diff --git a/scripts/ops/hermes_triage_monitor.py b/scripts/ops/hermes_triage_monitor.py
index 452dba36b..2cd0dbca0 100755
--- a/scripts/ops/hermes_triage_monitor.py
+++ b/scripts/ops/hermes_triage_monitor.py
@@ -302,6 +302,11 @@ def evidence_for(key: str, incident: str = "") -> None:
              "printenv", "ARIADNE_HERMES_ALLOWED_ACTIONS"], limit=2)
         run(["kubectl", "-n", NS_ARIADNE, "exec", "deploy/ariadne", "-c", "ariadne", "--",
              "printenv", "ARIADNE_HERMES_MIN_CONFIDENCE"], limit=2)
+        print(f"  {DIM}a separate setting governs what Hermes may be asked to propose a fix"
+              f" for. It is separate because these become pull requests rather than"
+              f" changes Ariadne makes itself:{RESET}")
+        run(["kubectl", "-n", NS_ARIADNE, "exec", "deploy/ariadne", "-c", "ariadne", "--",
+             "printenv", "ARIADNE_HERMES_FIX_CATEGORIES"], limit=2)
         print()
     elif key == "route":
         if IS_CODE_JOB:
diff --git a/services/maintenance/apps/ariadne-deployment.yaml b/services/maintenance/apps/ariadne-deployment.yaml
index 418453ffb..65b91d2d7 100644
--- a/services/maintenance/apps/ariadne-deployment.yaml
+++ b/services/maintenance/apps/ariadne-deployment.yaml
@@ -536,6 +536,12 @@ spec:
             # and expensive to read. Below this ceiling an open pull request on
             # a repository is no reason to withhold a fix for a different
             # failure; at it, new proposals wait.
+            # What Hermes may be asked to propose a fix for. Deliberately not
+            # in ARIADNE_HERMES_ALLOWED_ACTIONS: that list gates what Ariadne
+            # executes on its own authority, whereas everything here becomes a
+            # pull request a person reads before anything changes.
+            - name: ARIADNE_HERMES_FIX_CATEGORIES
+              value: lint_violation,undefined_name,failing_assertion
             - name: ARIADNE_HERMES_CODE_MAX_OPEN_PROPOSALS
               value: "64"
             - name: ARIADNE_HERMES_CODE_REPOS