From 882cb6fd700ad050d9dc5d7de8b440e27883a462 Mon Sep 17 00:00:00 2001
From: Ben Johnson <ben@binarylogic.com>
Date: Tue, 31 Mar 2026 10:13:42 -0700
Subject: [PATCH 1/2] chore: use the company Hermit source overlay

---
 bin/hermit.hcl | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/bin/hermit.hcl b/bin/hermit.hcl
index 081cbe83..297f1580 100644
--- a/bin/hermit.hcl
+++ b/bin/hermit.hcl
@@ -1,2 +1,4 @@
+sources = ["https://github.com/usetero/hermit-packages.git", "https://github.com/cashapp/hermit-packages.git"]
+
 github-token-auth {
 }

From c4895f44920b0eaf2dd081dac8eddd53e37e5dbd Mon Sep 17 00:00:00 2001
From: Ben Johnson <ben@binarylogic.com>
Date: Tue, 31 Mar 2026 10:31:59 -0700
Subject: [PATCH 2/2] fix: authenticate Hermit overlay in benchmark workflow

---
 .github/workflows/benchmark.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/benchmark.yaml b/.github/workflows/benchmark.yaml
index 064898f1..c3896144 100644
--- a/.github/workflows/benchmark.yaml
+++ b/.github/workflows/benchmark.yaml
@@ -28,10 +28,22 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Generate token
+        id: generate-token
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        with:
+          app-id: ${{ secrets.TERO_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.TERO_BOT_PRIVATE_SIGNING_KEY }}
+          owner: ${{ github.repository_owner }}
+
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
+          token: ${{ steps.generate-token.outputs.token }}
+
+      - name: Configure Git for private Hermit sources
+        run: git config --global url.https://x-access-token:${{ steps.generate-token.outputs.token }}@github.com/.insteadOf https://github.com/
 
       - name: Setup Hermit
         uses: cashapp/activate-hermit@12a728b03ad41eace0f9abaf98a035e7e8ea2318 # v1.1.4