diff --git a/CHANGELOG.md b/CHANGELOG.md
index 08b1e2d..c466682 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,24 @@
 ## Changelog
 
+### scripts — Hub Mode + FileBrowser Controller-Managed Volumes (2026-02-22)
+
+#### `scripts/docker-setup.sh` — v6.0.0
+- **Hub mode** (`--hub-customer` / `--hub-password`): downloads `controller.yaml` from Hub API early in setup, extracts `domain`, `email`, `cf_api_token`, `cf_tunnel_token` and auto-populates all infrastructure settings. Single one-liner deploys fully configured Traefik + TLS + Cloudflare Tunnel with no additional flags needed. CLI flags always override hub values.
+- **`yaml_get()` helper**: strips leading whitespace before key comparison — required because Go's `yaml.v3` uses 4-space indentation.
+- **`apply_hub_config()`**: called before `print_banner` in `main()` so hub-sourced values are reflected in the plan display.
+- **FileBrowser initial install**: removed drive auto-discovery from `install_filebrowser()`. FileBrowser is now installed with no drive volumes and a minimal `config.yaml` with `/srv` fallback. Drive volumes are managed entirely by the controller (`SyncFileBrowserMounts()`) after storage is registered via the dashboard.
+- **Bug fix**: `((found_mounts++))` → `found_mounts=$(( found_mounts + 1 ))` — `set -euo pipefail` traps post-increment when var=0 (exit code 1). Same fix applied to `step_num` in `install_filebrowser()`.
+
+#### `scripts/felhom-wipe.sh`
+- **`cleanup_scan_dir()`**: removes `/mnt/.felhom-scan/` (ephemeral DR scan directory) — called from `full` level onwards.
+- **`cleanup_raw_mounts()`**: removes raw helper mount infrastructure (`/mnt/.felhom-raw/`) at `nuclear` level: unmounts bind mounts first, then raw mounts, strips fstab entries, removes empty directories. Physical drive data untouched.
+
+#### `scripts/README.md`
+- Hub mode quick start simplified to one-liner
+- Updated installation steps table: step 7 reflects controller-managed FileBrowser volumes
+- Added "Raw helper mounts" section explaining two-level mount architecture
+- Updated wipe levels table for `full` (scan dir) and `nuclear` (raw mounts + scan dir)
+
 ### v0.26.0 — Storage Namespace `felhom-data/` + Test Node Wipe Script (2026-02-22)
 
 All felhom-managed data on external drives now lives under a `felhom-data/` subdirectory, cleanly separating controller-managed data from user files. Plus a multi-level wipe script for repeatable test node cleanup.
diff --git a/scripts/README.md b/scripts/README.md
index 59ac75f..3300eaa 100644
--- a/scripts/README.md
+++ b/scripts/README.md
@@ -69,7 +69,7 @@ The script runs these steps in order:
 | 4b | `install_cloudflare_tunnel()` | Deploy Cloudflare Tunnel (optional, only if tunnel token provided in wizard). |
 | 5 | `generate_self_signed_cert()` | Generate self-signed CA + wildcard cert (optional, if `--self-signed-cert` flag set). |
 | 6 | `run_config_wizard()` | Interactive wizard or Hub download. Generates `controller.yaml` with customer settings. |
-| 7 | `install_filebrowser()` | Deploy FileBrowser Quantum with auto-discovered drive mounts (optional). |
+| 7 | `install_filebrowser()` | Deploy FileBrowser Quantum with no drive volumes (optional). Drive volumes are managed by the controller via `SyncFileBrowserMounts()` after storage is registered. |
 | 8 | `install_controller()` | Deploy felhom-controller (privileged container with system access). |
 | 9 | `install_tools_and_configure()` | Install ctop, lazydocker, Docker shell aliases. |
 
diff --git a/scripts/docker-setup.sh b/scripts/docker-setup.sh
index 6095f11..b149fea 100644
--- a/scripts/docker-setup.sh
+++ b/scripts/docker-setup.sh
@@ -1268,43 +1268,18 @@ install_filebrowser() {
 
     # Calculate step number dynamically
     local step_num=5
-    [[ "$SELF_SIGNED_CERT" == true ]] && ((step_num++))
-    [[ -n "${CF_TUNNEL_TOKEN:-}" ]] && ((step_num++))
+    [[ "$SELF_SIGNED_CERT" == true ]] && step_num=$(( step_num + 1 ))
+    [[ -n "${CF_TUNNEL_TOKEN:-}" ]] && step_num=$(( step_num + 1 ))
     log_step "${step_num}/$(get_total_steps) - Installing FileBrowser Quantum..."
 
-    # Discover drive mounts for FileBrowser volumes
-    local volume_lines=""
-    local mount_comment=""
-    local found_mounts=0
-
-    # Scan /mnt/ for existing mount points (e.g., /mnt/hdd_1, /mnt/sys_drive)
-    if [[ -d /mnt ]]; then
-        for mp in /mnt/*/; do
-            [[ ! -d "$mp" ]] && continue
-            local name
-            name=$(basename "$mp")
-            # Skip hidden dirs and raw mount dirs
-            [[ "$name" == .* ]] && continue
-            [[ "$name" == .felhom-raw ]] && continue
-            volume_lines+="      - \"${mp%/}:/srv/${name}\""$'\n'
-            mount_comment+="      # ${mp%/} → /srv/${name}"$'\n'
-            found_mounts=$(( found_mounts + 1 ))
-        done
-    fi
-
-    # Note: system_data_path is now configured via the web setup wizard,
-    # FileBrowser mounts will be synced by the controller after setup completes.
-
-    if [[ $found_mounts -eq 0 ]]; then
-        log_warn "No mount points found in /mnt/ — FileBrowser will have no drive volumes."
-        log_warn "Drives can be attached later via the controller dashboard."
-    fi
+    # Note: FileBrowser drive volumes are managed entirely by the controller.
+    # SyncFileBrowserMounts() runs on controller startup and regenerates
+    # docker-compose.yml + config.yaml whenever storage paths are added/removed.
+    # docker-setup.sh writes an empty initial config; the controller takes over immediately.
 
     if [[ "$DRY_RUN" == true ]]; then
         echo -e "${CYAN}[DRY-RUN]${NC} Would install FileBrowser Quantum at files.${BASE_DOMAIN}"
-        if [[ $found_mounts -gt 0 ]]; then
-            echo -e "${CYAN}[DRY-RUN]${NC} Would mount ${found_mounts} drive(s)"
-        fi
+        echo -e "${CYAN}[DRY-RUN]${NC} Drive volumes managed by controller (empty on initial install)"
         return
     fi
 
@@ -1331,7 +1306,9 @@ services:
       - TZ=Europe/Budapest
     volumes:
       - filebrowser_data:/home/filebrowser/data
-${volume_lines}    networks:
+      - ./config.yaml:/home/filebrowser/config.yaml:ro
+      # Storage volumes are auto-managed by felhom-controller (SyncFileBrowserMounts)
+    networks:
       - traefik-public
     deploy:
       resources:
@@ -1360,6 +1337,48 @@ networks:
     external: true
 EOF
 
+    # Create initial config.yaml (no storage sources — controller syncs on startup)
+    cat > "${FILEBROWSER_DIR}/config.yaml" << 'CONFIGEOF'
+# FileBrowser Quantum — managed by felhom-controller
+# WARNING: This file is auto-generated. Manual edits will be overwritten.
+
+server:
+  port: 80
+  baseURL: "/"
+  database: "/home/filebrowser/data/database.db"
+  logging:
+    - levels: "info|warning|error"
+  sources:
+    - path: "/srv"
+userDefaults:
+  stickySidebar: true
+  darkMode: true
+  viewMode: "normal"
+  showHidden: false
+  dateFormat: false
+  gallerySize: 3
+  themeColor: "var(--blue)"
+  preview:
+    disableHideSidebar: false
+    highQuality: true
+    image: true
+    video: true
+    motionVideoPreview: true
+    office: true
+    popup: true
+    autoplayMedia: true
+    folder: true
+  permissions:
+    api: false
+    admin: false
+    modify: false
+    share: false
+    realtime: false
+    delete: false
+    create: false
+    download: true
+CONFIGEOF
+
     # Create .felhom.yml metadata
     cat > "${FILEBROWSER_DIR}/.felhom.yml" << 'METAEOF'
 display_name: Filebrowser