diff --git a/hub/onboard-spoke.sh b/hub/onboard-spoke.sh
index 97e24b4..8a78f73 100755
--- a/hub/onboard-spoke.sh
+++ b/hub/onboard-spoke.sh
@@ -128,3 +128,123 @@ else
     printf '\\n[%s-remote]\\ntype = sftp\\nhost = localhost\\nport = %s\\nkey_file = %s\\nshell_type = unix\\nmd5sum_command = md5sum\\nsha1sum_command = sha1sum\\n' "$SPOKE_NAME" "$TUNNEL_PORT" "$KEY_PATH" >> "$RCLONE_CONF"
     info "Remote [${SPOKE_NAME}-remote] added to $RCLONE_CONF."
 fi
+
+header "Union Remote (optional)"
+read -rp "Add this spoke to a union remote for redundancy? [y/N]: " ADD_UNION
+ADD_UNION="${ADD_UNION:-n}"
+if [[ "${ADD_UNION,,}" == "y" ]]; then
+    read -rp "Union remote name [shared-union]: " UNION_NAME
+    UNION_NAME="${UNION_NAME:-shared-union}"
+    read -rp "Subfolder path on this spoke (e.g. books, leave blank for root): " UNION_PATH
+    echo ""
+    echo "Upstream access mode for this spoke:"
+    echo "  0) None       - full read/write (default)"
+    echo "  1) :ro        - read only"
+    echo "  2) :nc        - no create (read/write existing, no new files)"
+    echo "  3) :writeback - writeback cache"
+    echo ""
+    read -rp "Choose [0-3]: " UNION_MODE
+    UNION_MODE="${UNION_MODE:-0}"
+    case "$UNION_MODE" in
+        0) UPSTREAM_TAG="" ;;
+        1) UPSTREAM_TAG=":ro" ;;
+        2) UPSTREAM_TAG=":nc" ;;
+        3) UPSTREAM_TAG=":writeback" ;;
+        *) warn "Invalid choice, defaulting to full read/write."; UPSTREAM_TAG="" ;;
+    esac
+    if [ -n "$UNION_PATH" ]; then
+        UPSTREAM="${SPOKE_NAME}-remote:${UNION_PATH}${UPSTREAM_TAG}"
+    else
+        UPSTREAM="${SPOKE_NAME}-remote:${UPSTREAM_TAG}"
+    fi
+    if grep -q "^\[${UNION_NAME}\]" "$RCLONE_CONF" 2>/dev/null; then
+        ALREADY=$(python3 - "$RCLONE_CONF" "$UNION_NAME" "${SPOKE_NAME}-remote:" <<'PYEOF2'
+import sys
+path, section, prefix = sys.argv[1], sys.argv[2], sys.argv[3]
+with open(path) as f:
+    lines = f.readlines()
+in_section = False
+for line in lines:
+    if line.strip() == f"[{section}]":
+        in_section = True
+    elif line.strip().startswith("["):
+        in_section = False
+    if in_section and line.startswith("upstreams =") and prefix in line:
+        print("yes")
+        sys.exit(0)
+print("no")
+PYEOF2
+)
+        if [ "$ALREADY" = "yes" ]; then
+            warn "Upstream for ${SPOKE_NAME}-remote already in union remote [${UNION_NAME}], skipping."
+        else
+            python3 - "$RCLONE_CONF" "$UNION_NAME" "$UPSTREAM" <<'PYEOF2'
+import sys
+path, section, upstream = sys.argv[1], sys.argv[2], sys.argv[3]
+with open(path) as f:
+    lines = f.readlines()
+out = []
+in_section = False
+for line in lines:
+    if line.strip() == f"[{section}]":
+        in_section = True
+    elif line.strip().startswith("["):
+        in_section = False
+    if in_section and line.startswith("upstreams ="):
+        line = line.rstrip() + " " + upstream + "\n"
+    out.append(line)
+with open(path, "w") as f:
+    f.writelines(out)
+PYEOF2
+            info "Added '$UPSTREAM' to union remote [${UNION_NAME}]."
+        fi
+    else
+        [ -s "$RCLONE_CONF" ] && tail -c1 "$RCLONE_CONF" | grep -qv $'\n' && echo "" >> "$RCLONE_CONF"
+        printf '\n[%s]\ntype = union\nupstreams = %s\n' "$UNION_NAME" "$UPSTREAM" >> "$RCLONE_CONF"
+        info "Union remote [${UNION_NAME}] created with upstream '$UPSTREAM'."
+    fi
+fi
+
+header "Testing rclone Connection"
+if rclone lsd "${SPOKE_NAME}-remote:" --config "$RCLONE_CONF" 2>/dev/null; then
+    info "rclone connection to $SPOKE_NAME successful."
+else
+    warn "rclone test failed. Check the remote config in $RCLONE_CONF."
+fi
+
+header "Registering Spoke"
+mkdir -p "$(dirname "$REGISTRY")"
+MOUNT_POINT="${HOME}/mnt/${SPOKE_NAME}"
+mkdir -p "$MOUNT_POINT"
+if grep -q "^${SPOKE_NAME} " "$REGISTRY" 2>/dev/null; then
+    warn "$SPOKE_NAME already in registry, updating."
+    grep -v "^${SPOKE_NAME} " "$REGISTRY" > "${REGISTRY}.tmp" 2>/dev/null || true
+    mv "${REGISTRY}.tmp" "$REGISTRY"
+fi
+echo "${SPOKE_NAME} ${TUNNEL_PORT} ${KEY_PATH} ${MOUNT_POINT}" >> "$REGISTRY"
+info "$SPOKE_NAME registered."
+
+header "Setting Up Auto-Mount"
+MOUNT_CMD="rclone mount ${SPOKE_NAME}-remote: ${MOUNT_POINT} --config ${HOME}/.config/rclone/rclone.conf --vfs-cache-mode writes --allow-other --daemon"
+CRON_ENTRY="@reboot ${MOUNT_CMD}"
+EXISTING=$(crontab -l 2>/dev/null || true)
+if echo "$EXISTING" | grep -qF "${SPOKE_NAME}-remote:"; then
+    warn "Crontab entry for ${SPOKE_NAME}-remote already exists, skipping."
+else
+    CRONTAB_BACKUP="${HOME}/.config/tinyboard/crontab.$(date +%Y%m%d%H%M%S)"
+    mkdir -p "$(dirname "$CRONTAB_BACKUP")"
+    echo "$EXISTING" > "$CRONTAB_BACKUP"
+    info "Crontab backed up to $CRONTAB_BACKUP"
+    { echo "$EXISTING"; echo "$CRON_ENTRY"; } | crontab -
+    info "Auto-mount crontab entry added for ${SPOKE_NAME}."
+fi
+info "Starting mount now..."
+mkdir -p "$MOUNT_POINT"
+eval "$MOUNT_CMD" 2>/dev/null && info "Mounted ${SPOKE_NAME} at ${MOUNT_POINT}." || warn "Mount failed — will retry on next reboot."
+
+header "Onboarding Complete"
+echo -e "  Spoke:       ${GREEN}$SPOKE_NAME${NC}"
+echo -e "  Port:        ${GREEN}$TUNNEL_PORT${NC}"
+echo -e "  Hub key:     ${GREEN}$KEY_PATH${NC}"
+echo -e "  rclone:      ${GREEN}${SPOKE_NAME}-remote${NC}"
+echo ""