diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index 4e2f4e2..fd69c0e 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -160,6 +160,29 @@ pihole.franksdank.cloud {
 	reverse_proxy 192.168.0.143:8083
 }
 
+# --- Hermes WebUI (Hermex webui; host-netns container, published 8787) ------
+# Exempt by construction: the webui authenticates itself (HERMES_WEBUI_PASSWORD),
+# so no Anubis challenge and no Authentik proxy provider is required — nothing
+# here enters the http://:8016 auth chain. Internal-only by DNS absence: there is
+# no public Porkbun A record for this name, so only LAN clients (Pi-hole
+# addn-hosts → 192.168.0.143) can resolve it at all; DNS-01 issuance via the
+# Porkbun module needs no public record. Upstream is the host LAN IP rather than
+# localhost because Caddy itself lives on dankclaw_default: from that bridge the
+# gateway address 10.89.1.1 has nothing serving 8787 (connection refused), while
+# 192.168.0.143:8787 is open.
+hermes.franksdank.cloud {
+	reverse_proxy 192.168.0.143:8787
+}
+
+# --- Hermes dashboard (admin UI; published 9119 on dankclaw_default) --------
+# Exempt by construction: the app enforces its own complete auth — verified live
+# from Caddy's own network, an unauthenticated GET / returns 302 → /login?next=%2F
+# (uvicorn), and basic_auth.username + a scrypt password_hash are set in the
+# dashboard's /data/config.yaml. No outpost provider needed.
+hermesadmin.franksdank.cloud {
+	reverse_proxy 192.168.0.143:9119
+}
+
 # ═══════════════════════════════════════════════════════════════
 # Services on dankserver (192.168.0.235) — published LAN ports
 # ═══════════════════════════════════════════════════════════════
diff --git a/dankclaw/pihole/addn-hosts b/dankclaw/pihole/addn-hosts
index 59753ea..191a751 100644
--- a/dankclaw/pihole/addn-hosts
+++ b/dankclaw/pihole/addn-hosts
@@ -38,6 +38,7 @@
 192.168.0.143 comfyui.franksdank.cloud
 192.168.0.143 ai.franksdank.cloud
 192.168.0.143 hermes.franksdank.cloud
+192.168.0.143 hermesadmin.franksdank.cloud
 192.168.0.143 gitea.franksdank.cloud
 192.168.0.143 grafana.franksdank.cloud
 192.168.0.143 prometheus.franksdank.cloud