diff --git a/tests/hermes_cli/test_migrate_xai.py b/tests/hermes_cli/test_migrate_xai.py
index cf30099161..74099b2969 100644
--- a/tests/hermes_cli/test_migrate_xai.py
+++ b/tests/hermes_cli/test_migrate_xai.py
@@ -1,6 +1,7 @@
 """Tests for ``hermes migrate xai`` — apply path with ruamel round-trip."""
 from __future__ import annotations
 
+import sys
 from pathlib import Path
 
 import pytest
@@ -269,6 +270,7 @@ class TestCrashDurability:
         assert real.read_text(encoding="utf-8") == link.read_text(encoding="utf-8")
         assert "grok-4.3" in real.read_text(encoding="utf-8")
 
+    @pytest.mark.skipif(sys.platform == "win32", reason="POSIX permission bits")
     def test_existing_file_mode_is_preserved(self, trap_config: Path):
         """Managed (NixOS 0640) and container installs widen config.yaml
         deliberately; the migration must not silently tighten it to 0600."""
diff --git a/tests/hermes_cli/test_profile_distribution.py b/tests/hermes_cli/test_profile_distribution.py
index dc6a45dfe4..b0282efe85 100644
--- a/tests/hermes_cli/test_profile_distribution.py
+++ b/tests/hermes_cli/test_profile_distribution.py
@@ -10,6 +10,7 @@ mocking git would just test the mock.
 
 from __future__ import annotations
 
+import sys
 from pathlib import Path
 
 import pytest
@@ -720,6 +721,9 @@ class TestManifestCrashDurability:
         # No temp file left behind next to the manifest.
         assert list(tmp_path.glob("*.tmp")) == []
 
+    @pytest.mark.skipif(
+        sys.platform == "win32", reason="POSIX permission bits"
+    )
     def test_existing_file_mode_is_preserved(self, tmp_path):
         import os
         import stat
diff --git a/tests/hermes_cli/test_uninstall_shell_configs.py b/tests/hermes_cli/test_uninstall_shell_configs.py
index ccb5fc1cce..4cc9bc1b97 100644
--- a/tests/hermes_cli/test_uninstall_shell_configs.py
+++ b/tests/hermes_cli/test_uninstall_shell_configs.py
@@ -10,6 +10,7 @@ from __future__ import annotations
 
 import os
 import stat
+import sys
 from pathlib import Path
 
 import pytest
@@ -104,6 +105,7 @@ class TestCrashDurability:
         assert "# Hermes Agent" not in real.read_text(encoding="utf-8")
         assert "export EDITOR=vim" in real.read_text(encoding="utf-8")
 
+    @pytest.mark.skipif(sys.platform == "win32", reason="POSIX permission bits")
     def test_existing_file_mode_is_preserved(self, fake_home: Path):
         """Shell rc files are normally 0644; uninstalling must not change that."""
         rc = fake_home / ".zshrc"
diff --git a/tests/hermes_cli/test_web_profile_soul_writes.py b/tests/hermes_cli/test_web_profile_soul_writes.py
index e912110fc5..752529666f 100644
--- a/tests/hermes_cli/test_web_profile_soul_writes.py
+++ b/tests/hermes_cli/test_web_profile_soul_writes.py
@@ -14,6 +14,7 @@ from __future__ import annotations
 
 import os
 import stat
+import sys
 from pathlib import Path
 
 import pytest
@@ -96,6 +97,7 @@ class TestSoulWriteDurability:
         # No temp file left behind in the profile directory.
         assert list(profile_dir.glob("*.tmp")) == []
 
+    @pytest.mark.skipif(sys.platform == "win32", reason="POSIX permission bits")
     def test_existing_file_mode_is_preserved(self, client, profile_dir: Path):
         """Profile SOUL.md is created 0644 and never run through
         ``_secure_file``; saving from the dashboard must not change that."""