diff --git a/home-manager/programs/cass/default.nix b/home-manager/programs/cass/default.nix
index be497b3ae..193c1dcdf 100644
--- a/home-manager/programs/cass/default.nix
+++ b/home-manager/programs/cass/default.nix
@@ -4,6 +4,16 @@
   ...
 }:
 {
+  # Clean up the hydrate.sh output before linkGeneration so it doesn't
+  # block the next nix-switch.
+  home.activation.cassSourcesCleanup = config.lib.dag.entryBefore [ "linkGeneration" ] ''
+    $DRY_RUN_CMD ${pkgs.bash}/bin/bash -c '
+      if [ -f "${config.home.homeDirectory}/.config/cass/sources.toml" ]; then
+        rm -f "${config.home.homeDirectory}/.config/cass/sources.toml"
+      fi
+    '
+  '';
+
   # sources.toml is hydrated at activation so each machine can drop itself from
   # the peer list using its runtime hostname.
   home.activation.hydrateCassSources = config.lib.dag.entryAfter [ "writeBoundary" ] ''
diff --git a/home-manager/services/hermes/default.nix b/home-manager/services/hermes/default.nix
index 08f2770dc..785a64356 100644
--- a/home-manager/services/hermes/default.nix
+++ b/home-manager/services/hermes/default.nix
@@ -11,6 +11,19 @@ let
   hermesNode = pkgs.nodejs_22;
 in
 lib.mkIf host.isKyber {
+  # Clean up writable copies that Hermes activate.sh creates (replacing Nix-managed
+  # symlinks) so they don't block the next nix-switch's linkGeneration.
+  home.activation.hermesCleanup = config.lib.dag.entryBefore [ "linkGeneration" ] ''
+    $DRY_RUN_CMD ${pkgs.bash}/bin/bash -c '
+      for f in hermes-gateway.service hermes-dashboard.service hermes-dashboard-proxy.service; do
+        unit="${homeDir}/.config/systemd/user/$f"
+        if [ -f "$unit" ] && [ ! -L "$unit" ]; then
+          rm -f "$unit"
+        fi
+      done
+    '
+  '';
+
   home.activation.hermesSetup = config.lib.dag.entryAfter [ "writeBoundary" ] ''
     $DRY_RUN_CMD ${pkgs.bash}/bin/bash "${./activate.sh}" "${homeDir}" "${hermesNode}/bin/npm"
   '';