diff --git a/nightly.nix b/nightly.nix
index 8e40e0d..ced1fb8 100644
--- a/nightly.nix
+++ b/nightly.nix
@@ -2,7 +2,7 @@
 # Auto-updated by scripts/update-nightly.sh — do not edit manually.
 { pkgs }:
 pkgs.callPackage ./package.nix {
-  pinVersion = "0.0.0-unstable-2026-09-29.536802c0";
+  pinVersion = "0.21.5-unstable-2026-09-29.536802c0";
   pinRev = "536802c00e4f93061fc46b134dc029ff695f364f";
   pinHash = "sha256-5IdY6zQjaGCWkz2Mg8UT2a2VZ+6RH1xsL2gI9VjRQg4=";
 }
diff --git a/scripts/update-common.sh b/scripts/update-common.sh
index db0a682..7c23683 100755
--- a/scripts/update-common.sh
+++ b/scripts/update-common.sh
@@ -11,6 +11,14 @@ extract_sri_hash() {
   sed -nE 's/.*got:[[:space:]]*(sha256-[A-Za-z0-9+\/=]+).*/\1/p' "$1" | head -1
 }
 
+# Echo the ``[project]`` version from upstream's pyproject.toml at a git ref
+# (branch, tag or commit sha).
+upstream_pyproject_version() {
+  gh api -H "Accept: application/vnd.github.raw+json" \
+    "/repos/NousResearch/hermes-agent/contents/pyproject.toml?ref=${1}" |
+    python3 -c 'import sys, tomllib; print(tomllib.load(sys.stdin.buffer)["project"]["version"])'
+}
+
 realize_flake_source() {
   nix build "$1.src" --no-link --print-out-paths 2>/dev/null | tail -1 || true
 }
diff --git a/scripts/update-nightly.sh b/scripts/update-nightly.sh
index 622e7d8..ac5b022 100755
--- a/scripts/update-nightly.sh
+++ b/scripts/update-nightly.sh
@@ -28,11 +28,23 @@ if [[ "$current_rev" == "$head_sha" ]]; then
   exit 0
 fi
 
-upstream_version=$(
-  gh api -H "Accept: application/vnd.github.raw+json" \
-    "/repos/NousResearch/hermes-agent/contents/pyproject.toml?ref=${head_sha}" |
-    python3 -c 'import sys, tomllib; print(tomllib.load(sys.stdin.buffer)["project"]["version"])'
-)
+upstream_version=$(upstream_pyproject_version "$head_sha")
+
+# Upstream resets the [project] version to a placeholder (0.0.0) on main between
+# releases. Pinning that verbatim would regress pinVersion from a real release to
+# 0.0.0; update-pins.sh aborts the stable channel on such a downgrade, but the
+# nightly tracks unreleased HEAD, so fall back to the latest release's version.
+if [[ "$upstream_version" == "0.0.0" ]]; then
+  release_tag=$(gh api /repos/NousResearch/hermes-agent/releases/latest --jq '.tag_name // empty' || true)
+  if [[ -n "$release_tag" ]]; then
+    release_version=$(upstream_pyproject_version "$release_tag" || true)
+    if [[ -n "$release_version" && "$release_version" != "0.0.0" ]]; then
+      log "Upstream ${head_sha:0:12} declares a placeholder version; using ${release_tag} version ${release_version}"
+      upstream_version="$release_version"
+    fi
+  fi
+fi
+
 python3 - "$upstream_version" <<'PY' || die "upstream pyproject contains an invalid version"
 import re, sys
 raise SystemExit(0 if re.fullmatch(r"\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?", sys.argv[1]) else 1)
diff --git a/scripts/update-pins.sh b/scripts/update-pins.sh
index 17e16ad..fd34c2f 100755
--- a/scripts/update-pins.sh
+++ b/scripts/update-pins.sh
@@ -34,11 +34,7 @@ for _depth in 1 2 3 4 5; do
 done
 [[ "$tag_type" == "commit" && -n "$tag_sha" ]] || die "release tag does not resolve to a commit"
 
-upstream_version=$(
-  gh api -H "Accept: application/vnd.github.raw+json" \
-    "/repos/NousResearch/hermes-agent/contents/pyproject.toml?ref=${tag_sha}" |
-    python3 -c 'import sys, tomllib; print(tomllib.load(sys.stdin.buffer)["project"]["version"])'
-)
+upstream_version=$(upstream_pyproject_version "$tag_sha")
 current_version=$(awk -F'"' '/pinVersion \? "/{print $2; exit}' "$package_file")
 current_rev=$(awk -F'"' '/pinRev \? "/{print $2; exit}' "$package_file")
 [[ -n "$current_version" && -n "$current_rev" ]] || die "could not read current stable pin"