diff --git a/hosts/m3-hermes/services/hermes-dashboard.nix b/hosts/m3-hermes/services/hermes-dashboard.nix
index 20b93de..1480dbd 100644
--- a/hosts/m3-hermes/services/hermes-dashboard.nix
+++ b/hosts/m3-hermes/services/hermes-dashboard.nix
@@ -24,7 +24,9 @@ in {
       User = "hermes";
       Group = "hermes";
 
-      ExecStart = "${hermesPkg}/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open";
+      # --insecure: required to bind 0.0.0.0 (default refuses non-localhost).
+      # Safe because firewall restricts port 9119 to Netbird mesh only.
+      ExecStart = "${hermesPkg}/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open --insecure";
 
       # Environment matching the hermes-agent service
       Environment = [