diff --git a/nix/callHermesArgs.nix b/nix/callHermesArgs.nix
deleted file mode 100644
index 824192156de..00000000000
--- a/nix/callHermesArgs.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-# nix/callHermesArgs.nix — Shared callPackage arguments for hermes-agent.nix
-#
-# packages.nix (perSystem) and overlays.nix (overlay) both call
-# ./hermes-agent.nix with the same flake-input wiring.  This file is that
-# single set of args — import it and spread, adding only the
-# system-resolved npm-lockfile-fix package at each call site.
-#
-# Only embed clean revs — dirtyRev doesn't represent any upstream commit,
-# so comparing it would always claim "update available".
-inputs: {
-  inherit (inputs) uv2nix pyproject-nix pyproject-build-systems;
-  rev = inputs.self.rev or null;
-}
diff --git a/nix/overlays.nix b/nix/overlays.nix
index aaf7de57d72..53248a8a56e 100644
--- a/nix/overlays.nix
+++ b/nix/overlays.nix
@@ -1,12 +1,14 @@
 # nix/overlays.nix — Expose pkgs.hermes-agent for external NixOS configs
+#
+# The overlay is a pure alias for this flake's own package — NOT a
+# re-instantiation against the consumer's nixpkgs.  This guarantees
+# `pkgs.hermes-agent`, `nix build .#default`, and the NixOS module's
+# default package are all the exact same locked, tested derivation.
+# (.override { extraPythonPackages = ...; } still works — callPackage's
+# makeOverridable travels with the package.)
 { inputs, ... }:
 {
   flake.overlays.default = final: _: {
-    hermes-agent = final.callPackage ./hermes-agent.nix (
-      import ./callHermesArgs.nix inputs
-      // {
-        npm-lockfile-fix = inputs.npm-lockfile-fix.packages.${final.stdenv.hostPlatform.system}.default;
-      }
-    );
+    hermes-agent = inputs.self.packages.${final.stdenv.hostPlatform.system}.default;
   };
 }
diff --git a/nix/packages.nix b/nix/packages.nix
index 1936f843dd4..469306eb81b 100644
--- a/nix/packages.nix
+++ b/nix/packages.nix
@@ -4,12 +4,13 @@
   perSystem =
     { pkgs, lib, inputs', ... }:
     let
-      hermesAgent = pkgs.callPackage ./hermes-agent.nix (
-        import ./callHermesArgs.nix inputs
-        // {
-          npm-lockfile-fix = inputs'.npm-lockfile-fix.packages.default;
-        }
-      );
+      hermesAgent = pkgs.callPackage ./hermes-agent.nix {
+        inherit (inputs) uv2nix pyproject-nix pyproject-build-systems;
+        npm-lockfile-fix = inputs'.npm-lockfile-fix.packages.default;
+        # Only embed clean revs — dirtyRev doesn't represent any upstream
+        # commit, so comparing it would always claim "update available".
+        rev = inputs.self.rev or null;
+      };
     in
     {
       packages = {