diff --git a/profiles/base/cli-tools/default.nix b/profiles/base/cli-tools/default.nix
index 3125597..959abea 100644
--- a/profiles/base/cli-tools/default.nix
+++ b/profiles/base/cli-tools/default.nix
@@ -6,6 +6,7 @@
     ./direnv.nix
     ./eza.nix
     ./fzf.nix
+    ./hermes-remote.nix
     ./lf.nix
     ./nitch.nix
     ./packages.nix
diff --git a/profiles/base/cli-tools/hermes-remote.nix b/profiles/base/cli-tools/hermes-remote.nix
new file mode 100644
index 0000000..a7ad8b7
--- /dev/null
+++ b/profiles/base/cli-tools/hermes-remote.nix
@@ -0,0 +1,50 @@
+# hermes-remote — SSH into m3-hermes and attach/create a Zellij session running the Hermes CLI.
+# Available on all hosts (base profile), uses the m3-hermes SSH match block.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.hermesRemote;
+in {
+  options.base.cliTools.hermesRemote = {
+    enable = (mkEnableOption "enable hermes-remote shortcut") // {default = true;};
+
+    host = mkOption {
+      type = types.str;
+      default = "m3-hermes";
+      description = "SSH hostname (resolved via ~/.ssh/config matchBlocks).";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "hermes";
+      description = "Remote SSH user.";
+    };
+
+    identityFile = mkOption {
+      type = types.str;
+      default = "~/.ssh/hermes";
+      description = "SSH private key for the hermes user.";
+    };
+
+    session = mkOption {
+      type = types.str;
+      default = "hermes";
+      description = "Zellij session name on the remote host.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = [
+      (pkgs.writeShellScriptBin "hermes-remote" ''
+        # hermes-remote — SSH into m3-hermes as the hermes user and
+        # attach/create a Zellij session with the Hermes CLI.
+        exec ssh -t -i ${cfg.identityFile} ${cfg.user}@${cfg.host} \
+          "zellij attach -c ${cfg.session} || zellij -s ${cfg.session}"
+      '')
+    ];
+  };
+}