diff --git a/doc/plans/2026-10-06-hermes-native-runner.md b/doc/plans/2026-10-06-hermes-native-runner.md
index 7fa9579b78f..e735852535e 100644
--- a/doc/plans/2026-10-06-hermes-native-runner.md
+++ b/doc/plans/2026-10-06-hermes-native-runner.md
@@ -1172,3 +1172,14 @@ Cloud diagnostics now retain the candidate file manifest before rejected setup
 removes its temporary distribution. The original materializer and closure pin
 checks remain unchanged. Exact differing files must be identified and explained
 before changing any reviewed runtime pin.
+
+The diagnostic manifest establishes that only `python/lib/libpython3.12.dylib`
+differs; the other 19,248 files are identical. Explicitly re-signing a task-owned
+copy with 4 KiB pages reproduces the rejected cloud hash
+`c592b475f247692c43a3c9de87d999c888adf89456d6986722d781425a402486` and size
+18,075,920 bytes. Signing with 16 KiB pages reproduces the reviewed hash
+`076cd19d748b2409ba5d82b530b68506f07c8edb4d920ac2cfaa8c34e3311d97` and size
+17,970,928 bytes. Both signatures verify; the original runtime is untouched.
+The materializer now specifies 16 KiB signing pages explicitly. No runtime pin,
+dependency, native code, or credential boundary changes. Fresh cold cloud
+provisioning remains required to establish that the correction passes.
diff --git a/packages/paperclip-runner/scripts/materialize-hermes.py b/packages/paperclip-runner/scripts/materialize-hermes.py
index 5a90ed9568b..9e981faeae7 100644
--- a/packages/paperclip-runner/scripts/materialize-hermes.py
+++ b/packages/paperclip-runner/scripts/materialize-hermes.py
@@ -41,7 +41,9 @@ if sys.platform == "darwin":
     if not shutil.which("install_name_tool") or not shutil.which("codesign"):
         raise ValueError("Hermes provisioning requires macOS Command Line Tools (install_name_tool and codesign)")
     subprocess.run(["install_name_tool", "-id", "@rpath/libpython3.12.dylib", str(library)], check=True)
-    subprocess.run(["codesign", "--force", "--sign", "-", "--identifier", "paperclip.hermes.libpython3.12", "--timestamp=none", str(library)], check=True)
+    # macOS 15 and 26 default to different code-signing page granularities.
+    # Keep the reviewed library's 16 KiB hash slots on every provisioning host.
+    subprocess.run(["codesign", "--force", "--sign", "-", "--identifier", "paperclip.hermes.libpython3.12", "--timestamp=none", "--pagesize", "16384", str(library)], check=True)
 site = destination / "python/lib/python3.12/site-packages"
 site.mkdir(parents=True, exist_ok=True)
 # Do not retain editable-install locators, virtualenv hooks, or provenance files