diff --git a/hub/onboard-spoke.sh b/hub/onboard-spoke.sh
index d2a1ce0..4d766ae 100644
--- a/hub/onboard-spoke.sh
+++ b/hub/onboard-spoke.sh
@@ -4,23 +4,29 @@ set -euo pipefail
 RCLONE_CONF="${HOME}/.config/rclone/rclone.conf"
 SSH_DIR="${HOME}/.ssh"
 
-if [ "$(id -u)" -eq 0 ]; then
-    echo -e "\033[0;31m[WARNING]\033[0m Running as root — keys will be written to /root/.ssh. Run as armbian instead."
-    exit 1
-fi
-mkdir -p "$SSH_DIR"
-touch "$SSH_DIR/known_hosts"
-chmod 700 "$SSH_DIR"
-chmod 600 "$SSH_DIR/known_hosts"
-
-check_deps ssh ssh-keygen ssh-keyscan ssh-copy-id rclone
-
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
 CYAN='\033[0;36m'
 NC='\033[0m'
 
+info()   { echo -e "${GREEN}[+]${NC} $*"; }
+warn()   { echo -e "${YELLOW}[!]${NC} $*"; }
+die()    { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
+header() { echo -e "\n${CYAN}══════════════════════════════════════════${NC}"; echo -e "${CYAN}  $*${NC}"; echo -e "${CYAN}══════════════════════════════════════════${NC}"; }
+
+check_deps() {
+    local missing=()
+    for cmd in "$@"; do
+        if ! command -v "$cmd" >/dev/null 2>&1; then
+            missing+=("$cmd")
+        fi
+    done
+    if [ ${#missing[@]} -gt 0 ]; then
+        die "Missing required dependencies: ${missing[*]}"
+    fi
+}
+
 retry_or_abort() {
     local test_cmd="$1"
     local fail_msg="$2"
@@ -40,36 +46,30 @@ retry_or_abort() {
     done
 }
 
-info()   { echo -e "${GREEN}[+]${NC} $*"; }
-check_deps() {
-    local missing=()
-    for cmd in "$@"; do
-        if ! command -v "$cmd" >/dev/null 2>&1; then
-            missing+=("$cmd")
-        fi
-    done
-    if [ ${#missing[@]} -gt 0 ]; then
-        die "Missing required dependencies: ${missing[*]}"
-    fi
-}
+if [ "$(id -u)" -eq 0 ]; then
+    die "Running as root — keys will be written to /root/.ssh. Run as the hub user instead."
+fi
+mkdir -p "$SSH_DIR"
+touch "$SSH_DIR/known_hosts"
+chmod 700 "$SSH_DIR"
+chmod 600 "$SSH_DIR/known_hosts"
 
-
-warn()   { echo -e "${YELLOW}[!]${NC} $*"; }
-die()    { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
-header() { echo -e "\n${CYAN}══════════════════════════════════════════${NC}"; echo -e "${CYAN}  $*${NC}"; echo -e "${CYAN}══════════════════════════════════════════${NC}"; }
+check_deps ssh ssh-keygen ssh-keyscan ssh-copy-id rclone
 
 header "TinyBoard Hub — Onboard New Spoke"
 
+read -rp "Spoke local user [armbian]: " SPOKE_USER
+SPOKE_USER="${SPOKE_USER:-armbian}"
+
 read -rp "Spoke name (e.g. rocky): " SPOKE_NAME
 [ -n "$SPOKE_NAME" ] || die "Spoke name cannot be empty"
 
 read -rp "Tunnel port for $SPOKE_NAME: " TUNNEL_PORT
 [[ "$TUNNEL_PORT" =~ ^[0-9]+$ ]] || die "Invalid port"
 
-KEY_NAME="armbian-${SPOKE_NAME}-$(date +%Y%m)"
+KEY_NAME="${SPOKE_USER}-${SPOKE_NAME}-$(date +%Y%m)"
 KEY_PATH="$SSH_DIR/$KEY_NAME"
 
-command -v rclone >/dev/null || die "rclone is not installed"
 mkdir -p "$(dirname "$RCLONE_CONF")"
 
 header "Checking Tunnel"
@@ -80,7 +80,7 @@ echo "$KEYSCAN" >> "$SSH_DIR/known_hosts"
 
 info "Verifying spoke is reachable on port $TUNNEL_PORT..."
 retry_or_abort \
-    "ssh -o BatchMode=yes -o ConnectTimeout=10 -p \"$TUNNEL_PORT\" armbian@localhost exit" \
+    "ssh -o BatchMode=yes -o ConnectTimeout=10 -p \"$TUNNEL_PORT\" \"$SPOKE_USER\"@localhost exit" \
     "Spoke not reachable on port $TUNNEL_PORT. Make sure the tunnel is up."
 
 header "Generating Hub SSH Key"
@@ -92,14 +92,14 @@ else
 fi
 
 header "Copying Hub Key to Spoke"
-info "Running ssh-copy-id to armbian@localhost:$TUNNEL_PORT..."
-info "(You will be prompted for the armbian password on the spoke)"
-ssh-copy-id -i "$KEY_PATH.pub" -p "$TUNNEL_PORT" armbian@localhost
+info "Running ssh-copy-id to $SPOKE_USER@localhost:$TUNNEL_PORT..."
+info "(You will be prompted for the $SPOKE_USER password on the spoke)"
+ssh-copy-id -i "$KEY_PATH.pub" -p "$TUNNEL_PORT" "$SPOKE_USER"@localhost
 info "Key copied."
 
 header "Testing Hub -> Spoke Key Auth"
 retry_or_abort \
-    "ssh -i \"$KEY_PATH\" -o BatchMode=yes -o ConnectTimeout=10 -p \"$TUNNEL_PORT\" armbian@localhost exit" \
+    "ssh -i \"$KEY_PATH\" -o BatchMode=yes -o ConnectTimeout=10 -p \"$TUNNEL_PORT\" \"$SPOKE_USER\"@localhost exit" \
     "Key auth failed. Check authorized_keys on the spoke."
 info "Key auth to spoke successful."