diff --git a/profiles/base/cli-tools/hermes-remote.nix b/profiles/base/cli-tools/hermes-remote.nix
index 01bb3a4..a7ad8b7 100644
--- a/profiles/base/cli-tools/hermes-remote.nix
+++ b/profiles/base/cli-tools/hermes-remote.nix
@@ -15,7 +15,19 @@ in {
     host = mkOption {
       type = types.str;
       default = "m3-hermes";
-      description = "SSH hostname (must match a matchBlocks entry).";
+      description = "SSH hostname (resolved via ~/.ssh/config matchBlocks).";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "hermes";
+      description = "Remote SSH user.";
+    };
+
+    identityFile = mkOption {
+      type = types.str;
+      default = "~/.ssh/hermes";
+      description = "SSH private key for the hermes user.";
     };
 
     session = mkOption {
@@ -28,9 +40,10 @@ in {
   config = mkIf cfg.enable {
     home.packages = [
       (pkgs.writeShellScriptBin "hermes-remote" ''
-        # hermes-remote — SSH into m3-hermes and attach/create a Zellij session with hermes CLI.
-        # Uses -t for PTY allocation (required by both Zellij and Hermes).
-        exec ssh -t ${cfg.host} "zellij attach -c ${cfg.session} || zellij -s ${cfg.session}"
+        # hermes-remote — SSH into m3-hermes as the hermes user and
+        # attach/create a Zellij session with the Hermes CLI.
+        exec ssh -t -i ${cfg.identityFile} ${cfg.user}@${cfg.host} \
+          "zellij attach -c ${cfg.session} || zellij -s ${cfg.session}"
       '')
     ];
   };