diff --git a/src/assets/my-nethesis.svg b/src/assets/my-nethesis.svg
new file mode 100644
index 000000000..befaea222
--- /dev/null
+++ b/src/assets/my-nethesis.svg
@@ -0,0 +1,7 @@
+<svg viewBox="0 0 48 48" xmlns="http://www.w3.org/2000/svg">
+  <rect width="48" height="48" rx="10" fill="#0ea5e9" />
+  <g fill="#ffffff" transform="translate(-37.97 11) scale(0.187)">
+    <path d="M300.215 20.5056C300.215 37.3883 283.659 37.3883 283.659 37.3883V0H300.215V20.5056Z" />
+    <path d="M339.648 52.2904C347.588 52.2904 353.5 54.8747 357.7 60.2366C360.933 64.3426 362.574 69.5354 362.574 75.646V122.116C362.574 139.023 379.106 139.023 379.106 139.023V75.1147C379.106 63.5939 375.389 54.1985 368.077 47.1459C360.547 40.045 351.28 36.6154 339.648 36.6154C328.016 36.6154 318.942 39.9967 311.533 47.001C304.004 53.9811 300.215 63.4489 300.215 75.1147V139.023H316.746V75.6702C316.746 69.5596 318.411 64.3909 321.669 60.2608C325.844 54.923 331.732 52.3146 339.672 52.3146H339.648V52.2904Z" />
+  </g>
+</svg>
diff --git a/src/components/standalone/backup_and_restore/BackupContent.vue b/src/components/standalone/backup_and_restore/BackupContent.vue
index 0b249645c..73d740970 100644
--- a/src/components/standalone/backup_and_restore/BackupContent.vue
+++ b/src/components/standalone/backup_and_restore/BackupContent.vue
@@ -60,10 +60,11 @@ const retryTimeout = ref<ReturnType<typeof setTimeout>>()
 
 interface Backup {
   id: string
-  name: string
-  created: BigInteger
+  filename: string
+  uploaded_at: string
   size: number
   mimetype: string
+  sha256?: string
 }
 
 const loading = computed((): boolean => {
@@ -183,8 +184,11 @@ async function getBackups() {
       const res = await ubusCall('ns.backup', 'registered-list-backups')
       if (res?.data?.values?.backups?.length) {
         listBackups.value = res.data.values.backups
-        // sort by created date in unix timestamp
-        listBackups.value.sort((a, b) => Number(b.created) - Number(a.created))
+        // newest first — the server already sorts, but keep the guard
+        // so a stray ordering change upstream doesn't break the UI.
+        listBackups.value.sort(
+          (a, b) => new Date(b.uploaded_at).getTime() - new Date(a.uploaded_at).getTime()
+        )
       }
     } catch (exception: unknown) {
       if (exception instanceof Error) {
@@ -233,6 +237,9 @@ function successRunBackup() {
 
 function successSetPassphrase() {
   showPassphraseDrawer.value = false
+  // Refresh the store so the "Passphrase not configured" warning and the
+  // "Run backup" disabled state update without a full page reload.
+  backups.loadData()
 }
 
 function getMimetypeDescription(mimetype: string) {
@@ -258,10 +265,7 @@ function getDropdownItems(item: Backup) {
       action: () => {
         openDeleteBackup(
           item.id,
-          formatDateLoc(new Date(Number(item.created) * 1000), 'PPpp') +
-            ' (' +
-            byteFormat1024(item.size) +
-            ')'
+          formatDateLoc(new Date(item.uploaded_at), 'PPpp') + ' (' + byteFormat1024(item.size) + ')'
         )
       }
     }
@@ -509,11 +513,11 @@ function successDeleteBackup() {
           </NeTableHeadCell>
         </NeTableHead>
         <NeTableBody>
-          <NeTableRow v-for="item in listBackups" :key="item.name">
+          <NeTableRow v-for="item in listBackups" :key="item.id">
             <NeTableCell :data-label="t('standalone.backup_and_restore.backup.date')">
               <div>
                 <FontAwesomeIcon :icon="faClock" class="mr-2" />
-                {{ formatDateLoc(new Date(Number(item.created) * 1000), 'PPpp') }}
+                {{ formatDateLoc(new Date(item.uploaded_at), 'PPpp') }}
               </div>
             </NeTableCell>
             <NeTableCell :data-label="t('standalone.backup_and_restore.backup.mimetype')">
@@ -533,7 +537,7 @@ function successDeleteBackup() {
               <div class="-ml-2.5 flex items-center gap-2 xl:ml-0 xl:justify-end">
                 <NeButton
                   :kind="'tertiary'"
-                  @click="openDownloadEnterprise(item.id, item.mimetype, item.created.toString())"
+                  @click="openDownloadEnterprise(item.id, item.mimetype, item.uploaded_at)"
                 >
                   <template #prefix>
                     <FontAwesomeIcon :icon="faArrowCircleDown" />
diff --git a/src/components/standalone/backup_and_restore/DeleteBackupModal.vue b/src/components/standalone/backup_and_restore/DeleteBackupModal.vue
index 0f61954c1..733800b44 100644
--- a/src/components/standalone/backup_and_restore/DeleteBackupModal.vue
+++ b/src/components/standalone/backup_and_restore/DeleteBackupModal.vue
@@ -53,7 +53,7 @@ async function deleteBackup() {
     }
 
     const res = await ubusCall('ns.backup', methodCall, payload)
-    if (res?.data?.result === 'success') {
+    if (res?.data?.message === 'success') {
       emit('close')
       backups.loadData()
     }
diff --git a/src/components/standalone/backup_and_restore/DownloadBackupModal.vue b/src/components/standalone/backup_and_restore/DownloadBackupModal.vue
index c648a2a76..a25e0cced 100644
--- a/src/components/standalone/backup_and_restore/DownloadBackupModal.vue
+++ b/src/components/standalone/backup_and_restore/DownloadBackupModal.vue
@@ -58,7 +58,7 @@ const errorDownloadBackup = ref({ ...objNotification })
 
 function getBackupName() {
   if (props.selectedBackupTime) {
-    return formatDateLoc(new Date(Number(props.selectedBackupTime) * 1000), 'PPpp')
+    return formatDateLoc(new Date(props.selectedBackupTime), 'PPpp')
   } else {
     return props.unitName
   }
@@ -104,7 +104,12 @@ async function downloadBackup() {
       const link = document.createElement('a')
       link.href = fileURL
       if (props.selectedBackupTime && !props.unencrypted) {
-        link.download = 'backup-' + props.unitName + '-' + props.selectedBackupTime + extension
+        // selectedBackupTime is an RFC3339 string from the my API.
+        // Reduce it to an epoch-second integer so the downloaded file
+        // name does not contain the ":" characters that some file
+        // systems and shells refuse.
+        const epoch = Math.floor(new Date(props.selectedBackupTime).getTime() / 1000)
+        link.download = 'backup-' + props.unitName + '-' + epoch + extension
       } else {
         link.download = 'backup-' + props.unitName + '-' + Date.now().toString() + extension
       }
diff --git a/src/components/standalone/backup_and_restore/RestoreContent.vue b/src/components/standalone/backup_and_restore/RestoreContent.vue
index 3a2bb5131..525288a71 100644
--- a/src/components/standalone/backup_and_restore/RestoreContent.vue
+++ b/src/components/standalone/backup_and_restore/RestoreContent.vue
@@ -4,7 +4,7 @@
 -->
 
 <script setup lang="ts">
-import { onMounted, ref } from 'vue'
+import { computed, onMounted, ref } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { ubusCall, ValidationError } from '@/lib/standalone/ubus'
 import {
@@ -84,6 +84,20 @@ const errorRestore = ref({
   backup: ''
 })
 
+// The passphrase input flips from "Optional" to required whenever the
+// selected backup is encrypted. We detect that from the id suffix: the
+// ingest pipeline writes .gpg only when the appliance encrypted the
+// payload with the configured passphrase.
+const isPassphraseRequired = computed(() => {
+  if (typeRestore.value === 'from_backup') {
+    return formRestore.value.backup.toLowerCase().endsWith('.gpg')
+  }
+  if (typeRestore.value === 'upload_file' && formRestore.value.file) {
+    return (formRestore.value.file as File).name.toLowerCase().endsWith('.gpg')
+  }
+  return false
+})
+
 onMounted(() => {
   getSubscription()
 })
@@ -111,11 +125,14 @@ async function getBackups() {
       const res = await ubusCall('ns.backup', 'registered-list-backups')
       if (res?.data?.values?.backups?.length) {
         listBackups.value = res.data.values.backups
-          .sort((a: any, b: any) => Number(b.created) - Number(a.created))
+          .sort(
+            (a: any, b: any) =>
+              new Date(b.uploaded_at).getTime() - new Date(a.uploaded_at).getTime()
+          )
           .map((item: any) => ({
             id: item.id,
             label:
-              formatDateLoc(new Date(Number(item.created) * 1000), 'PPpp') +
+              formatDateLoc(new Date(item.uploaded_at), 'PPpp') +
               ' (' +
               byteFormat1024(item.size) +
               ')'
@@ -153,6 +170,17 @@ function validateRestore(): boolean {
     }
   }
 
+  if (isPassphraseRequired.value) {
+    const { valid, errMessage } = validateRequired(formRestore.value.passphrase)
+    if (!valid) {
+      errorRestore.value.passphrase = t(errMessage as string)
+      isValidationOk = false
+      if (!isFocusInput) {
+        focusElement(passphraseRef)
+      }
+    }
+  }
+
   return isValidationOk
 }
 
@@ -356,7 +384,7 @@ function setRestoreTimer() {
           :invalid-message="errorRestore.passphrase"
           :label="t('standalone.backup_and_restore.restore.passphrase')"
           is-password
-          optional
+          :optional="!isPassphraseRequired"
           :optional-label="t('common.optional')"
         >
           <template #tooltip>
diff --git a/src/components/standalone/backup_and_restore/RunBackupModal.vue b/src/components/standalone/backup_and_restore/RunBackupModal.vue
index 86895dd6d..1a417307d 100644
--- a/src/components/standalone/backup_and_restore/RunBackupModal.vue
+++ b/src/components/standalone/backup_and_restore/RunBackupModal.vue
@@ -66,6 +66,7 @@ async function runBackup() {
     :secondary-label="t('common.close')"
     secondary-button-kind="tertiary"
     @close="$emit('close')"
+    @secondary-click="$emit('close')"
     @primary-click="runBackup()"
   >
     <div>
diff --git a/src/components/standalone/dashboard/BackupStatusCard.vue b/src/components/standalone/dashboard/BackupStatusCard.vue
index f141d65f5..ea79b61f7 100644
--- a/src/components/standalone/dashboard/BackupStatusCard.vue
+++ b/src/components/standalone/dashboard/BackupStatusCard.vue
@@ -17,11 +17,12 @@ import type { AxiosResponse } from 'axios'
 import { useBackupsStore } from '@/stores/standalone/backups.ts'
 
 type BackupData = {
-  created: number
+  uploaded_at: string
   id: string
   mimetype: string
-  name: string
+  filename: string
   size: number
+  sha256?: string
 }
 
 type BackupResponse = AxiosResponse<{
@@ -45,9 +46,11 @@ watchEffect(() => {
     latestBackupLoading.value = true
     ubusCall('ns.backup', 'registered-list-backups')
       .then((response: BackupResponse) => {
-        const backup = response.data.values.backups.sort((a, b) => b.created - a.created).shift()
+        const backup = response.data.values.backups
+          .sort((a, b) => new Date(b.uploaded_at).getTime() - new Date(a.uploaded_at).getTime())
+          .shift()
         if (backup != undefined) {
-          lastBackup.value = formatDateLoc(new Date(backup.created * 1000), 'PPpp')
+          lastBackup.value = formatDateLoc(new Date(backup.uploaded_at), 'PPpp')
         } else {
           lastBackup.value = undefined
         }
diff --git a/src/components/standalone/hotspot/SettingsContent.vue b/src/components/standalone/hotspot/SettingsContent.vue
index 1c1bd9ae7..47e570a4f 100644
--- a/src/components/standalone/hotspot/SettingsContent.vue
+++ b/src/components/standalone/hotspot/SettingsContent.vue
@@ -4,12 +4,16 @@
 -->
 
 <script lang="ts" setup>
-import { onMounted, ref } from 'vue'
+import { computed, onMounted, onUnmounted, ref } from 'vue'
 import {
+  NeBadge,
+  NeCard,
   NeCombobox,
   NeInlineNotification,
   NeButton,
+  NeLink,
   NeSkeleton,
+  NeSpinner,
   NeTooltip,
   NeTextInput,
   focusElement,
@@ -20,11 +24,13 @@ import { type NeNotification, NeModal } from '@nethesis/vue-components'
 import { faSave, faRightToBracket } from '@fortawesome/free-solid-svg-icons'
 import { FontAwesomeIcon } from '@fortawesome/vue-fontawesome'
 import FormLayout from '@/components/standalone/FormLayout.vue'
+import myNethesisIconUrl from '@/assets/my-nethesis.svg'
 import { useI18n } from 'vue-i18n'
 import { validateIp4Cidr, validateRequired } from '@/lib/validation'
-import { ubusCall } from '@/lib/standalone/ubus'
+import { ubusCall, ValidationError } from '@/lib/standalone/ubus'
 import { AxiosError } from 'axios'
 import { useUciPendingChangesStore } from '@/stores/standalone/uciPendingChanges'
+import { useSubscriptionStore } from '@/stores/standalone/subscription'
 import router from '@/router'
 import { getStandaloneRoutePrefix } from '@/lib/router'
 import { uid } from 'uid/single'
@@ -33,6 +39,9 @@ import { useNotificationsStore } from '@/stores/notifications'
 const { t } = useI18n()
 const uciPendingChangesStore = useUciPendingChangesStore()
 const notificationsStore = useNotificationsStore()
+// the My Nethesis login authenticates the user on the hotspot manager via
+// the my.nethesis.it identity: offer it only on enterprise-subscribed units
+const subscriptionStore = useSubscriptionStore()
 
 interface Login {
   hostname: string
@@ -82,6 +91,23 @@ const configurationForm = ref<Configuration>({
 
 const isError = ref(false)
 const isLoggedIn = ref(false)
+const oidcLogging = ref(false)
+const myLoginAvailable = computed(
+  () => subscriptionStore.isActive && subscriptionStore.isEnterprise
+)
+// the manager session token file exists on the unit (it may still be
+// rejected by the manager: isLoggedIn tracks that)
+const tokenPresent = ref(false)
+// a My Nethesis pairing happened in the past (account info persisted in uci)
+// and the unit still holds its session token, but the manager no longer
+// accepts it: offer the re-login from the Connected account card. With no
+// token at all (e.g. after a reboot) the classic login screen is shown.
+const sessionExpired = computed(
+  () => tokenPresent.value && !isLoggedIn.value && accountName.value !== ''
+)
+const accountName = ref('')
+const accountUser = ref('')
+const managerHost = ref('')
 const viewConfiguration = ref(false)
 const activeConfiguration = ref(false)
 const loadingParentHotspot = ref(false)
@@ -117,6 +143,9 @@ const objError = {
   maxClientsAllowed: ''
 }
 const error = ref({ ...objError })
+// My Nethesis login errors are shown under the automatic-login button
+// (same spot as the waiting notification), not in the top banner
+const oidcError = ref({ ...objError })
 const errorListParents = ref({ ...objError })
 const errorListDevices = ref({ ...objError })
 const errorGetConfiguration = ref({ ...objError })
@@ -129,13 +158,16 @@ onMounted(() => {
   errorListParents.value = { ...objError }
   errorListDevices.value = { ...objError }
   errorGetConfiguration.value = { ...objError }
+  // the subscription may have changed since the store was first loaded
+  // (e.g. the unit was just registered): refresh it on every visit
+  subscriptionStore.loadData()
   getListParents()
   getListDevices()
   getConfiguration()
   getHostname()
 })
 
-async function getListParents() {
+async function getListParents(retry = false) {
   loadingParentHotspot.value = true
 
   // Retrieve parent hotspot
@@ -152,6 +184,12 @@ async function getListParents() {
       }
     }
   } catch (exception: any) {
+    if (retry) {
+      // a transient network error towards the hotspot manager right after
+      // the login would scare the user for nothing: try once more
+      await new Promise((resolve) => setTimeout(resolve, 2000))
+      return getListParents(false)
+    }
     isError.value = true
     errorListParents.value.notificationTitle = t('error.cannot_retrieve_parent_hotspot')
     errorListParents.value.notificationDescription = t(getAxiosErrorMessage(exception))
@@ -189,6 +227,7 @@ async function getConfiguration() {
     const res = await ubusCall('ns.dedalo', 'get-configuration', {})
     if (res?.data?.configuration) {
       const configuration = res.data.configuration
+      tokenPresent.value = !!configuration.connected
       if (configuration.connected) {
         activeConfiguration.value = configuration.hotspot_id != ''
         viewConfiguration.value = true
@@ -196,6 +235,10 @@ async function getConfiguration() {
         isLoggedIn.value = false
       }
 
+      accountName.value = configuration.account_name ?? ''
+      accountUser.value = configuration.account_user ?? ''
+      managerHost.value = configuration.manager_host ?? ''
+
       configurationForm.value.parentHotspot = String(configuration.hotspot_id)
       configurationForm.value.unitDescription = configuration.unit_description
       configurationForm.value.networkDevice = configuration.interface
@@ -285,13 +328,7 @@ function login() {
     ubusCall('ns.dedalo', 'login', payload)
       .then((response) => {
         if (response.data && response.data.response && response.data.response === 'success') {
-          isLoggedIn.value = true
-          errorListParents.value = { ...objError }
-          errorListDevices.value = { ...objError }
-          errorGetConfiguration.value = { ...objError }
-          getListParents()
-          getListDevices()
-          getConfiguration()
+          refreshAfterLogin()
         } else {
           error.value.notificationTitle = t('error.cannot_login_hotspot')
           error.value.notificationDescription = t('error.cannot_login_hotspot_description')
@@ -308,6 +345,122 @@ function login() {
   }
 }
 
+function refreshAfterLogin() {
+  isLoggedIn.value = true
+  errorListParents.value = { ...objError }
+  errorListDevices.value = { ...objError }
+  errorGetConfiguration.value = { ...objError }
+  getListParents(true)
+  getListDevices()
+  getConfiguration()
+}
+
+let oidcPollTimer: number | undefined
+let oidcPollDeadline = 0
+
+function stopOidcPolling() {
+  if (oidcPollTimer) {
+    clearInterval(oidcPollTimer)
+    oidcPollTimer = undefined
+  }
+  oidcLogging.value = false
+}
+
+async function oidcLogin(host?: string) {
+  clearErrors()
+  oidcLogging.value = true
+
+  try {
+    const res = await ubusCall('ns.dedalo', 'oidc-start', {
+      host: host || loginForm.value.hostname
+    })
+    if (!res?.data?.verification_url) {
+      throw new Error('pairing_start_failed')
+    }
+    // the popup runs the OIDC login on the hotspot manager: with an active
+    // My Nethesis session it completes without user interaction, then the
+    // unit picks up the session token by polling
+    const popup = window.open(
+      res.data.verification_url,
+      'nethspot-pairing',
+      'popup,width=520,height=680'
+    )
+    if (!popup) {
+      oidcLogging.value = false
+      oidcError.value.notificationTitle = t('error.cannot_login_hotspot')
+      oidcError.value.notificationDescription = t(
+        'standalone.hotspot.settings.login_oidc_popup_blocked'
+      )
+      return
+    }
+    oidcPollDeadline = Date.now() + (res.data.expires_in ?? 600) * 1000
+    oidcPollTimer = window.setInterval(oidcPoll, (res.data.interval ?? 2) * 1000)
+  } catch (exception: unknown) {
+    oidcLogging.value = false
+    oidcError.value.notificationTitle = t('error.cannot_login_hotspot')
+    // expected outcomes of the user-provided host come back as validation
+    // errors (400, no global toast)
+    const hostError =
+      exception instanceof ValidationError ? exception.errorBag.getFirstFor('host') : ''
+    if (hostError === 'oidc_not_supported') {
+      oidcError.value.notificationDescription = t(
+        'standalone.hotspot.settings.login_oidc_not_supported'
+      )
+    } else if (
+      hostError === 'pairing_start_failed' ||
+      (exception instanceof Error && exception.message === 'pairing_start_failed')
+    ) {
+      oidcError.value.notificationDescription = t(
+        'standalone.hotspot.settings.login_oidc_start_failed'
+      )
+    } else {
+      oidcError.value.notificationDescription = t(getAxiosErrorMessage(exception))
+    }
+  }
+}
+
+async function oidcPoll() {
+  if (Date.now() > oidcPollDeadline) {
+    stopOidcPolling()
+    oidcError.value.notificationTitle = t('error.cannot_login_hotspot')
+    oidcError.value.notificationDescription = t('standalone.hotspot.settings.login_oidc_expired')
+    return
+  }
+
+  try {
+    const res = await ubusCall('ns.dedalo', 'oidc-poll', {})
+    const status = res?.data?.status
+    if (status === 'success') {
+      stopOidcPolling()
+      const notification: NeNotification = {
+        id: uid(),
+        kind: 'success',
+        title: t('standalone.hotspot.settings.login_oidc_success', {
+          account: res.data.account_name
+        }),
+        timestamp: new Date()
+      }
+      notificationsStore.addNotification(notification)
+      refreshAfterLogin()
+    } else if (status === 'failed') {
+      stopOidcPolling()
+      oidcError.value.notificationTitle = t('error.cannot_login_hotspot')
+      oidcError.value.notificationDescription = t('standalone.hotspot.settings.login_oidc_failed', {
+        error: res.data.reason ?? 'unknown'
+      })
+    } else if (status === 'expired') {
+      stopOidcPolling()
+      oidcError.value.notificationTitle = t('error.cannot_login_hotspot')
+      oidcError.value.notificationDescription = t('standalone.hotspot.settings.login_oidc_expired')
+    }
+    // pending: keep polling
+  } catch {
+    // transient error talking to the unit: keep polling until the deadline
+  }
+}
+
+onUnmounted(() => stopOidcPolling())
+
 function clearErrors() {
   error.value = {
     notificationTitle: '',
@@ -322,6 +475,7 @@ function clearErrors() {
     dhcpLimit: '',
     maxClientsAllowed: ''
   }
+  oidcError.value = { ...objError }
 }
 
 function validateConfiguration(): boolean {
@@ -528,13 +682,80 @@ function goToInterfaces() {
 
 <template>
   <div>
-    <NeSkeleton v-if="loadingParentHotspot || loadingListDevices" :lines="8" />
+    <NeSkeleton
+      v-if="loadingParentHotspot || loadingListDevices || subscriptionStore.loading"
+      :lines="8"
+    />
     <FormLayout
-      v-if="!isLoggedIn && !loadingParentHotspot && !loadingListDevices"
+      v-if="
+        !isLoggedIn &&
+        !(sessionExpired && myLoginAvailable) &&
+        !loadingParentHotspot &&
+        !loadingListDevices &&
+        !subscriptionStore.loading
+      "
       :title="t('standalone.hotspot.settings.login')"
       :description="t('standalone.hotspot.settings.login_description')"
       class="max-w-3xl"
     >
+      <NeInlineNotification
+        v-if="error.notificationTitle"
+        class="my-4"
+        kind="error"
+        :title="error.notificationTitle"
+        :description="error.notificationDescription"
+      />
+      <template v-if="myLoginAvailable">
+        <div class="mb-1 font-medium text-gray-900 dark:text-gray-50">
+          {{ t('standalone.hotspot.settings.automatic_login') }}
+        </div>
+        <p class="mb-4 text-sm text-gray-500 dark:text-gray-400">
+          {{ t('standalone.hotspot.settings.automatic_login_description') }}
+        </p>
+        <div>
+          <NeButton
+            :disabled="oidcLogging || logging"
+            kind="secondary"
+            size="lg"
+            @click.prevent="oidcLogin()"
+          >
+            <template #prefix>
+              <img :src="myNethesisIconUrl" class="h-5 w-5" alt="" aria-hidden="true" />
+            </template>
+            {{ t('standalone.hotspot.settings.login_with_my_nethesis') }}
+            <template #suffix>
+              <NeSpinner v-if="oidcLogging" size="4" />
+            </template>
+          </NeButton>
+        </div>
+        <NeInlineNotification
+          v-if="oidcLogging"
+          class="my-4"
+          kind="info"
+          :title="t('standalone.hotspot.settings.login_oidc_waiting')"
+          :description="t('standalone.hotspot.settings.login_oidc_waiting_description')"
+          :primary-button-label="t('common.cancel')"
+          @primary-click="stopOidcPolling()"
+        />
+        <NeInlineNotification
+          v-if="oidcError.notificationTitle"
+          class="my-4"
+          kind="error"
+          :title="oidcError.notificationTitle"
+          :description="oidcError.notificationDescription"
+        />
+        <div class="my-6 flex items-center gap-3">
+          <hr class="grow border-gray-200 dark:border-gray-700" />
+          <span class="text-sm text-gray-500 dark:text-gray-400">{{ t('common.or') }}</span>
+          <hr class="grow border-gray-200 dark:border-gray-700" />
+        </div>
+        <div class="mb-1 font-medium text-gray-900 dark:text-gray-50">
+          {{ t('standalone.hotspot.settings.manual_login') }}
+        </div>
+        <p class="mb-4 text-sm text-gray-500 dark:text-gray-400">
+          {{ t('standalone.hotspot.settings.manual_login_description') }}
+        </p>
+      </template>
       <form @submit="login()">
         <div class="mb-8 flex flex-col gap-y-4">
           <NeTextInput
@@ -565,15 +786,14 @@ function goToInterfaces() {
             :label="t('standalone.hotspot.settings.login_password')"
           />
         </div>
-        <NeInlineNotification
-          v-if="error.notificationTitle"
-          class="my-4"
-          kind="error"
-          :title="error.notificationTitle"
-          :description="error.notificationDescription"
-        />
         <div class="flex justify-start">
-          <NeButton :disabled="logging" :loading="logging" kind="primary" size="lg" type="submit">
+          <NeButton
+            :disabled="logging || oidcLogging"
+            :loading="logging"
+            kind="secondary"
+            size="lg"
+            type="submit"
+          >
             <template #prefix>
               <FontAwesomeIcon :icon="faRightToBracket" />
             </template>
@@ -588,184 +808,284 @@ function goToInterfaces() {
       :description="t('standalone.hotspot.description')"
       class="max-w-3xl"
     >
-      <NeInlineNotification
-        v-if="emptyDevices"
-        class="my-4"
-        kind="warning"
-        :title="t('error.empty_network_device')"
-        :description="t('error.empty_network_device_description')"
-        :primary-button-label="t('standalone.hotspot.settings.empty_network_device_link')"
-        @primary-click="goToInterfaces"
-      />
-      <NeInlineNotification
-        v-if="errorHostname.notificationTitle"
-        class="my-4"
-        kind="error"
-        :title="errorHostname.notificationTitle"
-        :description="errorHostname.notificationDescription"
-      />
-      <NeInlineNotification
-        v-if="errorListParents.notificationTitle"
-        class="my-4"
-        kind="error"
-        :title="errorListParents.notificationTitle"
-        :description="errorListParents.notificationDescription"
-      />
-      <NeInlineNotification
-        v-if="errorListDevices.notificationTitle"
-        class="my-4"
-        kind="error"
-        :title="errorListDevices.notificationTitle"
-        :description="errorListDevices.notificationDescription"
-      />
-      <NeInlineNotification
-        v-if="errorGetConfiguration.notificationTitle"
-        class="my-4"
-        kind="error"
-        :title="errorGetConfiguration.notificationTitle"
-        :description="errorGetConfiguration.notificationDescription"
-      />
-      <form v-if="!isError">
-        <div class="mb-8 flex flex-col gap-y-4">
-          <NeCombobox
-            v-model="configurationForm.parentHotspot"
-            :options="parentHotspotList"
-            :placeholder="t('standalone.hotspot.settings.configuration_parent_hotspot_placeholder')"
-            :label="t('standalone.hotspot.settings.configuration_parent_hotspot')"
-            class="grow"
-            :disabled="!isLoggedIn || activeConfiguration"
-            :no-results-label="t('ne_combobox.no_results')"
-            :limited-options-label="t('ne_combobox.limited_options_label')"
-            :no-options-label="t('ne_combobox.no_options_label')"
-            :selected-label="t('ne_combobox.selected')"
-            :user-input-label="t('ne_combobox.user_input_label')"
-            :optional-label="t('common.optional')"
-          />
-          <NeTextInput
-            ref="unitNameRef"
-            v-model="configurationForm.unitName"
-            :invalid-message="error.unitName"
-            :placeholder="t('standalone.hotspot.settings.configuration_unit_name_placeholder')"
-            :label="t('standalone.hotspot.settings.configuration_unit_name')"
-            disabled
-          />
-          <NeTextInput
-            ref="unitDescriptionRef"
-            v-model="configurationForm.unitDescription"
-            :invalid-message="error.unitDescription"
-            :placeholder="
-              t('standalone.hotspot.settings.configuration_unit_description_placeholder')
-            "
-            :label="t('standalone.hotspot.settings.configuration_unit_description')"
-            :disabled="!isLoggedIn || activeConfiguration"
+      <NeCard
+        v-if="accountName && (isLoggedIn || sessionExpired)"
+        :title="t('standalone.hotspot.settings.connected_account_title')"
+        :icon="['fas', 'wifi']"
+        class="mb-6"
+      >
+        <div class="divide-y divide-gray-200 text-sm dark:divide-gray-700">
+          <div class="flex items-center justify-between gap-4 py-2.5">
+            <span class="text-gray-500 dark:text-gray-400">
+              {{ t('standalone.hotspot.settings.connected_session') }}
+            </span>
+            <NeBadge
+              :text="
+                isLoggedIn
+                  ? t('standalone.hotspot.settings.session_active')
+                  : t('standalone.hotspot.settings.session_expired')
+              "
+              :kind="isLoggedIn ? 'success' : 'warning'"
+              size="sm"
+            />
+          </div>
+          <div class="flex items-center justify-between gap-4 py-2.5">
+            <span class="text-gray-500 dark:text-gray-400">
+              {{ t('standalone.hotspot.settings.connected_account') }}
+            </span>
+            <span class="text-right font-medium text-gray-900 dark:text-gray-50">
+              {{ accountName }}
+            </span>
+          </div>
+          <div class="flex items-center justify-between gap-4 py-2.5">
+            <span class="text-gray-500 dark:text-gray-400">
+              {{ t('standalone.hotspot.settings.connected_user') }}
+            </span>
+            <span class="text-right font-medium text-gray-900 dark:text-gray-50">
+              {{ accountUser }}
+            </span>
+          </div>
+          <div class="flex items-center justify-between gap-4 py-2.5">
+            <span class="text-gray-500 dark:text-gray-400">
+              {{ t('standalone.hotspot.settings.connected_manager') }}
+            </span>
+            <NeLink :href="`https://${managerHost}`" target="_blank" class="text-right font-medium">
+              {{ managerHost }}
+            </NeLink>
+          </div>
+        </div>
+        <template v-if="sessionExpired && myLoginAvailable">
+          <p class="mt-4 text-sm text-gray-500 dark:text-gray-400">
+            {{ t('standalone.hotspot.settings.session_expired_description') }}
+          </p>
+          <div class="mt-4">
+            <NeButton
+              :disabled="oidcLogging || logging"
+              kind="secondary"
+              @click.prevent="oidcLogin(managerHost)"
+            >
+              <template #prefix>
+                <img :src="myNethesisIconUrl" class="h-5 w-5" alt="" aria-hidden="true" />
+              </template>
+              {{ t('standalone.hotspot.settings.login_with_my_nethesis') }}
+              <template #suffix>
+                <NeSpinner v-if="oidcLogging" size="4" />
+              </template>
+            </NeButton>
+          </div>
+          <NeInlineNotification
+            v-if="oidcLogging"
+            class="mt-4"
+            kind="info"
+            :title="t('standalone.hotspot.settings.login_oidc_waiting')"
+            :description="t('standalone.hotspot.settings.login_oidc_waiting_description')"
+            :primary-button-label="t('common.cancel')"
+            @primary-click="stopOidcPolling()"
           />
-          <NeCombobox
-            ref="networkDeviceRef"
-            v-model="configurationForm.networkDevice"
-            :options="networkDeviceList"
-            :placeholder="t('standalone.hotspot.settings.configuration_network_device_placeholder')"
-            :invalid-message="error.networkDevice"
-            :label="t('standalone.hotspot.settings.configuration_network_device')"
-            :disabled="!isLoggedIn"
-            class="grow"
-            :no-results-label="t('ne_combobox.no_results')"
-            :limited-options-label="t('ne_combobox.limited_options_label')"
-            :no-options-label="t('ne_combobox.no_options_label')"
-            :selected-label="t('ne_combobox.selected')"
-            :user-input-label="t('ne_combobox.user_input_label')"
-            :optional-label="t('common.optional')"
-          >
-            <template #tooltip>
-              <NeTooltip>
-                <template #content>
-                  {{ t('standalone.hotspot.settings.configuration_network_device_helper') }}
-                </template>
-              </NeTooltip>
-            </template>
-          </NeCombobox>
-          <NeTextInput
-            ref="networkAddressRef"
-            v-model="configurationForm.networkAddress"
-            :invalid-message="error.networkAddress"
-            placeholder="192.168.0.0/24"
-            :label="t('standalone.hotspot.settings.configuration_network_address')"
-            :disabled="!isLoggedIn"
-            :helper-text="
-              t('standalone.hotspot.settings.configuration_max_client_allowed') +
-              ' ' +
-              configurationForm.maxClientsAllowed
-            "
-            @change="getDhcpRange(false)"
-          >
-            <template #tooltip>
-              <NeTooltip>
-                <template #content>
-                  {{ t('standalone.hotspot.settings.configuration_network_address_helper') }}
-                </template>
-              </NeTooltip>
-            </template>
-          </NeTextInput>
           <NeInlineNotification
-            v-if="errorDhcpRange.notificationTitle"
-            class="my-4"
+            v-if="oidcError.notificationTitle"
+            class="mt-4"
             kind="error"
-            :title="errorDhcpRange.notificationTitle"
-            :description="errorDhcpRange.notificationDescription"
+            :title="oidcError.notificationTitle"
+            :description="oidcError.notificationDescription"
           />
-          <NeTextInput
-            ref="dhcpLimitRef"
-            v-model="configurationForm.dhcpLimit"
-            :invalid-message="error.dhcpLimit"
-            :label="t('standalone.hotspot.settings.configuration_dhcp_limit')"
-            :disabled="!isLoggedIn"
-            :helper-text="
-              t('standalone.hotspot.settings.configuration_dhcp_start') +
-              ' ' +
-              configurationForm.dhcpRangeStart
-            "
-          >
-            <template #tooltip>
-              <NeTooltip>
-                <template #content>
-                  {{ t('standalone.hotspot.settings.configuration_dhcp_limit_helper') }}
-                </template>
-              </NeTooltip>
-            </template>
-          </NeTextInput>
-        </div>
+        </template>
+      </NeCard>
+      <!-- with an expired session the fields would be disabled placeholders:
+           hide the form until the user logs in again -->
+      <template v-if="viewConfiguration && !sessionExpired">
+        <NeInlineNotification
+          v-if="emptyDevices"
+          class="my-4"
+          kind="warning"
+          :title="t('error.empty_network_device')"
+          :description="t('error.empty_network_device_description')"
+          :primary-button-label="t('standalone.hotspot.settings.empty_network_device_link')"
+          @primary-click="goToInterfaces"
+        />
         <NeInlineNotification
-          v-if="errorSave.notificationTitle"
+          v-if="errorHostname.notificationTitle"
           class="my-4"
           kind="error"
-          :title="errorSave.notificationTitle"
-          :description="errorSave.notificationDescription"
+          :title="errorHostname.notificationTitle"
+          :description="errorHostname.notificationDescription"
         />
         <NeInlineNotification
+          v-if="errorListParents.notificationTitle"
           class="my-4"
-          kind="info"
-          :title="t('standalone.hotspot.settings.configuration_save_info')"
-          :description="t('standalone.hotspot.settings.configuration_save_info_description')"
+          kind="error"
+          :title="errorListParents.notificationTitle"
+          :description="errorListParents.notificationDescription"
         />
-        <div class="flex justify-end">
-          <div>
-            <NeButton
-              v-if="isLoggedIn"
-              :disabled="saving"
-              :loading="saving"
-              kind="primary"
-              size="lg"
-              @click.prevent="saveConfiguration()"
+        <NeInlineNotification
+          v-if="errorListDevices.notificationTitle"
+          class="my-4"
+          kind="error"
+          :title="errorListDevices.notificationTitle"
+          :description="errorListDevices.notificationDescription"
+        />
+        <NeInlineNotification
+          v-if="errorGetConfiguration.notificationTitle"
+          class="my-4"
+          kind="error"
+          :title="errorGetConfiguration.notificationTitle"
+          :description="errorGetConfiguration.notificationDescription"
+        />
+        <form v-if="!isError">
+          <div class="mb-8 flex flex-col gap-y-4">
+            <NeCombobox
+              v-model="configurationForm.parentHotspot"
+              :options="parentHotspotList"
+              :placeholder="
+                t('standalone.hotspot.settings.configuration_parent_hotspot_placeholder')
+              "
+              :label="t('standalone.hotspot.settings.configuration_parent_hotspot')"
+              class="grow"
+              :disabled="!isLoggedIn || activeConfiguration"
+              :no-results-label="t('ne_combobox.no_results')"
+              :limited-options-label="t('ne_combobox.limited_options_label')"
+              :no-options-label="t('ne_combobox.no_options_label')"
+              :selected-label="t('ne_combobox.selected')"
+              :user-input-label="t('ne_combobox.user_input_label')"
+              :optional-label="t('common.optional')"
+            />
+            <NeTextInput
+              ref="unitNameRef"
+              v-model="configurationForm.unitName"
+              :invalid-message="error.unitName"
+              :placeholder="t('standalone.hotspot.settings.configuration_unit_name_placeholder')"
+              :label="t('standalone.hotspot.settings.configuration_unit_name')"
+              disabled
+            />
+            <NeTextInput
+              ref="unitDescriptionRef"
+              v-model="configurationForm.unitDescription"
+              :invalid-message="error.unitDescription"
+              :placeholder="
+                t('standalone.hotspot.settings.configuration_unit_description_placeholder')
+              "
+              :label="t('standalone.hotspot.settings.configuration_unit_description')"
+              :disabled="!isLoggedIn || activeConfiguration"
+            />
+            <NeCombobox
+              ref="networkDeviceRef"
+              v-model="configurationForm.networkDevice"
+              :options="networkDeviceList"
+              :placeholder="
+                t('standalone.hotspot.settings.configuration_network_device_placeholder')
+              "
+              :invalid-message="error.networkDevice"
+              :label="t('standalone.hotspot.settings.configuration_network_device')"
+              :disabled="!isLoggedIn"
+              class="grow"
+              :no-results-label="t('ne_combobox.no_results')"
+              :limited-options-label="t('ne_combobox.limited_options_label')"
+              :no-options-label="t('ne_combobox.no_options_label')"
+              :selected-label="t('ne_combobox.selected')"
+              :user-input-label="t('ne_combobox.user_input_label')"
+              :optional-label="t('common.optional')"
             >
-              <template #prefix>
-                <FontAwesomeIcon :icon="faSave" />
+              <template #tooltip>
+                <NeTooltip>
+                  <template #content>
+                    {{ t('standalone.hotspot.settings.configuration_network_device_helper') }}
+                  </template>
+                </NeTooltip>
               </template>
-              {{ t('common.save') }}
-            </NeButton>
+            </NeCombobox>
+            <NeTextInput
+              ref="networkAddressRef"
+              v-model="configurationForm.networkAddress"
+              :invalid-message="error.networkAddress"
+              placeholder="192.168.0.0/24"
+              :label="t('standalone.hotspot.settings.configuration_network_address')"
+              :disabled="!isLoggedIn"
+              :helper-text="
+                t('standalone.hotspot.settings.configuration_max_client_allowed') +
+                ' ' +
+                configurationForm.maxClientsAllowed
+              "
+              @change="getDhcpRange(false)"
+            >
+              <template #tooltip>
+                <NeTooltip>
+                  <template #content>
+                    {{ t('standalone.hotspot.settings.configuration_network_address_helper') }}
+                  </template>
+                </NeTooltip>
+              </template>
+            </NeTextInput>
+            <NeInlineNotification
+              v-if="errorDhcpRange.notificationTitle"
+              class="my-4"
+              kind="error"
+              :title="errorDhcpRange.notificationTitle"
+              :description="errorDhcpRange.notificationDescription"
+            />
+            <NeTextInput
+              ref="dhcpLimitRef"
+              v-model="configurationForm.dhcpLimit"
+              :invalid-message="error.dhcpLimit"
+              :label="t('standalone.hotspot.settings.configuration_dhcp_limit')"
+              :disabled="!isLoggedIn"
+              :helper-text="
+                t('standalone.hotspot.settings.configuration_dhcp_start') +
+                ' ' +
+                configurationForm.dhcpRangeStart
+              "
+            >
+              <template #tooltip>
+                <NeTooltip>
+                  <template #content>
+                    {{ t('standalone.hotspot.settings.configuration_dhcp_limit_helper') }}
+                  </template>
+                </NeTooltip>
+              </template>
+            </NeTextInput>
           </div>
-        </div>
-      </form>
+          <NeInlineNotification
+            v-if="errorSave.notificationTitle"
+            class="my-4"
+            kind="error"
+            :title="errorSave.notificationTitle"
+            :description="errorSave.notificationDescription"
+          />
+          <NeInlineNotification
+            class="my-4"
+            kind="info"
+            :title="t('standalone.hotspot.settings.configuration_save_info')"
+            :description="t('standalone.hotspot.settings.configuration_save_info_description')"
+          />
+          <div class="flex justify-start">
+            <div>
+              <NeButton
+                v-if="isLoggedIn"
+                :disabled="saving"
+                :loading="saving"
+                kind="primary"
+                size="lg"
+                @click.prevent="saveConfiguration()"
+              >
+                <template #prefix>
+                  <FontAwesomeIcon :icon="faSave" />
+                </template>
+                {{ t('common.save') }}
+              </NeButton>
+            </div>
+          </div>
+        </form>
+      </template>
     </FormLayout>
-    <hr class="my-8" />
+    <hr
+      v-if="
+        !loadingParentHotspot &&
+        !loadingListDevices &&
+        isLoggedIn &&
+        activeConfiguration &&
+        !emptyDevices
+      "
+      class="my-8"
+    />
     <FormLayout
       v-if="
         !loadingParentHotspot &&
diff --git a/src/components/standalone/subscription/CancelSubscriptionModal.vue b/src/components/standalone/subscription/CancelSubscriptionModal.vue
index 735b0f4a0..2b4f82d52 100644
--- a/src/components/standalone/subscription/CancelSubscriptionModal.vue
+++ b/src/components/standalone/subscription/CancelSubscriptionModal.vue
@@ -77,6 +77,12 @@ async function cancelSubscription() {
     @primary-click="cancelSubscription"
   >
     <div class="space-y-2">
+      <NeInlineNotification
+        kind="warning"
+        :title="t('standalone.subscription.cancel_irreversible_title')"
+        :description="t('standalone.subscription.cancel_irreversible_description')"
+        class="mb-4!"
+      />
       <p>{{ t('standalone.subscription.confirm_cancel_subscription') }}:</p>
       <ul class="list-inside list-disc">
         <li>{{ t('standalone.subscription.dpi_filter') }}</li>
diff --git a/src/components/standalone/subscription/UnitSubscription.vue b/src/components/standalone/subscription/UnitSubscription.vue
index 057fd33a9..5a6631491 100644
--- a/src/components/standalone/subscription/UnitSubscription.vue
+++ b/src/components/standalone/subscription/UnitSubscription.vue
@@ -14,12 +14,13 @@ import {
   NeButton,
   NeHeading,
   NeInlineNotification,
+  NeLink,
   NeSkeleton,
   NeTextInput
 } from '@nethesis/vue-components'
 import type { SubscriptionDataType } from '@/views/standalone/system/SubscriptionView.vue'
 import { computed, onMounted, type PropType, ref, toRefs } from 'vue'
-import { ubusCall } from '@/lib/standalone/ubus'
+import { ubusCall, ValidationError } from '@/lib/standalone/ubus'
 import { validateRequired } from '@/lib/validation'
 import CancelSubscriptionModal from './CancelSubscriptionModal.vue'
 import { useSubscriptionStore } from '@/stores/standalone/subscription.ts'
@@ -88,7 +89,13 @@ async function subscribe() {
     emit('subscription-update')
     subscriptionStore.loadData()
   } catch (e: any) {
-    if (e.response.data.message == 'invalid_secret_or_server_not_found') {
+    // expected outcomes come back as validation errors (400, no global toast)
+    if (
+      e instanceof ValidationError &&
+      e.errorBag.getFirstFor('secret') == 'system_already_registered'
+    ) {
+      errors.value.request = t('standalone.subscription.system_already_registered')
+    } else if (e.response?.data?.message == 'invalid_secret_or_server_not_found') {
       errors.value.request = t('standalone.subscription.invalid_secret_or_server_not_found')
     } else {
       errors.value.request = t(getAxiosErrorMessage(e))
@@ -169,14 +176,42 @@ function requestSync() {
           <NeTextInput
             :label="t('standalone.subscription.system_id')"
             :disabled="true"
-            :model-value="subscriptionData.systemd_id"
+            :model-value="
+              subscriptionData.type === 'enterprise' && subscriptionData.server_id
+                ? String(subscriptionData.server_id)
+                : subscriptionData.systemd_id
+            "
           />
+          <NeLink
+            v-if="subscriptionData.system_url"
+            :href="subscriptionData.system_url"
+            target="_blank"
+            class="-mt-6 text-sm"
+          >
+            {{ t('standalone.subscription.view_on_portal') }}
+          </NeLink>
+          <div v-if="subscriptionData.system_name">
+            <NeHeading tag="h6" class="mb-1.5">{{
+              t('standalone.subscription.system_name')
+            }}</NeHeading>
+            <p class="text-sm font-normal text-gray-500 dark:text-gray-400">
+              {{ subscriptionData.system_name }}
+            </p>
+          </div>
           <div>
             <NeHeading tag="h6" class="mb-1.5">{{ t('standalone.subscription.plan') }}</NeHeading>
             <p class="text-sm font-normal text-gray-500 dark:text-gray-400">
               {{ subscriptionData.plan }}
             </p>
           </div>
+          <div v-if="subscriptionData.organization">
+            <NeHeading tag="h6" class="mb-1.5">{{
+              t('standalone.subscription.company')
+            }}</NeHeading>
+            <p class="text-sm font-normal text-gray-500 dark:text-gray-400">
+              {{ subscriptionData.organization }}
+            </p>
+          </div>
           <div>
             <NeHeading tag="h6" class="mb-1.5">{{
               t('standalone.subscription.expiration')
diff --git a/src/i18n/en.json b/src/i18n/en.json
index 5c74de9c4..db12c28f2 100644
--- a/src/i18n/en.json
+++ b/src/i18n/en.json
@@ -14,6 +14,7 @@
       "about": "About",
       "platform_info": "Controller information"
     },
+    "or": "or",
     "platform": {
       "controller_version": "Controller version",
       "logs_retention_days": "Log retention days",
@@ -628,8 +629,11 @@
       "authentication_token_placeholder": "Paste token here",
       "register": "Register",
       "start_session": "Start session",
+      "system_name": "System name",
       "system_id": "System ID",
+      "view_on_portal": "View system on portal",
       "plan": "Plan",
+      "company": "Company",
       "expiration": "Expiration",
       "no_expiration": "No expiration",
       "status": "Status",
@@ -640,6 +644,9 @@
       "remote_support_session_description": "The session will automatically close on {date}. You can stop it at any time.",
       "stop_session": "Stop session",
       "invalid_secret_or_server_not_found": "Invalid token or server not found",
+      "system_already_registered": "This system is already registered and its token cannot be reused. To subscribe again, create a new system on my.nethesis.it and register with its new token.",
+      "cancel_irreversible_title": "This action cannot be undone",
+      "cancel_irreversible_description": "Once cancelled, this system's token cannot be reused to register again. To subscribe this unit again you will need to create a new system on my.nethesis.it and use its new token.",
       "active": "Active",
       "inactive": "Inactive",
       "confirm_cancel_subscription": "If you cancel the unit subscription you will lose access to the extra features included in your plan. These may include",
@@ -1404,6 +1411,27 @@
         "login_username": "Username",
         "login_password": "Password",
         "login_helper_username": "Enter the username used to access the hotspot manager instance.",
+        "automatic_login": "Automatic login",
+        "automatic_login_description": "Authenticate with your My Nethesis account.",
+        "manual_login": "Manual login",
+        "manual_login_description": "Enter the hotspot manager credentials.",
+        "login_with_my_nethesis": "Login with My Nethesis",
+        "login_oidc_waiting": "Waiting for authentication",
+        "login_oidc_waiting_description": "Complete the login in the browser window that just opened; the unit will be connected automatically.",
+        "login_oidc_success": "Authenticated as {account}",
+        "login_oidc_expired": "The login request expired, please try again.",
+        "login_oidc_failed": "Authentication was not authorized ({error}).",
+        "login_oidc_not_supported": "The hotspot manager does not support My Nethesis login yet.",
+        "login_oidc_popup_blocked": "The browser blocked the login window: allow popups for this site and try again.",
+        "connected_account_title": "Connected account",
+        "connected_account": "Account",
+        "connected_user": "Authenticated by",
+        "connected_manager": "Hotspot manager",
+        "connected_session": "Session status",
+        "session_active": "Active",
+        "session_expired": "Expired",
+        "session_expired_description": "The session with the hotspot manager has expired. Log in again with My Nethesis to manage the hotspot configuration.",
+        "login_oidc_start_failed": "Cannot reach the hotspot manager right now, please try again.",
         "configuration": "Hotspot configuration",
         "configuration_unit_name": "Hotspot unit name",
         "configuration_unit_name_placeholder": "Samplename",
diff --git a/src/i18n/it.json b/src/i18n/it.json
index 815eae721..e7002a27a 100644
--- a/src/i18n/it.json
+++ b/src/i18n/it.json
@@ -1,6 +1,7 @@
 {
   "common": {
     "save": "Salva",
+    "or": "oppure",
     "cancel": "Annulla",
     "search": "Ricerca",
     "help": "Aiuto",
@@ -757,6 +758,7 @@
       "copy_id": "Copia ID",
       "cancel_registration": "Annulla subscription",
       "inactive": "Inattivo",
+      "system_name": "Nome sistema",
       "system_id": "ID sistema",
       "start_session": "Avvia sessione",
       "dpi_filter": "2600+ applicazioni per filtro DPI",
@@ -1348,6 +1350,27 @@
         "login_description": "Esegui il login per modificare la configurazione dell'hotspot o deregistrare l'hotspot.",
         "configuration_network_device_helper": "Scegli un dispositivo di rete: l'hotspot intercetterà tutte le connessioni su questa interfaccia di rete e richiederà l'autenticazione ai client connessi.",
         "login_helper_username": "Inserisci il nome utente utilizzato per accedere all'istanza del hotspot manager.",
+        "automatic_login": "Login automatico",
+        "automatic_login_description": "Autenticati con il tuo account My Nethesis.",
+        "manual_login": "Login manuale",
+        "manual_login_description": "Inserisci le credenziali del hotspot manager.",
+        "login_with_my_nethesis": "Login with My Nethesis",
+        "login_oidc_waiting": "In attesa di autenticazione",
+        "login_oidc_waiting_description": "Completa l'accesso nella finestra del browser appena aperta; l'unità verrà collegata automaticamente.",
+        "login_oidc_success": "Autenticato come {account}",
+        "login_oidc_expired": "La richiesta di accesso è scaduta, riprova.",
+        "login_oidc_failed": "Autenticazione non autorizzata ({error}).",
+        "login_oidc_not_supported": "Il hotspot manager non supporta ancora il login con My Nethesis.",
+        "login_oidc_popup_blocked": "Il browser ha bloccato la finestra di login: consenti i popup per questo sito e riprova.",
+        "connected_account_title": "Account collegato",
+        "connected_account": "Account",
+        "connected_user": "Autenticato da",
+        "connected_manager": "Hotspot manager",
+        "connected_session": "Stato sessione",
+        "session_active": "Attiva",
+        "session_expired": "Scaduta",
+        "session_expired_description": "La sessione con il hotspot manager è scaduta. Accedi di nuovo con My Nethesis per gestire la configurazione del hotspot.",
+        "login_oidc_start_failed": "Impossibile raggiungere il hotspot manager in questo momento, riprova.",
         "unregister_unit": "Rimuovi registrazione unità hotspot",
         "configuration_network_address_helper": "Scegli un indirizzo di rete disponibile; ai dispositivi collegati al hotspot sarà assegnato un indirizzo IP all'interno di questa rete.",
         "empty_network_device_link": "Vai a Interfacce e dispositivi",
diff --git a/src/stores/standalone/subscription.ts b/src/stores/standalone/subscription.ts
index 832babc93..952c33dc0 100644
--- a/src/stores/standalone/subscription.ts
+++ b/src/stores/standalone/subscription.ts
@@ -6,17 +6,24 @@ import type { AxiosResponse } from 'axios'
 type SubscriptionStatusResponse = AxiosResponse<SubscriptionDataType>
 
 export type SubscriptionDataType = {
-  server_id?: number
+  server_id?: number | string
   systemd_id: string
   plan?: string
   expiration?: number
   active?: boolean
+  // enterprise units (migrated to the new my): type='enterprise' and the
+  // organization name; community units keep the legacy plan name and no org.
+  type?: string
+  organization?: string
+  // enterprise: the system name given on my at creation time
+  system_name?: string
 }
 
 export const useSubscriptionStore = defineStore('subscription', () => {
   const loading = ref(true)
   const error = ref<Error>()
   const isActive = ref(false)
+  const isEnterprise = ref(false)
 
   function loadData() {
     loading.value = true
@@ -24,6 +31,7 @@ export const useSubscriptionStore = defineStore('subscription', () => {
     ubusCall('ns.subscription', 'info')
       .then((res: SubscriptionStatusResponse) => {
         isActive.value = res.data.active ?? false
+        isEnterprise.value = res.data.type === 'enterprise'
       })
       .catch((err) => {
         error.value = err
@@ -41,6 +49,7 @@ export const useSubscriptionStore = defineStore('subscription', () => {
     loading,
     loadData,
     isActive,
+    isEnterprise,
     error
   }
 })
diff --git a/src/views/standalone/system/SubscriptionView.vue b/src/views/standalone/system/SubscriptionView.vue
index 2a7c61d71..f91db5b5d 100644
--- a/src/views/standalone/system/SubscriptionView.vue
+++ b/src/views/standalone/system/SubscriptionView.vue
@@ -14,11 +14,19 @@ import { NeInlineNotification, NeHeading, getAxiosErrorMessage } from '@nethesis
 
 /** * @deprecated use SubscriptionDataType in subscription.ts */
 export type SubscriptionDataType = {
-  server_id: number
+  server_id: number | string
   systemd_id: string
   plan: string
   expiration: number
   active: boolean
+  // enterprise units (migrated to the new my): type='enterprise' and the
+  // organization name; community units keep the legacy plan name and no org.
+  type?: string
+  organization?: string
+  // enterprise: the system name given on my at creation time
+  system_name?: string
+  // enterprise: link to the system page on the my portal
+  system_url?: string
 }
 
 const { t } = useI18n()