diff --git a/bin/omarchy-install-hermes-cli b/bin/omarchy-install-hermes-cli
index c153013b..7922e386 100755
--- a/bin/omarchy-install-hermes-cli
+++ b/bin/omarchy-install-hermes-cli
@@ -30,6 +30,10 @@ mode=${1:-}
 tool='pipx:hermes-agent[extras=all]'
 python='3.13'
 
+# The line that identifies the stub as this installer's; matched whole, so a
+# wrapper that merely mentions the command is not mistaken for ours.
+marker='# Written by omarchy-install-hermes-cli.'
+
 # The package, not the runtime directory: it is installed before the app has
 # ever run, and that is exactly when we must not start building a second copy.
 desktop_owns_hermes() {
@@ -55,12 +59,38 @@ installed() {
   [[ -d "$(mise where "$tool" 2>/dev/null)/hermes-agent/lib/python$python" ]]
 }
 
+# The stub is the only thing this installer owns. Anything else at that path
+# -- Hermes' official installer, a hand-rolled wrapper, even a dangling link
+# -- was put there by the user and is never deleted or overwritten here.
+# Symlinks count as foreign even when they resolve to a marked file: the stub
+# is written as a regular file, so a link is someone else's arrangement.
+ours() {
+  [[ -f $HOME/.local/bin/hermes && ! -L $HOME/.local/bin/hermes ]] &&
+    grep -qxF "$marker" "$HOME/.local/bin/hermes"
+}
+
+foreign_hermes() {
+  [[ -e $HOME/.local/bin/hermes || -L $HOME/.local/bin/hermes ]] && ! ours
+}
+
+# A foreign path is usable when it is a command: a regular file that runs.
+# A directory passes -x on search permission alone, and is no more a command
+# than a dangling link is.
+foreign_hermes_runs() {
+  [[ -f $HOME/.local/bin/hermes && -x $HOME/.local/bin/hermes ]]
+}
+
 # --check lets callers tell a cold stub from a working one before they commit
 # to a path that assumes Hermes is ready.
 if [[ $mode == "--check" ]]; then
   if desktop_owns_hermes; then
     if desktop_hermes_ready; then exit 0; else exit 1; fi
   fi
+  # A foreign command is ready when it runs; a broken one is not, and since it
+  # is not ours to replace, nothing this installer does will make it ready.
+  if foreign_hermes; then
+    if foreign_hermes_runs; then exit 0; else exit 1; fi
+  fi
   if installed; then exit 0; else exit 1; fi
 fi
 
@@ -79,7 +109,7 @@ if desktop_owns_hermes; then
   # Our own stub has to go with it. Left in place it still answers `hermes`
   # until the app's bootstrap overwrites it, and answering means building the
   # second Hermes this whole arrangement exists to avoid.
-  if [[ -f $HOME/.local/bin/hermes ]] && grep -q omarchy-install-hermes-cli "$HOME/.local/bin/hermes"; then
+  if ours; then
     rm -f "$HOME/.local/bin/hermes"
   fi
 
@@ -92,13 +122,25 @@ if desktop_owns_hermes; then
   exit 1
 fi
 
+# The user already has a hermes of their own. Leave it be: a working one is
+# what the default agent will run, and a broken one is theirs to fix.
+if foreign_hermes; then
+  if foreign_hermes_runs; then
+    exit 0
+  fi
+
+  echo "~/.local/bin/hermes exists but is not runnable, and it was not installed by Omarchy." >&2
+  echo "Fix or remove it, then run omarchy-install-hermes-cli again." >&2
+  exit 1
+fi
+
 mkdir -p "$HOME/.local/bin"
 rm -f "$HOME/.local/bin/hermes"
 
 cat >"$HOME/.local/bin/hermes" <<EOF
 #!/bin/bash
 
-# Written by omarchy-install-hermes-cli.
+$marker
 
 export UV_PYTHON="$python"
 
diff --git a/bin/omarchy-remove-preinstalls b/bin/omarchy-remove-preinstalls
index 8f5ed5a9..6faf2868 100755
--- a/bin/omarchy-remove-preinstalls
+++ b/bin/omarchy-remove-preinstalls
@@ -17,9 +17,12 @@ if gum confirm "Are you sure you want to remove all preinstalled web apps, TUI w
        ~/.local/bin/gh ~/.local/bin/opencode ~/.local/bin/playwright ~/.local/bin/playwright-cli ~/.local/bin/pi \
        ~/.local/bin/omp ~/.local/bin/ori ~/.local/bin/grok ~/.local/bin/crush ~/.local/bin/ghui ~/.local/bin/hunk
 
-  # Hermes Desktop owns this path once installed, and its own CLI is not a
-  # preinstall to sweep away.
-  omarchy-pkg-present hermes-desktop || rm -f ~/.local/bin/hermes
+  # Only the wrapper omarchy-install-hermes-cli wrote is a preinstall. Hermes
+  # Desktop's command, an official install, or anything else at that path is
+  # the user's, so it is the marker that decides, not which packages are around.
+  if [[ -f ~/.local/bin/hermes && ! -L ~/.local/bin/hermes ]] && grep -qxF '# Written by omarchy-install-hermes-cli.' ~/.local/bin/hermes; then
+    rm -f ~/.local/bin/hermes
+  fi
 
   omarchy-pkg-drop \
     aether \
diff --git a/migrations/1787760281.sh b/migrations/1787760281.sh
new file mode 100644
index 00000000..ea0b1d68
--- /dev/null
+++ b/migrations/1787760281.sh
@@ -0,0 +1,20 @@
+echo "Install the Hermes CLI wrapper for existing installs"
+
+# Users who removed the preinstalls opted out of the mise wrappers, and Hermes
+# is one of them.
+[[ -f $HOME/.local/state/omarchy/preinstalls-removed ]] && exit 0
+
+# Hermes Desktop provides its own Hermes; the installer would only stand aside.
+omarchy-pkg-present hermes-desktop && exit 0
+
+# Anything already answering to hermes that this installer did not write --
+# an official install, a hand-rolled wrapper, even a dangling link -- belongs to
+# the user and stays exactly as it is.
+wrapper="$HOME/.local/bin/hermes"
+if [[ -e $wrapper || -L $wrapper ]]; then
+  if [[ -L $wrapper || ! -f $wrapper ]] || ! grep -qxF '# Written by omarchy-install-hermes-cli.' "$wrapper"; then
+    exit 0
+  fi
+fi
+
+omarchy-install-hermes-cli
diff --git a/test/shell.d/hermes-cli-migration-test.sh b/test/shell.d/hermes-cli-migration-test.sh
new file mode 100755
index 00000000..cfbc952c
--- /dev/null
+++ b/test/shell.d/hermes-cli-migration-test.sh
@@ -0,0 +1,103 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+migration="$ROOT/migrations/1787760281.sh"
+test_tmp=$(mktemp -d)
+trap 'rm -rf "$test_tmp"' EXIT
+
+mock_bin="$test_tmp/bin"
+test_home="$test_tmp/home"
+hermes="$test_home/.local/bin/hermes"
+marker="# Written by omarchy-install-hermes-cli."
+mkdir -p "$mock_bin" "$test_home/.local/bin" "$test_home/.local/state/omarchy"
+
+cat >"$mock_bin/omarchy-pkg-present" <<'SH'
+#!/bin/bash
+[[ ${OMARCHY_TEST_DESKTOP_INSTALLED:-0} == 1 ]]
+SH
+
+cat >"$mock_bin/omarchy-cmd-missing" <<'SH'
+#!/bin/bash
+! command -v "$1" >/dev/null 2>&1
+SH
+
+cat >"$mock_bin/mise" <<'SH'
+#!/bin/bash
+[[ $1 != "where" ]]
+SH
+
+chmod +x "$mock_bin"/*
+
+# The real installer is on PATH so the migration writes today's stub, not a
+# copy of it.
+run_migration() {
+  OMARCHY_TEST_DESKTOP_INSTALLED="${1:-0}" \
+    HOME="$test_home" \
+    PATH="$mock_bin:$ROOT/bin:$PATH" \
+    bash -euo pipefail "$migration" >/dev/null 2>&1
+}
+
+run_migration || fail "the migration installs the wrapper on a plain install"
+[[ -x $hermes ]] && grep -qxF "$marker" "$hermes" || fail "the migration writes the Omarchy wrapper"
+pass "the migration installs the Hermes wrapper"
+
+before=$(cat "$hermes")
+run_migration || fail "rerunning the migration succeeds"
+[[ $(cat "$hermes") == "$before" ]] || fail "rerunning the migration leaves the same wrapper"
+pass "the migration is idempotent"
+
+chmod -x "$hermes"
+run_migration || fail "the migration repairs a non-executable Omarchy wrapper"
+[[ -x $hermes ]] && grep -qxF "$marker" "$hermes" ||
+  fail "the migration restores a non-executable Omarchy wrapper"
+pass "the migration repairs a non-executable Omarchy wrapper"
+
+rm -f "$hermes"
+touch "$test_home/.local/state/omarchy/preinstalls-removed"
+run_migration || fail "the migration succeeds for users who removed the preinstalls"
+[[ ! -e $hermes ]] || fail "the migration respects the preinstalls opt-out"
+pass "the migration skips users who removed the preinstalls"
+rm -f "$test_home/.local/state/omarchy/preinstalls-removed"
+
+run_migration 1 || fail "the migration succeeds when Hermes Desktop owns Hermes"
+[[ ! -e $hermes ]] || fail "the migration writes nothing when Hermes Desktop owns Hermes"
+pass "the migration stands aside for Hermes Desktop"
+
+official_body="#!/bin/bash
+unset PYTHONPATH
+unset PYTHONHOME
+exec $test_home/.hermes/hermes-agent/venv/bin/hermes \"\$@\""
+printf '%s\n' "$official_body" >"$hermes"
+chmod +x "$hermes"
+run_migration || fail "the migration succeeds over a foreign hermes command"
+[[ $(cat "$hermes") == "$official_body" ]] || fail "the migration leaves a foreign hermes command alone"
+pass "the migration preserves a foreign hermes command"
+
+chmod -x "$hermes"
+run_migration || fail "the migration succeeds over a non-executable foreign hermes"
+[[ -f $hermes && ! -x $hermes && $(cat "$hermes") == "$official_body" ]] ||
+  fail "the migration leaves a non-executable foreign hermes alone"
+pass "the migration preserves a non-executable foreign hermes"
+
+rm -f "$hermes"
+ln -s "$test_home/nowhere/hermes" "$hermes"
+run_migration || fail "the migration succeeds over a dangling hermes link"
+[[ -L $hermes && $(readlink "$hermes") == "$test_home/nowhere/hermes" ]] ||
+  fail "the migration leaves a dangling hermes link alone"
+pass "the migration preserves a dangling hermes link"
+
+rm -f "$hermes"
+mkdir "$hermes"
+run_migration || fail "the migration succeeds over a directory at the hermes path"
+[[ -d $hermes ]] || fail "the migration leaves a directory at the hermes path alone"
+pass "the migration preserves a directory at the hermes path"
+
+rmdir "$hermes"
+printf '%s\n' "#!/bin/bash" "# Replaces the stub omarchy-install-hermes-cli used to write." >"$hermes"
+chmod +x "$hermes"
+run_migration || fail "the migration succeeds over a wrapper that mentions the installer"
+grep -qxF "$marker" "$hermes" && fail "the migration does not rewrite a wrapper that merely mentions the installer"
+pass "the migration preserves a wrapper that merely mentions the installer"
diff --git a/test/shell.d/hermes-cli-test.sh b/test/shell.d/hermes-cli-test.sh
index 881dac47..d73e621f 100755
--- a/test/shell.d/hermes-cli-test.sh
+++ b/test/shell.d/hermes-cli-test.sh
@@ -41,7 +41,7 @@ run_installer() {
     bash "$ROOT/bin/omarchy-install-hermes-cli" ${2:+"$2"} >/dev/null 2>&1
 }
 
-stub_marker="omarchy-install-hermes-cli"
+stub_marker="# Written by omarchy-install-hermes-cli."
 app_stub_body='#!/bin/bash
 exec /home/x/.hermes/hermes-agent/venv/bin/hermes "$@"'
 
@@ -51,14 +51,14 @@ exec /home/x/.hermes/hermes-agent/venv/bin/hermes "$@"'
 rm -f "$test_home/.local/bin/hermes"
 run_installer 0 || fail "installer failed with no desktop installed"
 [[ -x $test_home/.local/bin/hermes ]] || fail "installer writes a hermes stub when the desktop is absent"
-grep -q "$stub_marker" "$test_home/.local/bin/hermes" || fail "the stub records which command wrote it"
+grep -qxF "$stub_marker" "$test_home/.local/bin/hermes" || fail "the stub records which command wrote it"
 tr '\0' ' ' <"$mise_log" | grep -q "use -g --quiet uv" &&
   fail "writing the stub does not install uv"
 pass "writing the Hermes stub provisions nothing"
 
 # The desktop app owns Hermes, so our own stub must go rather than sit there
 # answering `hermes` until the app's bootstrap replaces it.
-printf '%s\n' "#!/bin/bash" "# $stub_marker" >"$test_home/.local/bin/hermes"
+printf '%s\n' "#!/bin/bash" "$stub_marker" >"$test_home/.local/bin/hermes"
 chmod +x "$test_home/.local/bin/hermes"
 run_installer 1 || true
 [[ ! -e $test_home/.local/bin/hermes ]] ||
@@ -74,7 +74,7 @@ run_installer 1 || true
 pass "the app's own hermes command is left alone"
 
 # A copy mise cannot vouch for is still a second Hermes.
-printf '%s\n' "#!/bin/bash" "# $stub_marker" >"$test_home/.local/bin/hermes"
+printf '%s\n' "#!/bin/bash" "$stub_marker" >"$test_home/.local/bin/hermes"
 chmod +x "$test_home/.local/bin/hermes"
 : >"$mise_log"
 OMARCHY_TEST_MISE_WHERE_OK=1 run_installer 1 || true
@@ -103,3 +103,81 @@ printf '%s\n' "#!/bin/bash" "exec /usr/local/bin/somebody-elses-hermes \"\$@\""
 chmod +x "$test_home/.local/bin/hermes"
 run_installer 1 --check && fail "--check rejects a hermes command belonging to something else"
 pass "--check rejects a foreign hermes command"
+
+# A hermes the user installed themselves -- the official installer, a wrapper of
+# their own -- is not ours to replace. --check follows whether it runs, and
+# installing steps aside so the default agent uses it.
+official_body="#!/bin/bash
+unset PYTHONPATH
+unset PYTHONHOME
+exec $test_home/.hermes/hermes-agent/venv/bin/hermes \"\$@\""
+printf '%s\n' "$official_body" >"$test_home/.local/bin/hermes"
+chmod +x "$test_home/.local/bin/hermes"
+run_installer 0 --check || fail "--check accepts a working foreign hermes command"
+run_installer 0 || fail "installing over a foreign hermes command returns success"
+run_installer 0 --now || fail "--now over a foreign hermes command returns success"
+[[ $(cat "$test_home/.local/bin/hermes") == "$official_body" ]] ||
+  fail "a foreign hermes command is left untouched"
+pass "a foreign hermes command is preserved and satisfies --check"
+
+# Broken foreign paths are still foreign. They cannot be used, so --check says
+# so and the installer refuses rather than replacing them.
+printf '%s\n' "$official_body" >"$test_home/.local/bin/hermes"
+chmod -x "$test_home/.local/bin/hermes"
+run_installer 0 --check && fail "--check rejects a non-executable foreign hermes"
+run_installer 0 && fail "the installer does not succeed over a non-executable foreign hermes"
+[[ -f $test_home/.local/bin/hermes && ! -x $test_home/.local/bin/hermes ]] ||
+  fail "a non-executable foreign hermes is left untouched"
+pass "a non-executable foreign hermes is preserved"
+
+foreign_target="$test_home/foreign/hermes"
+mkdir -p "$(dirname "$foreign_target")"
+printf '%s\n' "$official_body" >"$foreign_target"
+chmod +x "$foreign_target"
+rm -f "$test_home/.local/bin/hermes"
+ln -s "$foreign_target" "$test_home/.local/bin/hermes"
+run_installer 0 --check || fail "--check accepts a foreign link to a working hermes command"
+run_installer 0 || fail "the installer succeeds over a foreign link to a working hermes command"
+run_installer 0 --now || fail "--now succeeds over a foreign link to a working hermes command"
+[[ -L $test_home/.local/bin/hermes && $(readlink "$test_home/.local/bin/hermes") == "$foreign_target" ]] ||
+  fail "a foreign link to a working hermes command is left untouched"
+pass "a foreign link to a working hermes command is preserved"
+
+rm -f "$test_home/.local/bin/hermes"
+ln -s "$test_home/nowhere/hermes" "$test_home/.local/bin/hermes"
+run_installer 0 --check && fail "--check rejects a dangling hermes link"
+run_installer 0 && fail "the installer does not succeed over a dangling hermes link"
+[[ -L $test_home/.local/bin/hermes && $(readlink "$test_home/.local/bin/hermes") == "$test_home/nowhere/hermes" ]] ||
+  fail "a dangling hermes link is left untouched"
+pass "a dangling hermes link is preserved"
+
+# A directory passes -x on search permission alone. It is still not a command.
+rm -f "$test_home/.local/bin/hermes"
+mkdir "$test_home/.local/bin/hermes"
+run_installer 0 --check && fail "--check rejects a directory at the hermes path"
+run_installer 0 && fail "the installer does not succeed over a directory at the hermes path"
+[[ -d $test_home/.local/bin/hermes ]] || fail "a directory at the hermes path is left untouched"
+pass "a directory at the hermes path is preserved and rejected"
+
+# Mentioning the installer is not the same as being written by it.
+rmdir "$test_home/.local/bin/hermes"
+mentions_body='#!/bin/bash
+# Replaces the stub omarchy-install-hermes-cli used to write.
+exec /usr/local/bin/hermes "$@"'
+printf '%s\n' "$mentions_body" >"$test_home/.local/bin/hermes"
+chmod +x "$test_home/.local/bin/hermes"
+run_installer 0 || fail "installing over a wrapper that mentions the installer returns success"
+[[ $(cat "$test_home/.local/bin/hermes") == "$mentions_body" ]] ||
+  fail "a wrapper that merely mentions the installer is left untouched"
+pass "ownership needs the exact marker line, not a mention"
+
+# Our own stub is ours to rewrite, so reinstalling refreshes it to the current
+# template.
+rm -f "$test_home/.local/bin/hermes"
+printf '%s\n' "#!/bin/bash" "$stub_marker" "# stale template" >"$test_home/.local/bin/hermes"
+chmod +x "$test_home/.local/bin/hermes"
+run_installer 0 || fail "reinstalling over our own stub succeeds"
+grep -qxF "$stub_marker" "$test_home/.local/bin/hermes" || fail "the refreshed stub still carries the marker"
+grep -q "stale template" "$test_home/.local/bin/hermes" && fail "reinstalling rewrites our own stub"
+grep -q "exec mise x" "$test_home/.local/bin/hermes" || fail "the refreshed stub is the current template"
+pass "reinstalling refreshes the Omarchy stub"
diff --git a/test/shell.d/preinstalls-test.sh b/test/shell.d/preinstalls-test.sh
index fb4f19a2..7aba8085 100755
--- a/test/shell.d/preinstalls-test.sh
+++ b/test/shell.d/preinstalls-test.sh
@@ -89,3 +89,43 @@ pass "declining Remove Preinstalls changes nothing"
 "$ROOT/bin/omarchy-remove-preinstalls" >/dev/null
 [[ -f $marker ]] || fail "Remove Preinstalls records the opt-out"
 pass "Remove Preinstalls records the opt-out"
+
+# Hermes' wrapper is only a preinstall when omarchy-install-hermes-cli wrote it.
+# The desktop app's command and an official install live at the same path and
+# are the user's, whether or not any package says so.
+hermes="$test_home/.local/bin/hermes"
+mkdir -p "$(dirname "$hermes")"
+
+printf '%s\n' "#!/bin/bash" "# Written by omarchy-install-hermes-cli." >"$hermes"
+chmod +x "$hermes"
+"$ROOT/bin/omarchy-remove-preinstalls" >/dev/null
+[[ ! -e $hermes ]] || fail "Remove Preinstalls deletes the Omarchy Hermes wrapper"
+pass "Remove Preinstalls deletes the Omarchy Hermes wrapper"
+
+printf '%s\n' "#!/bin/bash" "exec $test_home/.hermes/hermes-agent/venv/bin/hermes \"\$@\"" >"$hermes"
+chmod +x "$hermes"
+"$ROOT/bin/omarchy-remove-preinstalls" >/dev/null
+[[ -x $hermes ]] || fail "Remove Preinstalls keeps the desktop app's Hermes command"
+pass "Remove Preinstalls keeps the desktop app's Hermes command"
+
+official_body="#!/bin/bash
+unset PYTHONPATH
+unset PYTHONHOME
+exec $test_home/.hermes/hermes-agent/venv/bin/hermes \"\$@\""
+printf '%s\n' "$official_body" >"$hermes"
+chmod +x "$hermes"
+"$ROOT/bin/omarchy-remove-preinstalls" >/dev/null
+[[ -x $hermes && $(cat "$hermes") == "$official_body" ]] || fail "Remove Preinstalls keeps an official Hermes install"
+pass "Remove Preinstalls keeps an official Hermes install"
+
+printf '%s\n' "#!/bin/bash" "# Replaces the stub omarchy-install-hermes-cli used to write." >"$hermes"
+chmod +x "$hermes"
+"$ROOT/bin/omarchy-remove-preinstalls" >/dev/null
+[[ -x $hermes ]] || fail "Remove Preinstalls keeps a wrapper that merely mentions the installer"
+pass "Remove Preinstalls keeps a wrapper that merely mentions the installer"
+
+rm -f "$hermes"
+ln -s "$test_home/nowhere/hermes" "$hermes"
+"$ROOT/bin/omarchy-remove-preinstalls" >/dev/null
+[[ -L $hermes ]] || fail "Remove Preinstalls keeps a foreign hermes link"
+pass "Remove Preinstalls keeps a foreign hermes link"