diff --git a/services/jenkins/configmap-jcasc.yaml b/services/jenkins/configmap-jcasc.yaml
index b02be8c5..50955a5f 100644
--- a/services/jenkins/configmap-jcasc.yaml
+++ b/services/jenkins/configmap-jcasc.yaml
@@ -656,6 +656,11 @@ data:
             disabled(false)
             description('Bounded daemonless Kaniko release for the latest atlas/titan-iac main containing a reviewed commit. Archives exact evidence, then publishes an immutable tag for Flux deployment.')
             authenticationToken(System.getenv('HERMES_AGENT_IMAGE_BUILD_TOKEN'))
+            parameters {
+              booleanParam('PUBLISH_IMAGE', false, 'Publish the reviewed Hermes agent image.')
+              stringParam('EXPECTED_SOURCE_REVISION', '', 'Full reviewed commit that must be contained by atlas/titan-iac main.')
+              stringParam('CONFIRM_PUBLISH', '', 'Exact confirmation: PUBLISH HERMES AGENT')
+            }
             definition {
               cpsScm {
                 scm {
@@ -675,6 +680,11 @@ data:
             disabled(false)
             description('Bounded daemonless Kaniko release for the latest atlas/titan-iac main containing a reviewed commit. Archives exact evidence, then publishes an immutable tag for Flux deployment.')
             authenticationToken(System.getenv('HERMES_AGENT_IMAGE_BUILD_TOKEN'))
+            parameters {
+              booleanParam('PUBLISH_IMAGE', false, 'Publish the reviewed Hermes WebUI image.')
+              stringParam('EXPECTED_SOURCE_REVISION', '', 'Full reviewed commit that must be contained by atlas/titan-iac main.')
+              stringParam('CONFIRM_PUBLISH', '', 'Exact confirmation: PUBLISH HERMES WEBUI')
+            }
             definition {
               cpsScm {
                 scm {
diff --git a/services/jenkins/deployment.yaml b/services/jenkins/deployment.yaml
index acffb3f7..9bf1e627 100644
--- a/services/jenkins/deployment.yaml
+++ b/services/jenkins/deployment.yaml
@@ -68,7 +68,7 @@ spec:
           {{ with secret "kv/data/atlas/hermes/developer-jenkins" }}
           HERMES_AGENT_IMAGE_BUILD_TOKEN={{ .Data.data.build_token }}
           {{ end }}
-        bstein.dev/restarted-at: "2026-08-23T16:40:25Z"
+        bstein.dev/restarted-at: "2026-08-23T16:53:00Z"
     spec:
       serviceAccountName: jenkins
       priorityClassName: scavenger
diff --git a/testing/tests/test_hermes_image_builder.py b/testing/tests/test_hermes_image_builder.py
index 419a3d3f..63171f1f 100644
--- a/testing/tests/test_hermes_image_builder.py
+++ b/testing/tests/test_hermes_image_builder.py
@@ -182,6 +182,9 @@ def test_jenkins_job_is_manual_and_reads_pipeline_from_main() -> None:
     assert (
         "authenticationToken(System.getenv('HERMES_AGENT_IMAGE_BUILD_TOKEN'))" in block
     )
+    assert "booleanParam('PUBLISH_IMAGE', false" in block
+    assert "stringParam('EXPECTED_SOURCE_REVISION', ''" in block
+    assert "stringParam('CONFIRM_PUBLISH', ''" in block
     assert "pipelineTriggers" not in block
     assert "scmTrigger" not in block
 
diff --git a/testing/tests/test_hermes_webui_release.py b/testing/tests/test_hermes_webui_release.py
index 6b7431ab..20649a40 100644
--- a/testing/tests/test_hermes_webui_release.py
+++ b/testing/tests/test_hermes_webui_release.py
@@ -86,6 +86,9 @@ def test_webui_job_is_independent_bounded_and_main_only() -> None:
     assert (
         "authenticationToken(System.getenv('HERMES_AGENT_IMAGE_BUILD_TOKEN'))" in block
     )
+    assert "booleanParam('PUBLISH_IMAGE', false" in block
+    assert "stringParam('EXPECTED_SOURCE_REVISION', ''" in block
+    assert "stringParam('CONFIRM_PUBLISH', ''" in block
 
 
 def test_pipeline_builds_latest_main_containing_reviewed_anchor() -> None: