diff --git a/scripts/ops/hermes_demo_lib.sh b/scripts/ops/hermes_demo_lib.sh
index 53fbd29e9..df42864d7 100644
--- a/scripts/ops/hermes_demo_lib.sh
+++ b/scripts/ops/hermes_demo_lib.sh
@@ -52,8 +52,18 @@ jenkins_post() {
 }
 gitea_get() { curl -s --max-time 25 -H "Authorization: token ${GITEA_TOKEN:-}" "$GITEA_URL$1"; }
 
+# Jenkins tree selectors use square brackets, which some curl builds treat as
+# glob metacharacters and refuse to send - the request never leaves, the body
+# is empty, and the JSON parse dies with a traceback that says nothing about
+# the real cause. Encoded, so the demo does not depend on how curl was built.
 last_build_number() {
-  jenkins_get "/job/$1/api/json?tree=lastBuild[number]" |
+  local body
+  body="$(jenkins_get "/job/$1/api/json?tree=lastBuild%5Bnumber%5D")"
+  if [ -z "$body" ]; then
+    echo "Jenkins returned nothing for job $1 (check credentials and $JENKINS_URL)" >&2
+    return 1
+  fi
+  printf '%s' "$body" |
     python3 -c 'import json,sys; print(json.load(sys.stdin)["lastBuild"]["number"])'
 }