diff --git a/deploy/README.md b/deploy/README.md
index 86dbd67..de6d60f 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -40,3 +40,31 @@ reboot). Then `ump.recall` would fall back to canonical ump via the
 shim's fallback path — which works, but loses RRF fusion and the graph
 channel. Now the sidecar is persistent and the MCP recall quality is
 uninterrupted.
+
+## krystie-hermes-gateway.service
+
+Manages the krystie-profile Hermes gateway (the Telegram session
+attributed to krystie).
+
+**Install (idempotent):**
+```bash
+sudo cp deploy/krystie-hermes-gateway.service /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now krystie-hermes-gateway.service
+sudo systemctl status krystie-hermes-gateway.service
+```
+
+**Important:** Before installing, stop any manually-launched krystie
+gateway (`pgrep -f 'gateway run --replace -p krystie'` then
+`kill -INT <pid>`). Wait ~10s for the Telegram session to release,
+then start the systemd unit. Telegram reconnects in ~5s.
+
+**Deps:** ump-memory.service, ump-recall-sidecar.service.
+
+**Why this exists:** Before this unit, the krystie gateway was launched
+manually, holding stale env (including UMP_DIR) from whatever was in
+the env when the user typed the command. After the openclaw→Hermes ump
+migration, krystie's MCP shim children were inheriting stale UMP_DIR
+and silently dropping writes. Now the gateway is systemd-managed so
+its shim and the canonical ump recompute their env together on every
+restart — drift can no longer accumulate silently.
diff --git a/deploy/krystie-hermes-gateway.service b/deploy/krystie-hermes-gateway.service
new file mode 100644
index 0000000..42318fe
--- /dev/null
+++ b/deploy/krystie-hermes-gateway.service
@@ -0,0 +1,27 @@
+[Unit]
+Description=Hermes Gateway — krystie profile (Telegram session)
+After=network.target ump-memory.service ump-recall-sidecar.service
+Wants=ump-memory.service ump-recall-sidecar.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/root
+ExecStart=/usr/local/lib/hermes-agent/venv/bin/python -m hermes_cli.main gateway run -p krystie --replace
+
+# Always restart — handles OOM kills, hot reloads, dev iterations.
+# --replace ensures only one instance owns the Telegram connection.
+Restart=always
+RestartSec=5
+
+# Graceful shutdown — gives Telegram polling time to ACK disconnect
+KillSignal=SIGINT
+TimeoutStopSec=30
+
+# Logging — flows through journal with this identifier
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=hermes-gateway-krystie
+
+[Install]
+WantedBy=multi-user.target