diff --git a/internal/embed/networks/ethereum/helmfile.yaml.gotmpl b/internal/embed/networks/ethereum/helmfile.yaml.gotmpl
index 6c0540740..b1d20c9f0 100644
--- a/internal/embed/networks/ethereum/helmfile.yaml.gotmpl
+++ b/internal/embed/networks/ethereum/helmfile.yaml.gotmpl
@@ -97,7 +97,7 @@ releases:
             tag: v1.17.5
             {{- else if eq .Values.executionClient "nethermind" }}
             # renovate: datasource=github-releases depName=NethermindEth/nethermind
-            tag: "1.39.2"
+            tag: "1.39.3"
             {{- else if eq .Values.executionClient "besu" }}
             # renovate: datasource=github-releases depName=hyperledger/besu
             tag: "26.7.1"
diff --git a/internal/hermes/hermes.go b/internal/hermes/hermes.go
index 98eb52adc..8e5a6bc9e 100644
--- a/internal/hermes/hermes.go
+++ b/internal/hermes/hermes.go
@@ -37,7 +37,7 @@ const (
 	rawChartVersion = "2.0.2"
 
 	// renovate: datasource=docker depName=nousresearch/hermes-agent
-	defaultImage = "nousresearch/hermes-agent:v2026.7.7.2"
+	defaultImage = "nousresearch/hermes-agent:v2026.8.3"
 	// Use the upstream image venv instead of cloning Hermes into the PVC on
 	// every cold start. The init container below validates the required extras
 	// are present so image regressions fail before the gateway starts.
diff --git a/internal/serviceoffercontroller/agent_render.go b/internal/serviceoffercontroller/agent_render.go
index 6a14341a5..63a31d0b8 100644
--- a/internal/serviceoffercontroller/agent_render.go
+++ b/internal/serviceoffercontroller/agent_render.go
@@ -29,7 +29,7 @@ const (
 	hermesDataPVC      = "hermes-data"
 	hermesAPIPath      = "/health"
 	// renovate: datasource=docker depName=nousresearch/hermes-agent
-	defaultHermesImage = "nousresearch/hermes-agent:v2026.7.7.2"
+	defaultHermesImage = "nousresearch/hermes-agent:v2026.8.3"
 )
 
 // agentLabels returns the standard label set we attach to every primitive
diff --git a/internal/serviceoffercontroller/scalar_html.go b/internal/serviceoffercontroller/scalar_html.go
index c77f21d6d..c24a71b9b 100644
--- a/internal/serviceoffercontroller/scalar_html.go
+++ b/internal/serviceoffercontroller/scalar_html.go
@@ -14,7 +14,7 @@ import (
 // payload never drifts silently. After a bump, refresh the SRI hash below
 // with scripts/update-scalar-sri.sh (the renovate PR body links it too).
 // renovate: datasource=npm depName=@scalar/api-reference
-const scalarBundleVersion = "1.64.0"
+const scalarBundleVersion = "1.64.1"
 
 // scalarBundleSRI is the Subresource Integrity hash for the pinned bundle.
 // The /api page is served over the public tunnel, so the third-party Scalar
@@ -24,7 +24,7 @@ const scalarBundleVersion = "1.64.0"
 // bundle and rewrites this constant). The hash is taken over the exact
 // (jsdelivr-minified) bytes that the pinned URL serves; it must be refreshed
 // in lockstep with scalarBundleVersion or the browser will block the script.
-const scalarBundleSRI = "sha384-MjGH/UsAZcRWbWSD70Yp9VOYGaCELxb+2a6meIvJsl5NkpqfdvkepJM6+ExL2Vmv"
+const scalarBundleSRI = "sha384-SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W"
 
 // scalarHTML returns the static HTML shell served at /api. It loads the
 // pinned @scalar/api-reference bundle from jsdelivr, points it at the