diff --git a/web/src/contexts/SystemActions.tsx b/web/src/contexts/SystemActions.tsx
index de4ef4395..976bf4c32 100644
--- a/web/src/contexts/SystemActions.tsx
+++ b/web/src/contexts/SystemActions.tsx
@@ -71,10 +71,28 @@ export function SystemActionsProvider({
       try {
         if (action === "restart") {
           await api.restartGateway();
+          setActiveAction(action);
         } else {
-          await api.updateHermes();
+          const resp = await api.updateHermes();
+          // In a Docker install the image is immutable, so `hermes update`
+          // can't apply — the endpoint returns 200 with a structured
+          // {ok:false, error:"docker_update_unsupported", message, update_command}
+          // envelope instead of spawning the action (see #34347 / #36263).
+          // Surface that guidance to the user rather than starting the poll,
+          // which would otherwise report a generic "failed (exit 1)".
+          if (!resp.ok && resp.error === "docker_update_unsupported") {
+            const cmd = resp.update_command ? `  ${resp.update_command}` : "";
+            setToast({
+              type: "success",
+              message:
+                (resp.message ??
+                  "Updates don't apply inside Docker — re-pull the image instead.") +
+                cmd,
+            });
+            return;
+          }
+          setActiveAction(action);
         }
-        setActiveAction(action);
       } catch (err) {
         const detail = err instanceof Error ? err.message : String(err);
         setToast({