diff --git a/modules/environments/hermes-agent/default.nix b/modules/environments/hermes-agent/default.nix
index 89c3dd1..82a2386 100644
--- a/modules/environments/hermes-agent/default.nix
+++ b/modules/environments/hermes-agent/default.nix
@@ -22,8 +22,20 @@ in
       settings.model.default = "anthropic/claude-sonnet-4-5";
       environmentFiles = [ config.sops.secrets."hermes-env".path ];
       addToSystemPackages = true;
+
+      backend = {
+        # "dashboard" serves the browser admin panel, not just the API.
+        mode = "dashboard";
+        # Non-loopback bind opens the dashboard's auth gate — username/password
+        # comes from HERMES_DASHBOARD_BASIC_AUTH_* in hermes-env (see secrets.nix).
+        host = "0.0.0.0";
+        port = 9119;
+      };
     };
 
+    # NixOS default-deny firewall otherwise blocks inbound LAN connections.
+    networking.firewall.allowedTCPPorts = [ config.services.hermes-agent.backend.port ];
+
     # addToSystemPackages only puts `hermes` on $PATH; using it needs group
     # access to /var/lib/hermes/.hermes (mode 2770 hermes:hermes). finn is
     # this machine's one human user and already knows hermes-env's contents
diff --git a/secrets/mibook.yaml b/secrets/mibook.yaml
index 266b164..af7d70b 100644
--- a/secrets/mibook.yaml
+++ b/secrets/mibook.yaml
@@ -1,4 +1,4 @@
-hermes-env: ENC[AES256_GCM,data:BRGzY+9FGyDyUM5yZzG8IrhqUnW3qH1Tfb41atr3JlaVp+qgdbNWfaajRrjGV/bMrLCO5X1JGavnjH1tFxGyNKT2iUUI70s49fyvVyQR5spKKdU2HlxEkAp6w/J9imoFWrfotHi40ZGtZW1vZ4FX6GubsWrAfKHKnw0EI61IXLIFpdspWd6LSVPH159tCl1iTXRxYXLj5HArD4gIP9MSo+LDTZqIAgaByLD0rnSPIL8YSGBsjFFhw8jnvgowIPyZJbcMuwUeXsVvEZ65U4F6GtWcyHFuBGd2VbCBjvPdKPh+08pvhe5hef+JaHIjzslBasiGowZe03yFF6z0RL4fK8SQ6T1tYNRS2//fwC0RMIweZkldojEnprMl7W5CFHRtdG4UNnA0ChVHllGHe8FgKlyv9ouf/fGqY0jNkaqArYJHH1lRpe+9gLbBNwj8HAlCi7p7G6A0rrfRQUx7pnYrCnMUcWpfuPX1FGbHkP2t5yN07g66WU01ZMz5A9EwEMJGzNilHHiGLd8athrjRM2/wEg7y0apqhInyyCsCfbrmQBa,iv:zrVf9D7EDf21QsfXUfU54DUfkvoxKvQsEOF/qA4lcG4=,tag:x4j+o+ArJo8sEoI/p9Kq7A==,type:str]
+hermes-env: ENC[AES256_GCM,data:du6bieWblEAhAYdZtCqnbNy0yWjFj13djw6co5nrNt1J8zWrmjdXo+UzvwKVpH5EMnxIEuzq9VrqsDPBLDAy1/SQRiWUuK5V7bRSVn88Hs/c7zJ1wo57i1DTVU5gwygzZHmEZbn6gKnFzNBx3aqZV+dLk3+Q4s6LpXbtRgZc63WeuMHqjlUBFeZoGIPZZ9FzqWjVx/FIgWRFm56utyBsnWhMK/2ZD2E6aOFNCZaXZp0QVXGRmiLtx7MLBY8oqJUBl16wytjOB8Y5khf5pJ5AV2NkXx9h27ycZbEQwouq1P6ty/OjQfmkZn7Jbt/oL9lG2FiOsR1x6f4bmVYrTrhjXmFoWvvDSlPJ7noBg2L+J0UrAZpDnOr2DCxZXlLnBCKaMdqvq27yTyATeWAW1BE5gCLlYnT5iE2vlr9GttY4LjfXW8HL3ieQ4bL/PB/PBZSZVKl5QrLfVrou1i8cxtM5cGfFKi9zCaDYI3G282961u1VHuVYVKZoU73WiR2BEuWqXn+1F3YOWEkOg7lM4xMoy9Q9qx7rSv3M/zOF7gjI0spCQv5RiuUOgoHbiERXgTAEfIaDRTYL30IqnHMS3O9SsTTINwDXBNk4cDxI2Ctyfy2IeAucBWAd4OhEqnji8bJ7tO4At8UIxjZ3oYGJiu0uqaDFS/Jdre4uYrSk,iv:CyO15YBh6BKNpZnsp+LAizND9rRgIjWj8SyT33Nii2c=,tag:WLlmMBIcvmYceSY4RXGUuw==,type:str]
 sops:
     age:
         - enc: |
@@ -19,7 +19,7 @@ sops:
             RTmhK6mw2wd8oUMdgPOUESNwh1xkCz4hDHPrDQnfd4sPhSAvh28jwg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1n3uqtee5ymykrls6k04dznq50cwmj99hw7ny83yxjndt4y2ncf5qhjwa2p
-    lastmodified: "2026-09-08T19:09:49Z"
-    mac: ENC[AES256_GCM,data:XByuffus4RuTZx2/FPfc/7UedefrFZnRTCtjC3AficDYVTLRHaL17hl6B8C9wZETOuvrzSGSDsedfTvPKQEwiujcwj0WHBuXzx/75pbFLpaITbDB+GXBYsB0fJqeVRi4aRMAgq3+698wuFnJ2CVvZ/IPvxcLCt0hL1UhUCcSwHM=,iv:tmNA+cMmrPu5hAbDh2Z6LGYt0PoP+cLOYquYA/2rBG4=,tag:jmMi+33sw93Wo64PFfkZCw==,type:str]
+    lastmodified: "2026-09-10T06:28:38Z"
+    mac: ENC[AES256_GCM,data:t9oIZWrBtwkGyyb9hGlfWzAguI/xlqtRceTyyYE2y99xmGIl+pXHJkFF2pP9T09/NWHcXV0gRmV7LuKfF1zX1ZPNY7dba0AwVtU5ezoUdUuL2i47S7Ty1Onk9y6PqtgsRE1SkRAdzAr7s0csBzGXAn8I4z2rqZa43obRwtx7XV4=,iv:Lw6UmeeSNsfNftho423VM+htR0VzQFrCw3sDQ9OLQP0=,tag:SDQ0jJLf1jQIhBWPkm2WRg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3