diff --git a/hermes/.env.example b/hermes/.env.example
index b1e0169..abd9b4d 100644
--- a/hermes/.env.example
+++ b/hermes/.env.example
@@ -14,6 +14,12 @@ HERMES_DASHBOARD_SECRET=
 # Model provider for the agent.
 OPENROUTER_API_KEY=
 
+# Telegram gateway: bot token, then comma-separated user ids and group chat ids
+# allowed to talk to it. An empty token leaves Telegram off.
+TELEGRAM_BOT_TOKEN=
+TELEGRAM_ALLOWED_USERS=
+TELEGRAM_GROUP_ALLOWED_CHATS=
+
 # Other providers. Uncomment here and in compose.yml to enable one.
 # ANTHROPIC_API_KEY=
 # OPENAI_API_KEY=
diff --git a/hermes/README.md b/hermes/README.md
index d131070..791ee6c 100644
--- a/hermes/README.md
+++ b/hermes/README.md
@@ -26,6 +26,8 @@ Health check: `GET /api/status`, also the compose healthcheck.
 | `HERMES_DASHBOARD_USERNAME` / `HERMES_DASHBOARD_PASSWORD` | `hermes` / — | Dashboard login |
 | `HERMES_DASHBOARD_SECRET` | — | Signs dashboard sessions |
 | `OPENROUTER_API_KEY` | empty | Model provider |
+| `TELEGRAM_BOT_TOKEN` | empty | Telegram bot; empty leaves Telegram off |
+| `TELEGRAM_ALLOWED_USERS` / `TELEGRAM_GROUP_ALLOWED_CHATS` | empty | Telegram users and group chats allowed to use the bot |
 | `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GOOGLE_API_KEY` | optional | Other model providers |
 
 `HERMES_DASHBOARD=1` turns the dashboard on. Bound to `0.0.0.0`, it refuses to
diff --git a/hermes/compose.yml b/hermes/compose.yml
index 07d28de..8d86fa8 100644
--- a/hermes/compose.yml
+++ b/hermes/compose.yml
@@ -14,6 +14,9 @@ services:
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
       - HERMES_WRITE_SAFE_ROOT=/opt/data:/workspace
       - TERMINAL_CWD=/workspace
+      - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-}
+      - TELEGRAM_ALLOWED_USERS=${TELEGRAM_ALLOWED_USERS:-}
+      - TELEGRAM_GROUP_ALLOWED_CHATS=${TELEGRAM_GROUP_ALLOWED_CHATS:-}
       # - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
       # - OPENAI_API_KEY=${OPENAI_API_KEY:-}
       # - GOOGLE_API_KEY=${GOOGLE_API_KEY:-}