diff --git a/home/common.nix b/home/common.nix
new file mode 100644
index 0000000..cd05528
--- /dev/null
+++ b/home/common.nix
@@ -0,0 +1,17 @@
+# Shared home-manager profile for darman, applied on every host via
+# common.nix. Host-specific extras (terra's desktop/dev tooling) layer on
+# top via their own home-manager.users.darman.imports entry, same pattern
+# used here — see hosts/terra/configuration.nix + hosts/terra/home.nix.
+{ ... }:
+{
+  home.stateVersion = "26.05";
+  programs.home-manager.enable = true;
+
+  # Matches terra's baseline (compinit, deduped/shared history, HISTFILE
+  # under $HOME). home-manager owns ~/.zshrc + ~/.zshenv as real files, which
+  # also means zsh's built-in zsh-newuser-install wizard never fires on
+  # first interactive login (it only triggers when none of
+  # .zshenv/.zprofile/.zshrc/.zlogin exist) — that used to happen on every
+  # host except terra.
+  programs.zsh.enable = true;
+}
diff --git a/hosts/mars/hermes-agent.nix b/hosts/mars/hermes-agent.nix
index 23a70f4..d196f33 100644
--- a/hosts/mars/hermes-agent.nix
+++ b/hosts/mars/hermes-agent.nix
@@ -23,7 +23,9 @@
 #     TELEGRAM_ALLOWED_USERS.
 #   - Runs as a rootful podman container (services/containers.nix) with its
 #     OWN numeric uid/gid — not darman, who is in the "hermes" group for
-#     host-level debugging only (`podman exec -it hermes-agent hermes ...`).
+#     host-level debugging only (`hermes ...` alias below, needs sudo since
+#     the container itself runs under root's podman, not darman's rootless
+#     one).
 #
 # Dashboard (HERMES_DASHBOARD=1) is gated behind Authentik, same setup as on
 # jupiter. Its default bind (0.0.0.0:9119) fails closed without an auth
@@ -75,6 +77,13 @@ in
   users.groups.hermes.gid = 983;
   users.users.darman.extraGroups = [ "hermes" ];
 
+  # `hermes <args>` on mars == `sudo podman exec -it hermes-agent hermes <args>`.
+  # sudo is required: virtualisation.oci-containers runs rootful (system)
+  # podman, a separate namespace from darman's own rootless `podman`/`docker`
+  # — darman's "hermes"/"docker" group membership only grants filesystem
+  # access to the bind-mounted state dir, not to root's container socket.
+  programs.zsh.shellAliases.hermes = "sudo podman exec -it hermes-agent hermes";
+
   systemd.tmpfiles.rules = [
     "d ${stateDir} 0750 root hermes -"
   ];