diff --git a/services/hermes/configmap.yaml b/services/hermes/configmap.yaml
index becb0da10..3c14415a4 100644
--- a/services/hermes/configmap.yaml
+++ b/services/hermes/configmap.yaml
@@ -9,11 +9,13 @@ metadata:
 data:
   config.yaml: |
     model:
-      provider: openai-codex
-      default: gpt-5.6-terra
-      model: gpt-5.6-terra
+      provider: anthropic
+      default: claude-opus-5
+      model: claude-opus-5
 
     fallback_providers:
+      - provider: openai-codex
+        model: gpt-5.6-terra
       - provider: custom
         model: gpt-oss:20b
         base_url: http://hermes-model-gate.hermes.svc.cluster.local:11434/v1
diff --git a/services/hermes/deployment.yaml b/services/hermes/deployment.yaml
index 7a49900c2..d2d299542 100644
--- a/services/hermes/deployment.yaml
+++ b/services/hermes/deployment.yaml
@@ -211,6 +211,19 @@ spec:
               value: https://scm.bstein.dev
             - name: GRAFANA_BASE_URL
               value: https://metrics.bstein.dev
+            # Claude subscription OAuth token (sk-ant-oat01...). The anthropic
+            # provider accepts ANTHROPIC_API_KEY, ANTHROPIC_TOKEN, or this, in
+            # that order; an OAuth token is not an API key, so it must arrive
+            # under this name. Optional, so Hermes still starts without it and
+            # falls back to openai-codex.
+            # TODO: migrate to Vault alongside the Gitea token; this manual
+            # Secret was created in the interest of demo time.
+            - name: CLAUDE_CODE_OAUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: hermes-anthropic-token
+                  key: token
+                  optional: true
           volumeMounts:
             - name: home
               mountPath: /opt/data