diff --git a/__tests__/installer-targets.test.ts b/__tests__/installer-targets.test.ts
index 59e869e2..a239c7eb 100644
--- a/__tests__/installer-targets.test.ts
+++ b/__tests__/installer-targets.test.ts
@@ -341,8 +341,8 @@ describe('Installer targets — partial-state idempotency', () => {
     expect(body).toContain('model:\n  default: qwen-3.7');
     expect(body).toContain('mcp_servers:\n  other:\n    command: other');
     expect(body).toContain('  codegraph:\n    command: codegraph');
-    expect(body).toContain('    - hermes-cli');
-    expect(body).toContain('    - mcp-codegraph');
+    expect(body).toContain('  - hermes-cli');
+    expect(body).toContain('  - mcp-codegraph');
     expect(body).toContain('  discord:\n    - hermes-discord');
 
     const second = hermes.install('global', { autoAllow: true });
diff --git a/package-lock.json b/package-lock.json
index 36c592b1..d9b3b484 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@colbymchenry/codegraph",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@colbymchenry/codegraph",
-      "version": "0.9.3",
+      "version": "0.9.4",
       "license": "MIT",
       "dependencies": {
         "@clack/prompts": "^1.3.0",
@@ -1431,7 +1431,6 @@
       "integrity": "sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.21.3",
         "postcss": "^8.4.43",
diff --git a/src/installer/targets/hermes.ts b/src/installer/targets/hermes.ts
index b6abfb94..b948799a 100644
--- a/src/installer/targets/hermes.ts
+++ b/src/installer/targets/hermes.ts
@@ -177,7 +177,15 @@ function childRange(lines: string[], parent: LineRange, child: string): LineRang
   for (let i = start + 1; i < parent.end; i++) {
     const line = lines[i] ?? '';
     if (line.trim() === '') continue;
-    if (/^  \S/.test(line)) {
+    // YAML allows both:
+    //   cli:
+    //   - file
+    // and:
+    //   cli:
+    //     - file
+    // A line beginning with "  -" is still part of the current child, not
+    // the next platform key. Only a sibling mapping key ends this child.
+    if (/^  [A-Za-z_][A-Za-z0-9_-]*:\s*(?:#.*)?$/.test(line)) {
       end = i;
       break;
     }
@@ -248,6 +256,14 @@ function removeCodeGraphMcpServer(content: string): string {
   return joinLines(lines);
 }
 
+function listItemIndent(lines: string[], range: LineRange, fallback: string): string {
+  for (const line of lines.slice(range.start + 1, range.end)) {
+    const match = /^(\s*)-\s+/.exec(line);
+    if (match) return match[1] ?? fallback;
+  }
+  return fallback;
+}
+
 function upsertCodeGraphToolset(content: string): string {
   const lines = splitLines(content);
   const parent = topLevelRange(lines, 'platform_toolsets');
@@ -261,7 +277,7 @@ function upsertCodeGraphToolset(content: string): string {
   }
 
   if (!cli) {
-    lines.splice(parent.end, 0, '  cli:', '    - hermes-cli', '    - mcp-codegraph');
+    lines.splice(parent.end, 0, '  cli:', '  - hermes-cli', '  - mcp-codegraph');
     return joinLines(lines);
   }
 
@@ -270,7 +286,8 @@ function upsertCodeGraphToolset(content: string): string {
     .some((line) => line.trim() === '- mcp-codegraph');
   if (hasEntry) return joinLines(lines);
 
-  lines.splice(cli.end, 0, '    - mcp-codegraph');
+  const indent = listItemIndent(lines, cli, '  ');
+  lines.splice(cli.end, 0, `${indent}- mcp-codegraph`);
   return joinLines(lines);
 }