diff --git a/services/hermes/agent-deployment.yaml b/services/hermes/agent-deployment.yaml
index c54358ae1..1b9ef238b 100644
--- a/services/hermes/agent-deployment.yaml
+++ b/services/hermes/agent-deployment.yaml
@@ -24,7 +24,7 @@ spec:
         ai.bstein.dev/execution: Hermes Kanban with durable direct Codex and Claude Code CLI workers
         ai.bstein.dev/model-policy: Jetson-assisted AUTO routing, low through xhigh, cross-provider fallback
         ai.bstein.dev/placement: rpi5 preferred; Jetson deferred until state storage is available
-        ai.bstein.dev/config-rev: "20260811-codex-image-broker"
+        ai.bstein.dev/config-rev: "20260811-codex-image-broker-port"
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/role: hermes-agent
         vault.hashicorp.com/agent-inject-secret-anthropic-token: kv/data/atlas/hermes/agent-tokens
@@ -705,6 +705,7 @@ spec:
             - {name: CODEX_HOME, value: /opt/data/home/.codex}
             - {name: PYTHONPATH, value: /opt/hermes}
             - {name: HERMES_IMAGE_BROKER_DEFAULT_MODEL, value: gpt-image-2-high}
+            - {name: HERMES_IMAGE_BROKER_LISTEN_PORT, value: "9002"}
           readinessProbe:
             tcpSocket: {port: image-broker}
             initialDelaySeconds: 5
diff --git a/services/hermes/scripts/image_broker.py b/services/hermes/scripts/image_broker.py
index 4c31fa9f9..97b36c302 100644
--- a/services/hermes/scripts/image_broker.py
+++ b/services/hermes/scripts/image_broker.py
@@ -14,8 +14,10 @@ from pathlib import Path
 from typing import Any
 
 
-HOST = os.environ.get("HERMES_IMAGE_BROKER_HOST", "0.0.0.0")
-PORT = int(os.environ.get("HERMES_IMAGE_BROKER_PORT", "9002"))
+HOST = os.environ.get("HERMES_IMAGE_BROKER_LISTEN_HOST", "0.0.0.0")
+# Kubernetes reserves <SERVICE>_PORT for service-link discovery and injects a
+# tcp://... value.  Keep listener configuration out of that namespace.
+PORT = int(os.environ.get("HERMES_IMAGE_BROKER_LISTEN_PORT", "9002"))
 TOKEN = os.environ.get("HERMES_IMAGE_BROKER_KEY", "").strip()
 PROVIDER_PATH = Path(
     os.environ.get(