diff --git a/services/hermes/agent-deployment.yaml b/services/hermes/agent-deployment.yaml
index eb8094f5..abee6932 100644
--- a/services/hermes/agent-deployment.yaml
+++ b/services/hermes/agent-deployment.yaml
@@ -425,12 +425,15 @@ spec:
                 chmod 0755 "${tools}/bin/ttyd.tmp"
                 mv "${tools}/bin/ttyd.tmp" "${tools}/bin/ttyd"
               fi
-              # The CLI stamp is arch-specific: npm only materializes the current
-              # arch's native optional deps (e.g. @openai/codex-linux-x64), so a
-              # fresh arch must re-run the install even though the shared volume
-              # already holds the other arch's node_modules. npm keeps both
-              # arches' optional packages, so this never clobbers the sibling arch.
-              if [ ! -f "${tools}/.cli-versions-0.147.0-2.1.226-${arch}" ]; then
+              # npm materializes codex's native optional dep only for the current
+              # platform, and a sibling-arch `npm install` on the SHARED volume
+              # removes this arch's native binary (node_modules is shared across
+              # nodes). So re-run the install whenever this arch's native codex
+              # package is absent — not only when the arch stamp is missing —
+              # which self-heals after the pod has run on the other architecture.
+              case "$(uname -m)" in x86_64) nodearch=x64 ;; aarch64) nodearch=arm64 ;; *) nodearch=unknown ;; esac
+              codex_native="${tools}/lib/node_modules/@openai/codex-linux-${nodearch}"
+              if [ ! -f "${tools}/.cli-versions-0.147.0-2.1.226-${arch}" ] || [ ! -d "${codex_native}" ]; then
                 npm install --global --omit=dev --no-audit --no-fund --prefix "${tools}" \
                   @openai/codex@0.147.0 \
                   @anthropic-ai/claude-code@2.1.226