diff --git a/hermes-key-enforcement.prose.md b/hermes-key-enforcement.prose.md
index 4b50ed4..67bc906 100644
--- a/hermes-key-enforcement.prose.md
+++ b/hermes-key-enforcement.prose.md
@@ -74,8 +74,9 @@ model:
 Run on any Hermes host to detect violations:
 
 ```bash
-grep -n 'api_key: sk-' /root/.hermes/config.yaml \
-  | grep -v 'deepseek\|b7d9\|openai\|anthropic\|DEEPSEEK'
+grep -rn 'api_key: sk-' /root/.hermes/ \
+  --include='config.yaml' \
+  | grep -v 'deepseek\|openai\|anthropic\|DEEPSEEK'
 ```
 
 If any output — violation. Fix immediately.
@@ -157,6 +158,7 @@ EnvironmentFile=/etc/environment
 4. **Restart** — gateway must restart to pick up env var
 5. **Confirm** — test key against LiteLLM: `curl -H "Authorization: Bearer $KEY" .../v1/models` → 200
 6. **Update** — bump the verified table above
+7. **Use safe-mutate** — if the fix requires changing `/etc/environment` or restarting the gateway on a remote host, use `safe-mutate` to verify current state before mutating.
 
 ## Related Contracts