diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml
index 3fe15c1a0..a0751a5a1 100644
--- a/services/hermes/deployment.yaml
+++ b/services/hermes/deployment.yaml
@@ -37,6 +37,11 @@ spec:
           {{ .Data.data.anthropic_oauth_token }}
           {{- end }}
         vault.hashicorp.com/agent-pre-populate-only: "true"
+        # Without this the agent init container is appended after the
+        # pod's own init containers, so init-config runs before the
+        # secret file exists and silently falls back to the Secret -
+        # the migration looks complete while Vault is never read.
+        vault.hashicorp.com/agent-init-first: "true"
         vault.hashicorp.com/agent-requests-cpu: 25m
         vault.hashicorp.com/agent-requests-mem: 32Mi
         vault.hashicorp.com/agent-limits-cpu: 100m