.nightly
+++ b/Dockerfile.nightly
@@ -66,13 +66,6 @@ RUN touch src/main.rs src/lib.rs \
     && strip "target/$(cat /rust-target)/release/openab-pty" \
     && cp "target/$(cat /rust-target)/release/openab-pty" /openab-pty
 
-# The workflow fetches the Hermes installer through GitHub's authenticated
-# Contents API at the exact resolved release commit. Keeping it in a scratch
-# stage lets the runtime RUN mount it without adding the script to any final
-# image layer. Non-Hermes matrix jobs provide a fail-closed placeholder.
-FROM scratch AS hermes-installer
-COPY --chmod=755 .nightly-hermes-install.sh /install.sh
-
 # --- runtime ----------------------------------------------------------------
 # The openab base, digest-pinned per variant by the workflow at build time — the
 # digest is recorded in the job log so a base change can never silently alter an
@@ -100,13 +93,11 @@ ARG VARIANT
 # dated immutable tags are the rollback path.
 ARG CLI_VERSION
 ARG CLI_SHA256=""
-ARG CLI_REF=""
 # Provided automatically by buildx (amd64 | arm64). Each vendor spells the arch
 # differently in its download URL, so the per-token mapping is computed inside
 # the RUN from this single input rather than hardcoded per variant.
 ARG TARGETARCH
-RUN --mount=type=bind,from=hermes-installer,source=/install.sh,target=/tmp/install-hermes.sh,ro \
-    set -eux; \
+RUN set -eux; \
 \
     # Per-vendor arch tokens. Availability was verified against live endpoints
     # (issue #21): every variant below ships an arm64 Linux artifact EXCEPT
@@ -138,15 +129,6 @@ RUN --mount=type=bind,from=hermes-installer,source=/install.sh,target=/tmp/insta
       opencode) \
         npm install -g "opencode-ai@${CLI_VERSION}" --fetch-retries=3 \
         && npm cache clean --force ;; \
-      hermes) \
-        rm -rf /usr/local/lib/hermes-agent \
-        && HERMES_HOME=/home/agent/.hermes \
-           HERMES_INSTALL_DIR=/usr/local/lib/hermes-agent \
-           bash /tmp/install-hermes.sh --skip-setup --skip-browser \
-             --skip-computer-use --no-skills --branch main \
-             --commit "${CLI_REF}" --force-commit \
-        && ln -sf /usr/local/lib/hermes-agent/venv/bin/hermes-acp /usr/local/bin/hermes-acp \
-        && chown -R 1000:1000 /home/agent ;; \
       mimocode) \
         npm install -g "@mimo-ai/cli@${CLI_VERSION}" --fetch-retries=3 \
         && npm cache clean --force ;; \