diff --git a/config/hermes/hydrate.sh b/config/hermes/hydrate.sh
index 87be8bfef..e40eb4eab 100644
--- a/config/hermes/hydrate.sh
+++ b/config/hermes/hydrate.sh
@@ -59,7 +59,7 @@ if [ -z "$CLIPROXY_API_KEY" ]; then
   CLIPROXY_API_KEY="$(read_secret "${SECRETS_DIR}/cliproxy-key")"
 fi
 
-TELEGRAM_TOKEN="${TELEGRAM_TOKEN:-$(read_secret "${SECRETS_DIR}/telegram-token")}"
+TELEGRAM_TOKEN="${HERMES_TELEGRAM_TOKEN:-${TELEGRAM_TOKEN:-$(read_secret "${SECRETS_DIR}/telegram-token")}}"
 GATEWAY_TOKEN="${HERMES_GATEWAY_TOKEN:-${GATEWAY_TOKEN:-$(read_secret "${SECRETS_DIR}/gateway-token")}}"
 WHATSAPP_ALLOW_FROM="${WHATSAPP_ALLOW_FROM:-$(read_secret "${SECRETS_DIR}/whatsapp-allow-from")}"
 
diff --git a/home-manager/services/hermes/activate.sh b/home-manager/services/hermes/activate.sh
index d15c1e9bd..41b246150 100644
--- a/home-manager/services/hermes/activate.sh
+++ b/home-manager/services/hermes/activate.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Create Hermes directories with correct permissions
+# Create Hermes directories and install runtime deps
 # Usage: activate.sh <home_dir>
 set -euo pipefail
 HOME_DIR="$1"
@@ -11,3 +11,11 @@ mkdir -p "$HOME_DIR/.hermes/memories"
 mkdir -p "$HOME_DIR/.hermes/skills"
 mkdir -p "$HOME_DIR/.hermes/cron"
 chmod 700 "$HOME_DIR/.hermes"
+
+# Install hermes gateway runtime deps from pyproject.toml dependency group
+HERMES_VENV="$HOME_DIR/ghq/github.com/NousResearch/hermes-agent/.venv"
+if [ -d "$HERMES_VENV" ]; then
+  uv pip install --python "$HERMES_VENV/bin/python" \
+    --group hermes \
+    --project "$HOME_DIR/dotfiles" 2>/dev/null || true
+fi
diff --git a/home-manager/services/hermes/default.nix b/home-manager/services/hermes/default.nix
index 1aa0ae236..af78b5cda 100644
--- a/home-manager/services/hermes/default.nix
+++ b/home-manager/services/hermes/default.nix
@@ -41,4 +41,30 @@ lib.mkIf host.isKyber {
       WantedBy = [ "default.target" ];
     };
   };
+
+  systemd.user.services.hermes-dashboard = {
+    Unit = {
+      Description = "Hermes dashboard";
+      After = [ "network-online.target" ];
+      Wants = [ "network-online.target" ];
+      StartLimitIntervalSec = 300;
+      StartLimitBurst = 10;
+    };
+    Service = {
+      Type = "simple";
+      ExecStart = "${homeDir}/.local/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open --insecure";
+      Restart = "always";
+      RestartSec = "5s";
+      Environment = [
+        "HOME=${homeDir}"
+        "PATH=${homeDir}/.local/bin:${homeDir}/.nix-profile/bin:/usr/local/bin:/usr/bin:/bin"
+      ];
+      WorkingDirectory = "${homeDir}/.hermes";
+      StandardOutput = "append:/tmp/hermes/hermes-dashboard.log";
+      StandardError = "append:/tmp/hermes/hermes-dashboard.log";
+    };
+    Install = {
+      WantedBy = [ "default.target" ];
+    };
+  };
 }
diff --git a/pyproject.toml b/pyproject.toml
index 581323a15..cc14988bc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -21,6 +21,13 @@ tools = [
   "vllm>=0.20.0",
   "vllm-mlx>=0.2.9",
 ]
+# Hermes gateway runtime deps - installed into hermes venv via uv pip install
+hermes = [
+  "python-telegram-bot[webhooks]>=22.6,<23",
+  "croniter>=6.0.0,<7",
+  "fastapi[standard]>=0.115.0",
+  "uvicorn>=0.30.0",
+]
 
 [tool.uv]
 exclude-newer = "1 week"