diff --git a/hermes_cli/update_cmd.py b/hermes_cli/update_cmd.py
index cd951c11c2c44..6bf8340f417e7 100644
--- a/hermes_cli/update_cmd.py
+++ b/hermes_cli/update_cmd.py
@@ -734,7 +734,7 @@ def _read_project_version() -> str | None:
     try:
         import tomllib
 
-        with open(_m().PROJECT_ROOT / "pyproject.toml", "rb") as fh:
+        with open(_m().PROJECT_ROOT / "pyproject.toml", "rb") as fh:  # windows-footgun: ok — binary mode, tomllib requires bytes
             version = tomllib.load(fh).get("project", {}).get("version")
         return str(version) if version else None
     except Exception: