diff --git a/dockerfiles/Dockerfile.hermes-switchyard b/dockerfiles/Dockerfile.hermes-switchyard
index 28133cde6..44ed770d1 100644
--- a/dockerfiles/Dockerfile.hermes-switchyard
+++ b/dockerfiles/Dockerfile.hermes-switchyard
@@ -1,5 +1,5 @@
 # dockerfiles/Dockerfile.hermes-switchyard
-FROM rust:1.96.1-slim-bookworm@sha256:39decc9f9f4a87e03db5069b2424c0ee13c3d7e4116010980d4f96849e823bc4 AS build
+FROM rust:1.96.1-slim-bookworm@sha256:e18a79fc84dfcfc3ab5ba72290398a644c135c97eaa881447fddc354ee4701a3 AS build
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
@@ -15,7 +15,7 @@ RUN cargo install \
     --root /opt/switchyard \
     switchyard-server
 
-FROM debian:bookworm-slim@sha256:362e64223cc0da95422b3b13c045186fc0a81250e765d31c025fbddf257f6143
+FROM debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241
 
 COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=build /opt/switchyard/bin/switchyard-server /usr/local/bin/switchyard-server
diff --git a/services/hermes/switchyard-deployment.yaml b/services/hermes/switchyard-deployment.yaml
index 4f61c780f..7e5937f77 100644
--- a/services/hermes/switchyard-deployment.yaml
+++ b/services/hermes/switchyard-deployment.yaml
@@ -19,7 +19,7 @@ spec:
       labels:
         app: hermes-switchyard
       annotations:
-        ai.bstein.dev/config-rev: "20260811-switchyard-authority-v1"
+        ai.bstein.dev/config-rev: "20260811-switchyard-authority-v2"
         prometheus.io/scrape: "true"
         prometheus.io/port: "9005"
         prometheus.io/path: /metrics
@@ -57,7 +57,7 @@ spec:
               - matchExpressions:
                   - key: kubernetes.io/arch
                     operator: In
-                    values: [amd64]
+                    values: [arm64]
                   - key: node-role.kubernetes.io/worker
                     operator: In
                     values: ["true"]
@@ -66,7 +66,7 @@ spec:
                     values: [titan-18, titan-22, titan-24]
       containers:
         - name: switchyard
-          image: registry.bstein.dev/bstein/hermes-switchyard@sha256:dc050faf8ed16be9b6c6bdf0b9f6e033a37d29ce9a2b1b7eb6ca10dbae50b946
+          image: registry.bstein.dev/bstein/hermes-switchyard@sha256:3d952d528a4e4cb8afdf84f8995272f5d6107dc127b68cc20234b1da4aff43eb
           imagePullPolicy: IfNotPresent
           command: [/bin/sh, -ec]
           args:
@@ -124,7 +124,7 @@ spec:
             - name: tmp
               mountPath: /tmp
         - name: claude-oauth-broker
-          image: registry.bstein.dev/bstein/hermes-agent@sha256:693c4ee09052b75325fe6dc08a45ad24205e0f294dd608a197aa93d8a64c990d
+          image: registry.bstein.dev/bstein/hermes-agent@sha256:9b4c00a25fd08f0df3bcb800d755bd48576fb65af5ab0df40058fbb78a147e43
           imagePullPolicy: IfNotPresent
           command:
             - /opt/hermes/.venv/bin/python
@@ -181,7 +181,7 @@ spec:
               mountPath: /routing-catalog
               readOnly: true
         - name: worker-route-broker
-          image: registry.bstein.dev/bstein/hermes-agent@sha256:693c4ee09052b75325fe6dc08a45ad24205e0f294dd608a197aa93d8a64c990d
+          image: registry.bstein.dev/bstein/hermes-agent@sha256:9b4c00a25fd08f0df3bcb800d755bd48576fb65af5ab0df40058fbb78a147e43
           imagePullPolicy: IfNotPresent
           command:
             - /opt/hermes/.venv/bin/python