diff --git a/lib/hermes.js b/lib/hermes.js
index 6c169759..a0b5e848 100644
--- a/lib/hermes.js
+++ b/lib/hermes.js
@@ -18,6 +18,26 @@ import {
   verifyEvent, nip19, nip44,
 } from "nostr-tools";
 
+// --- scryptSync maxmem monkey-patch ----------------------------------------
+// node:crypto defaults scryptSync's maxmem option to 32 MiB. The host-side
+// mnemonic wrap uses N=2^15 r=8 p=1 which needs ~32 MiB exactly — Node throws
+// MEMORY_LIMIT_EXCEEDED on the boundary. Lift the ceiling here so the Create
+// account button stops erroring. Lives in this file (loaded dynamically from
+// resources/lib/hermes.mjs, outside app.asar) so an installed Theseus can be
+// hot-patched by replacing this file alone — a main.js fix would be stuck
+// inside the asar until a new release ships.
+import { createRequire as _createRequire } from "node:module";
+const _requireFromHermes = _createRequire(import.meta.url);
+const _nodeCryptoShared = _requireFromHermes("node:crypto");
+const _origScryptSync = _nodeCryptoShared.scryptSync;
+if (!_nodeCryptoShared.__hermesScryptPatched) {
+  _nodeCryptoShared.scryptSync = function (password, salt, keylen, options) {
+    const opts = Object.assign({ maxmem: 128 * 1024 * 1024 }, options || {});
+    return _origScryptSync.call(this, password, salt, keylen, opts);
+  };
+  _nodeCryptoShared.__hermesScryptPatched = true;
+}
+
 const enc = new TextEncoder();
 
 // ---- key derivation --------------------------------------------------------