diff --git a/packages/hermes-agent/package.nix b/packages/hermes-agent/package.nix
index b0eef48b72..dcf76451cb 100644
--- a/packages/hermes-agent/package.nix
+++ b/packages/hermes-agent/package.nix
@@ -18,26 +18,32 @@ let
   # PyPI ships wheels only, so build from source with maturin.
   nemo-relay = python3.pkgs.buildPythonPackage rec {
     pname = "nemo-relay";
-    version = "0.6.0";
+    version = "0.7.3";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "NVIDIA";
       repo = "NeMo-Relay";
       tag = version;
-      hash = "sha256-mqI1tDl01a+FCv1FSMqvzYGuS/7hNlc99jcFiN6dRIM=";
+      hash = "sha256-g7xHQOcccuyHIBiVY5GQHpd1vk99RMwuw923OR4+x3E=";
     };
 
     cargoDeps = rustPlatform.fetchCargoVendor {
       inherit src;
       name = "nemo-relay-${version}";
-      hash = "sha256-KxPNGhYHmMFCSiEJomZztrc2P/knYA0It+vuurIccCQ=";
+      hash = "sha256-Re/R/0aSxFNNG9jnbSg+3D0OhQV1mPyxmIJT7ExFaP0=";
     };
 
-    nativeBuildInputs = with rustPlatform; [
-      cargoSetupHook
-      maturinBuildHook
-    ];
+    nativeBuildInputs =
+      with rustPlatform;
+      [
+        cargoSetupHook
+        maturinBuildHook
+      ]
+      # The 0.7.3 tag still carries version 0.7.0 in the workspace Cargo.toml
+      # (pyproject's version is dynamic from it), which fails the metadata
+      # check and hermes' nemo-relay>=0.7.1 requirement.
+      ++ [ python3.pkgs.pyprojectVersionPatchHook ];
 
     pythonImportsCheck = [
       "nemo_relay"
@@ -53,42 +59,6 @@ let
     };
   };
 
-  exa-py = python3.pkgs.buildPythonPackage rec {
-    pname = "exa-py";
-    version = "2.10.2";
-    pyproject = true;
-
-    src = fetchPypi {
-      pname = "exa_py";
-      inherit version;
-      hash = "sha256-94HzCxmfEQIzM4RyitrmS7Faa7yr+pfpH9cF+QrP/EU=";
-    };
-
-    build-system = with python3.pkgs; [
-      poetry-core
-    ];
-
-    dependencies = with python3.pkgs; [
-      httpcore
-      httpx
-      openai
-      pydantic
-      python-dotenv
-      requests
-      typing-extensions
-    ];
-
-    pythonImportsCheck = [ "exa_py" ];
-
-    meta = with lib; {
-      description = "Python SDK for Exa API";
-      homepage = "https://github.com/exa-labs/exa-py";
-      license = licenses.mit;
-      sourceProvenance = with sourceTypes; [ fromSource ];
-      platforms = platforms.all;
-    };
-  };
-
   fal-client = python3.pkgs.buildPythonPackage rec {
     pname = "fal-client";
     version = "0.13.1";
@@ -163,13 +133,13 @@ let
     };
   };
 
-  version = "2026.8.3";
+  version = "2026.8.13";
 
   src = fetchFromGitHub {
     owner = "NousResearch";
     repo = "hermes-agent";
     tag = "v${version}";
-    hash = "sha256-S6TSGgpf37N8YgbTv70dT+LaPiiaQ4/lJV+js2hnCPk=";
+    hash = "sha256-A+pprddWqewhUjD8d+PLdTHAO5SZV6YwPhJrC2T2dFE=";
   };
 
   # Upstream moved ui-tui/ and web/ into npm workspaces with a single root
@@ -180,7 +150,7 @@ let
   hermes-frontend = buildNpmPackage {
     pname = "hermes-frontend";
     inherit version src;
-    npmDepsHash = "sha256-33ALD6Th++LCp8JiVO6ba27GhuP3GBuLGUuyoJg99iM=";
+    npmDepsHash = "sha256-B/i/G3g/ZJNdc8Ip83mO38fzpz76QLHxd4G2/SnESGo=";
 
     # The apps/desktop workspace pulls in electron; skip its binary download
     # and all install scripts — the esbuild/vite builds below don't need them.
@@ -457,6 +427,7 @@ python3.pkgs.buildPythonApplication {
     "rich"
     "pillow"
     "croniter"
+    "exa-py"
   ];
 
   pythonImportsCheck = [
diff --git a/packages/hermes-desktop/package.nix b/packages/hermes-desktop/package.nix
index 8b1482183f..462c2a4294 100644
--- a/packages/hermes-desktop/package.nix
+++ b/packages/hermes-desktop/package.nix
@@ -106,7 +106,7 @@ buildNpmPackage {
 
     upstream_electron_manifest=$(node -p "require('./apps/desktop/package.json').devDependencies.electron")
     upstream_electron_builder=$(node -p "require('./apps/desktop/package.json').build.electronVersion")
-    upstream_electron_lock=$(node -p "require('./package-lock.json').packages['node_modules/electron'].version")
+    upstream_electron_lock=$(node -p "(p => (p['apps/desktop/node_modules/electron'] ?? p['node_modules/electron']).version)(require('./package-lock.json').packages)")
     if [[ "$upstream_electron_manifest" != 40.10.2 || "$upstream_electron_builder" != 40.10.2 || "$upstream_electron_lock" != 40.10.2 ]]; then
       echo "error: upstream Electron pins changed from the reviewed 40.10.2" >&2
       echo "manifest=$upstream_electron_manifest builder=$upstream_electron_builder lock=$upstream_electron_lock" >&2
diff --git a/packages/hermes-desktop/prepare-packaging.mjs b/packages/hermes-desktop/prepare-packaging.mjs
index 5f3c1cc797..06c81ed67a 100644
--- a/packages/hermes-desktop/prepare-packaging.mjs
+++ b/packages/hermes-desktop/prepare-packaging.mjs
@@ -19,7 +19,7 @@ if (!externalList) {
 const externals = [...externalList[1].matchAll(/["']([^"']+)["']/g)]
   .map(match => match[1])
   .sort()
-const expected = ["electron", "fs", "node-pty"]
+const expected = ["electron", "fs", "get-windows", "node-pty"]
 if (JSON.stringify(externals) !== JSON.stringify(expected)) {
   throw new Error(
     `review Electron bundle externals before pruning dependencies: ${JSON.stringify(externals)}`
@@ -36,6 +36,11 @@ if (nativePayloads.length === 0) {
   throw new Error("staged node-pty native payload is missing")
 }
 
+const stagedGetWindows = at("dist/node_modules/get-windows")
+if (!fs.existsSync(path.join(stagedGetWindows, "package.json"))) {
+  throw new Error("staged get-windows package.json is missing")
+}
+
 const manifestPath = at("package.json")
 const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"))
 manifest.dependencies = {}