diff --git a/config/hermes/config.template.yaml b/config/hermes/config.template.yaml
index 1adcc211f..2e7e6cda2 100644
--- a/config/hermes/config.template.yaml
+++ b/config/hermes/config.template.yaml
@@ -327,3 +327,9 @@ custom_providers:
     base_url: https://cliproxy.shunkakinoki.com/v1
     api_key: __CLIPROXY_API_KEY__
     api_mode: chat_completions
+platforms:
+  webhook:
+    enabled: true
+    extra:
+      port: 8644
+      secret: __WEBHOOK_SECRET__
diff --git a/config/hermes/hydrate.sh b/config/hermes/hydrate.sh
index 78557d5f5..b7a9a5c9e 100644
--- a/config/hermes/hydrate.sh
+++ b/config/hermes/hydrate.sh
@@ -63,6 +63,7 @@ fi
 TELEGRAM_TOKEN="${HERMES_TELEGRAM_TOKEN:-${TELEGRAM_TOKEN:-$(read_secret "${SECRETS_DIR}/telegram-token")}}"
 GATEWAY_TOKEN="${HERMES_GATEWAY_TOKEN:-${GATEWAY_TOKEN:-$(read_secret "${SECRETS_DIR}/gateway-token")}}"
 WHATSAPP_ALLOW_FROM="${WHATSAPP_ALLOW_FROM:-$(read_secret "${SECRETS_DIR}/whatsapp-allow-from")}"
+WEBHOOK_SECRET="${HERMES_WEBHOOK_SECRET:-$(read_secret "${SECRETS_DIR}/webhook-secret")}"
 
 if [ -z "${GATEWAY_TOKEN}" ]; then
   echo "Warning: HERMES_GATEWAY_TOKEN not set, skipping Hermes hydration" >&2
@@ -72,6 +73,7 @@ fi
 # Hydrate config.yaml
 @sed@ \
   -e "s|__CLIPROXY_API_KEY__|${CLIPROXY_API_KEY}|g" \
+  -e "s|__WEBHOOK_SECRET__|${WEBHOOK_SECRET}|g" \
   "$CONFIG_TEMPLATE" >"${STATE_DIR}/config.yaml"
 chmod 600 "${STATE_DIR}/config.yaml"