diff --git a/.docker/cscli-hub-mirror.sh b/.docker/cscli-hub-mirror.sh
new file mode 100644
index 000000000..039177aec
--- /dev/null
+++ b/.docker/cscli-hub-mirror.sh
@@ -0,0 +1,377 @@
+# shellcheck shell=sh
+# CrowdSec hub mirror retry for cscli. POSIX sh, sourced by .docker/docker-entrypoint.sh and by
+# configs/crowdsec/install_hub_items.sh. The image copies it to /usr/local/lib/charon/cscli-hub-mirror.sh.
+#
+# cscli reads one hub URL template from its config (the hidden key __hub_url_template__). When the hub CDN
+# is unreachable, a retry runs cscli with a derived copy of the config whose template points at the raw
+# GitHub mirror. The live config is never written.
+#
+# The rules follow backend/internal/crowdsec/hub_mirror.go (template checks, refusal of a template the
+# operator already set, the network-failure markers). Keep the two in step. The timeout classification (_hub_timed_out:
+# exit status, signal text, budget expiry) exists only here: the image runs cscli under busybox timeout, which reports
+# a trapped TERM as the command's own exit 1, and the Go side does not classify exit statuses.
+#
+# Internal state, set by this helper and not meant for operators:
+#   CHARON_CSCLI_MIRROR_CONFIG  path of the derived config while it exists
+#   CHARON_CSCLI_MIRROR_FIRST   "1" once a mirror retry answered: later cscli_hub calls go mirror-first
+
+# The shell always uses the built-in mirror template, with no operator mirror base (the Go side can use one).
+_HUB_MIRROR_TEMPLATE='https://raw.githubusercontent.com/crowdsecurity/hub/%s/%s'
+_HUB_MIRROR_KEY='__hub_url_template__'
+_HUB_MIRROR_PREFIX='.charon-hub-mirror-'
+
+# Plain foreground fallback for callers without the entrypoint's stop-aware runner (install_hub_items.sh).
+if ! command -v run_interruptible >/dev/null 2>&1; then
+    run_interruptible() {
+        "$@"
+    }
+fi
+
+# hub_mirror_template_valid <template>
+# Succeeds for an https URL with exactly two %s verbs, no other percent sign and no control characters.
+hub_mirror_template_valid() {
+    case "$1" in
+        https://*%s*%s*) ;;
+        *) return 1 ;;
+    esac
+    _pct=$(printf '%s' "$1" | tr -cd '%' | wc -c | tr -d ' ')
+    if [ "$_pct" != 2 ]; then
+        return 1
+    fi
+    case "$1" in
+        *[[:cntrl:]]*) return 1 ;;
+    esac
+    return 0
+}
+
+# _hub_mirror_match <ERE> <line>
+_hub_mirror_match() {
+    printf '%s\n' "$2" | grep -Eq "$1"
+}
+
+# _hub_mirror_child_indent <config>
+# Prints the indentation of the first child of the cscli section, so an inserted key matches the file.
+_hub_mirror_child_indent() {
+    _ind=$(awk '
+        /^cscli:[[:space:]]*$/ { incscli = 1; next }
+        incscli && /^[^[:space:]#]/ { exit }
+        incscli && /^[[:space:]]+[^[:space:]#]/ { match($0, /^[[:space:]]+/); print substr($0, 1, RLENGTH); exit }
+    ' "$1" 2>/dev/null) || _ind=""
+    printf '%s' "${_ind:-  }"
+}
+
+# Empty YAML values, the same ones the Go side treats as unset: no value, "", '', ~ and null (optionally followed
+# by a comment).
+_HUB_MIRROR_EMPTY_VALUE='(""|'"''"'|~|null)?[[:space:]]*(#.*)?$'
+
+# _hub_mirror_rewrite <live config> <template>
+# Writes the live config to stdout with the template set in its cscli section. An empty hub_branch is set to
+# master, and an empty template key is replaced. Fails (writes nothing usable) when the config already sets a
+# non-empty template, has an inline cscli value such as `cscli: {}`, or has more than one cscli section.
+_hub_mirror_rewrite() {
+    _src=$1
+    _tpl=$2
+    _indent=$(_hub_mirror_child_indent "$_src")
+    _has_branch=0
+    while IFS= read -r _line || [ -n "$_line" ]; do
+        case "$_line" in
+            *hub_branch:*)
+                if ! _hub_mirror_match "^[[:space:]]+hub_branch:[[:space:]]*${_HUB_MIRROR_EMPTY_VALUE}" "$_line"; then
+                    _has_branch=1
+                fi
+                ;;
+        esac
+    done <"$_src"
+    _sections=0
+    while IFS= read -r _line || [ -n "$_line" ]; do
+        case "$_line" in
+            cscli:*)
+                if ! _hub_mirror_match '^cscli:[[:space:]]*$' "$_line"; then
+                    return 1
+                fi
+                _sections=$((_sections + 1))
+                if [ "$_sections" -gt 1 ]; then
+                    return 1
+                fi
+                printf '%s\n' "$_line"
+                printf '%s%s: "%s"\n' "$_indent" "$_HUB_MIRROR_KEY" "$_tpl"
+                if [ "$_has_branch" -eq 0 ]; then
+                    printf '%shub_branch: master\n' "$_indent"
+                fi
+                ;;
+            *"$_HUB_MIRROR_KEY"*)
+                # An empty value is dropped (the line above replaces it); any other value means the operator set a hub.
+                if ! _hub_mirror_match "^[[:space:]]*${_HUB_MIRROR_KEY}:[[:space:]]*${_HUB_MIRROR_EMPTY_VALUE}" "$_line"; then
+                    return 1
+                fi
+                ;;
+            *hub_branch:*)
+                # An empty pin is dropped (master is written with the template); a set pin is kept.
+                if _hub_mirror_match "^[[:space:]]+hub_branch:[[:space:]]*${_HUB_MIRROR_EMPTY_VALUE}" "$_line"; then
+                    continue
+                fi
+                printf '%s\n' "$_line"
+                ;;
+            *)
+                printf '%s\n' "$_line"
+                ;;
+        esac
+    done <"$_src"
+    if [ "$_sections" -eq 0 ]; then
+        printf '\ncscli:\n%s%s: "%s"\n' "$_indent" "$_HUB_MIRROR_KEY" "$_tpl"
+        if [ "$_has_branch" -eq 0 ]; then
+            printf '%shub_branch: master\n' "$_indent"
+        fi
+    fi
+    return 0
+}
+
+# _hub_mirror_sweep <dir>
+# Removes derived configs a previous run left behind. Other files are never touched.
+_hub_mirror_sweep() {
+    for _leftover in "$1/$_HUB_MIRROR_PREFIX"*.yaml "$1/$_HUB_MIRROR_PREFIX"*.yaml.local; do
+        if [ -e "$_leftover" ]; then
+            rm -f "$_leftover"
+        fi
+    done
+    return 0
+}
+
+# _hub_mirror_local_template_set <local config>
+# Succeeds when config.yaml.local names a non-empty hub URL template. CrowdSec merges that file over the config, so
+# such a template would override the derived one. Same rule as _hub_mirror_rewrite: any line naming the key with a
+# value counts.
+_hub_mirror_local_template_set() {
+    while IFS= read -r _line || [ -n "$_line" ]; do
+        case "$_line" in
+            *"$_HUB_MIRROR_KEY"*)
+                if ! _hub_mirror_match "^[[:space:]]*${_HUB_MIRROR_KEY}:[[:space:]]*${_HUB_MIRROR_EMPTY_VALUE}" "$_line"; then
+                    return 0
+                fi
+                ;;
+        esac
+    done <"$1"
+    return 1
+}
+
+# hub_mirror_prepare <live config path>
+# Writes the derived config beside the live one (mode 0600, the live settings with the mirror template), copies
+# config.yaml.local next to it when present (CrowdSec merges that file by name), and exports
+# CHARON_CSCLI_MIRROR_CONFIG. Fails closed, with nothing left behind and nothing exported (so cscli_hub does not
+# retry), when the live config or config.yaml.local already sets a template. Relative paths keep resolving because
+# the copy sits in the same directory.
+hub_mirror_prepare() {
+    _live=$1
+    if ! hub_mirror_template_valid "$_HUB_MIRROR_TEMPLATE"; then
+        return 1
+    fi
+    if [ ! -r "$_live" ]; then
+        return 1
+    fi
+    if [ -f "$_live.local" ] && _hub_mirror_local_template_set "$_live.local"; then
+        return 1
+    fi
+    _dir=$(dirname "$_live")
+    _hub_mirror_sweep "$_dir"
+    _derived="$_dir/$_HUB_MIRROR_PREFIX$$.yaml"
+    if ! (umask 077 && set -C && _hub_mirror_rewrite "$_live" "$_HUB_MIRROR_TEMPLATE" >"$_derived"); then
+        rm -f "$_derived"
+        return 1
+    fi
+    if [ -e "$_live.local" ]; then
+        if ! (umask 077 && cp "$_live.local" "$_derived.local"); then
+            rm -f "$_derived" "$_derived.local"
+            return 1
+        fi
+    fi
+    CHARON_CSCLI_MIRROR_CONFIG=$_derived
+    export CHARON_CSCLI_MIRROR_CONFIG
+    return 0
+}
+
+# hub_mirror_remove
+# Deletes the derived config and its local copy, then forgets the path. Only files named like a derived config
+# are deleted, whatever the variable holds.
+hub_mirror_remove() {
+    _derived="${CHARON_CSCLI_MIRROR_CONFIG:-}"
+    if [ -n "$_derived" ]; then
+        case "$(basename "$_derived")" in
+            "$_HUB_MIRROR_PREFIX"*.yaml)
+                rm -f "$_derived" "$_derived.local"
+                ;;
+        esac
+    fi
+    unset CHARON_CSCLI_MIRROR_CONFIG
+    return 0
+}
+
+# _hub_mirror_available: a derived config was prepared and is still there.
+_hub_mirror_available() {
+    [ -n "${CHARON_CSCLI_MIRROR_CONFIG:-}" ] && [ -r "$CHARON_CSCLI_MIRROR_CONFIG" ]
+}
+
+# _hub_left <deadline epoch seconds>: seconds left before the deadline (may be zero or negative).
+_hub_left() {
+    printf '%s' $(($1 - $(date +%s)))
+}
+
+# _hub_network_failure <kind> <log>: the output names a failed network request or a transport timeout. An expired
+# deadline counts only for `hub update` (kind update), as on the Go side: on an item install or a hub upgrade it can
+# be a healthy slow run that ran out of its time.
+_hub_network_failure() {
+    if grep -Eqi 'dial tcp|no such host|network is unreachable|connection refused|i/o timeout|unable to send request|unable to retrieve latest crowdsec version|client\.timeout|tls handshake timeout|lookup [^[:space:]]+ on [^[:space:]]' "$2"; then
+        return 0
+    fi
+    if [ "$1" = update ]; then
+        grep -Eqi 'context deadline exceeded' "$2"
+        return
+    fi
+    return 1
+}
+
+# _hub_timed_out <status> <log>
+# Succeeds when the last attempt ran out of its budget. Three shapes count, because the image's timeout is busybox's
+# and cscli reports the expiry in more than one way:
+#   - exit 124 (GNU timeout) or 143 (busybox timeout, or a command killed by TERM);
+#   - the signal text cscli prints when it traps the TERM that timeout sends ("terminated signal received", or
+#     Go's "signal: terminated"), which leaves exit 1 on busybox;
+#   - a non-zero exit at or past the budget less one second, and never under two seconds. The clock has whole seconds:
+#     the margin keeps a run that ended right at the budget, and the floor stops an instant failure that crosses a
+#     second boundary from reading as one second. Reads _HUB_ATTEMPT_BUDGET and _HUB_ATTEMPT_ELAPSED from the last attempt.
+_hub_timed_out() {
+    case "$1" in
+        124|143) return 0 ;;
+    esac
+    if grep -Eqi 'terminated signal received|signal: terminated' "$2"; then
+        return 0
+    fi
+    [ "$1" -ne 0 ] && [ "$_HUB_ATTEMPT_ELAPSED" -ge 2 ] && [ "$_HUB_ATTEMPT_ELAPSED" -ge $((_HUB_ATTEMPT_BUDGET - 1)) ]
+}
+
+# _hub_retry_wanted <kind> <status> <log>
+# kind is update (hub update), hub (hub upgrade) or item (type install|upgrade). Only hub update retries when its
+# attempt timed out (_hub_timed_out). Hub upgrades and item installs or upgrades retry on a network failure text
+# only, so a healthy slow run is never cut short. A bare expired deadline counts only for hub update (_hub_network_failure).
+_hub_retry_wanted() {
+    if [ "$1" = update ] && _hub_timed_out "$2" "$3"; then
+        return 0
+    fi
+    _hub_network_failure "$1" "$3"
+}
+
+# _hub_attempt <seconds> <config or empty> <log> <cscli arguments...>
+# Runs one cscli command under timeout with its output in the log, prints the log, and returns the status. It also
+# records the budget and the wall-clock seconds the attempt took, for _hub_timed_out.
+_hub_attempt() {
+    _secs=$1
+    _cfg=$2
+    _log=$3
+    shift 3
+    _HUB_ATTEMPT_BUDGET=$_secs
+    _HUB_ATTEMPT_ELAPSED=0
+    if [ "$_secs" -lt 1 ]; then
+        # timeout 0 would mean no limit at all, so an attempt with no time left is refused instead.
+        : >"$_log"
+        return 124
+    fi
+    if [ -n "$_cfg" ]; then
+        set -- -c "$_cfg" "$@"
+    fi
+    _started=$(date +%s)
+    _status=0
+    run_interruptible timeout "$_secs" cscli "$@" >"$_log" 2>&1 || _status=$?
+    _HUB_ATTEMPT_ELAPSED=$(($(date +%s) - _started))
+    cat "$_log"
+    return "$_status"
+}
+
+# _hub_retry <deadline> <config or empty> <pre: 1|0> <log> <cscli arguments...>
+# Optionally runs `hub update` under the retry config first, then the command, both within the deadline.
+_hub_retry() {
+    _deadline=$1
+    _cfg=$2
+    _pre=$3
+    _log=$4
+    shift 4
+    if [ "$_pre" -eq 1 ]; then
+        _hub_attempt "$(_hub_left "$_deadline")" "$_cfg" "$_log" hub update || return $?
+    fi
+    _hub_attempt "$(_hub_left "$_deadline")" "$_cfg" "$_log" "$@"
+}
+
+# cscli_hub <budget seconds> <cscli arguments...>
+# Runs a cscli command with the retry rules above, all within the budget:
+#   hub update, hub upgrade   attempt 1 gets half the budget; the retry gets the rest
+#   <type> install|upgrade    attempt 1 gets the whole budget; the retry gets the rest
+#   anything else             one attempt, no retry
+# The retry uses the derived mirror config when one was prepared. When the mirror is the first choice (after an
+# earlier mirror win), the live config is the retry. Before a retry of an install, an upgrade or `hub upgrade`,
+# `hub update` runs under the retry config so the index and the items come from one source.
+# A mirror retry that answers sets CHARON_CSCLI_MIRROR_FIRST=1; a live retry that answers clears it.
+# Returns the status of the last attempt and prints every attempt's output.
+cscli_hub() {
+    _budget=$1
+    shift
+    _deadline=$(($(date +%s) + _budget))
+    _kind=none
+    _first=$_budget
+    if [ "${1:-}" = hub ]; then
+        case "${2:-}" in
+            update)
+                _kind=update
+                _first=$((_budget / 2))
+                ;;
+            upgrade)
+                _kind=hub
+                _first=$((_budget / 2))
+                ;;
+        esac
+    else
+        case "${2:-}" in
+            install|upgrade) _kind=item ;;
+        esac
+    fi
+    if [ "$_first" -lt 1 ]; then
+        _first=1
+    fi
+
+    _retry_ok=0
+    _first_cfg=""
+    _retry_cfg=""
+    if _hub_mirror_available; then
+        _retry_ok=1
+        if [ "${CHARON_CSCLI_MIRROR_FIRST:-}" = 1 ]; then
+            _first_cfg=$CHARON_CSCLI_MIRROR_CONFIG
+        else
+            _retry_cfg=$CHARON_CSCLI_MIRROR_CONFIG
+        fi
+    fi
+
+    _log=$(mktemp "${TMPDIR:-/tmp}/charon-cscli-hub.XXXXXX") || return 1
+    _rc=0
+    _hub_attempt "$_first" "$_first_cfg" "$_log" "$@" || _rc=$?
+    if [ "$_rc" -ne 0 ] && [ "$_kind" != none ] && [ "$_retry_ok" -eq 1 ] &&
+        _hub_retry_wanted "$_kind" "$_rc" "$_log" && [ "$(_hub_left "$_deadline")" -gt 0 ]; then
+        _pre=0
+        if [ "$_kind" = item ] || [ "${2:-}" = upgrade ]; then
+            _pre=1
+        fi
+        if [ -n "$_retry_cfg" ]; then
+            echo "cscli $* did not complete on the CDN; retrying through the hub mirror."
+        else
+            echo "cscli $* did not complete; retrying on the default hub source."
+        fi
+        _retry_rc=0
+        _hub_retry "$_deadline" "$_retry_cfg" "$_pre" "$_log" "$@" || _retry_rc=$?
+        _rc=$_retry_rc
+        if [ "$_rc" -eq 0 ]; then
+            if [ -n "$_retry_cfg" ]; then
+                export CHARON_CSCLI_MIRROR_FIRST=1
+            else
+                unset CHARON_CSCLI_MIRROR_FIRST
+            fi
+        fi
+    fi
+    rm -f "$_log"
+    return "$_rc"
+}
diff --git a/.docker/docker-entrypoint.sh b/.docker/docker-entrypoint.sh
index 20a36246e..20030ca1b 100755
--- a/.docker/docker-entrypoint.sh
+++ b/.docker/docker-entrypoint.sh
@@ -4,6 +4,10 @@ set -e
 # Entrypoint script to run both Caddy and Charon in a single container
 # This simplifies deployment for home users
 
+# Internal state of the hub mirror helper (cscli-hub-mirror.sh). Never taken from the environment: an
+# operator-set path here would be deleted at shutdown.
+unset CHARON_CSCLI_MIRROR_CONFIG CHARON_CSCLI_MIRROR_FIRST
+
 echo "Starting Charon with integrated Caddy..."
 
 # Child PIDs of the background processes started below. Empty until launched.
@@ -37,6 +41,11 @@ shutdown() {
     fi
     # Note: CrowdSec process lifecycle is managed by backend handlers
     # The backend will handle graceful CrowdSec shutdown when the container stops
+    # Remove the derived hub mirror config (a copy of the cscli settings). There is no EXIT trap, so this is the
+    # only cleanup on a stop; a crash leftover is swept by the next startup.
+    if command -v hub_mirror_remove >/dev/null 2>&1; then
+        hub_mirror_remove
+    fi
     exit "$_rc"
 }
 
@@ -94,6 +103,22 @@ run_interruptible() {
     return "$_status"
 }
 
+# hub mirror helper: cscli_hub (cscli with the mirror retry), hub_mirror_prepare and hub_mirror_remove.
+# It needs run_interruptible, so it is sourced after it. Without the helper, cscli_hub runs cscli once, unretried,
+# so the startup still works.
+CS_HUB_MIRROR_HELPER=/usr/local/lib/charon/cscli-hub-mirror.sh
+if [ -r "$CS_HUB_MIRROR_HELPER" ]; then
+    # The helper is linted and tested on its own (scripts/cscli_hub_mirror_test.sh), so it is not followed here.
+    # shellcheck source=/dev/null
+    . "$CS_HUB_MIRROR_HELPER"
+else
+    cscli_hub() {
+        _budget=$1
+        shift
+        run_interruptible timeout "$_budget" cscli "$@"
+    }
+fi
+
 get_group_by_gid() {
     if command -v getent >/dev/null 2>&1; then
         getent group "$1" 2>/dev/null || true
@@ -320,7 +345,7 @@ if command -v cscli >/dev/null; then
             echo "DEBUG: Symlink target verification:"
             ls -la /etc/crowdsec 2>/dev/null || echo "  (symlink broken or missing)"
             echo "DEBUG: Directory contents:"
-            ls -la "$CS_CONFIG_DIR/" 2>/dev/null | head -10 || echo "  (directory not found)"
+            find "$CS_CONFIG_DIR" -mindepth 1 -maxdepth 1 -exec ls -ld {} + 2>/dev/null | head -10 || echo "  (directory not found)"
             exit 1
         fi
         echo "✓ /etc/crowdsec/config.yaml is accessible via symlink"
@@ -454,9 +479,15 @@ ACQUIS_EOF
     if [ "${CHARON_SECURITY_TESTS_ENABLED}" = "false" ]; then
         echo "⚡ Skipping CrowdSec hub initialization (CHARON_SECURITY_TESTS_ENABLED=false)"
     else
+        # Derived cscli config that points the hub at the raw mirror, used by the retry in cscli_hub.
+        # Removed again once the hub startup steps are done.
+        if command -v hub_mirror_prepare >/dev/null 2>&1 && ! hub_mirror_prepare "$CS_CONFIG_DIR/config.yaml"; then
+            echo "⚠️ Hub mirror retry unavailable (the cscli config could not be prepared)."
+        fi
+
         # Always refresh hub index on startup (stale index causes hash mismatch errors on collection install)
         echo "Updating CrowdSec hub index..."
-        if ! run_interruptible timeout 60s cscli hub update 2>&1; then
+        if ! cscli_hub 60 hub update; then
             echo "⚠️ Hub index update failed (network issue?). Collections may fail to install."
             echo "   CrowdSec will still start with whatever index is cached."
         fi
@@ -479,7 +510,7 @@ ACQUIS_EOF
         if [ -n "$MISSING_HUB_DATA" ]; then
             echo "⚠️ CrowdSec hub data files missing from $CS_DATA_DIR: $(echo "$MISSING_HUB_DATA" | tr '\n' ' ')"
             echo "Running 'cscli hub upgrade' to restore them (this also upgrades installed hub items)..."
-            if ! run_interruptible timeout 120s cscli hub upgrade 2>&1; then
+            if ! cscli_hub 120 hub upgrade; then
                 echo "⚠️ Hub upgrade failed or timed out. CrowdSec will start, but some detection data may be missing until the next restart."
             fi
             STILL_MISSING="$(list_missing_hub_data_files "$CS_CONFIG_DIR" "$CS_DATA_DIR")"
@@ -489,6 +520,11 @@ ACQUIS_EOF
                 echo "✓ CrowdSec hub data files restored"
             fi
         fi
+
+        # The derived mirror config is not needed past the hub startup steps. Remove it before the ownership fix.
+        if command -v hub_mirror_remove >/dev/null 2>&1; then
+            hub_mirror_remove
+        fi
     fi
 
     # Fix ownership AFTER cscli commands (they run as root and create root-owned files)
diff --git a/.dockerignore b/.dockerignore
index 22bde238f..3170d81e7 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -174,6 +174,7 @@ scripts/lib/prune-common.sh
 scripts/prune-ghcr.sh
 scripts/prune-dockerhub.sh
 scripts/crowdsec_data_persistence_test.sh
+scripts/cscli_hub_mirror_test.sh
 
 # -----------------------------------------------------------------------------
 # Tools (not needed in image)
diff --git a/.github/workflows/build-offline.yml b/.github/workflows/build-offline.yml
index 95ff8548b..54ea7adfe 100644
--- a/.github/workflows/build-offline.yml
+++ b/.github/workflows/build-offline.yml
@@ -59,6 +59,17 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Free disk space
+        uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6  # v2.0.0
+        with:
+          android: true
+          dotnet: true
+          haskell: true
+          large-packages: true
+          docker-images: false
+          swap-storage: true
+          tool-cache: false
+
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
diff --git a/.github/workflows/quality-checks.yml b/.github/workflows/quality-checks.yml
index 87421a864..bfa217255 100644
--- a/.github/workflows/quality-checks.yml
+++ b/.github/workflows/quality-checks.yml
@@ -154,6 +154,38 @@ jobs:
       - name: bats
         run: bats scripts/tests/prune-ghcr.bats scripts/tests/prune-dockerhub.bats
 
+  cscli-hub-mirror-tests:
+    name: CrowdSec hub mirror helper (shell)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install shellcheck, dash and busybox
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y shellcheck dash busybox
+
+      - name: shellcheck (hub mirror helper, entrypoint and its test)
+        run: |
+          shellcheck --severity=error \
+            .docker/cscli-hub-mirror.sh \
+            .docker/docker-entrypoint.sh \
+            scripts/cscli_hub_mirror_test.sh
+
+      - name: Hub mirror helper tests (bash, dash, busybox sh)
+        run: |
+          bash scripts/cscli_hub_mirror_test.sh
+          dash scripts/cscli_hub_mirror_test.sh
+          busybox sh scripts/cscli_hub_mirror_test.sh
+
   toolchain-key-tests:
     name: Toolchain key / freshness-guard scripts (bats)
     runs-on: ubuntu-latest
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 89832c4e1..d0c3cb1f2 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -945,10 +945,12 @@ re-download them (startup log line only; no UI). `scripts/crowdsec_data_persiste
 verifies this in the CrowdSec integration job.
 
 **Versioning:** the bundled `cscli` and `crowdsec` binaries report their real
-version (currently v1.8.1); the Docker build fails if they do not. The
+version (currently v1.8.2); the Docker build fails if they do not. The
 entrypoint pins `cscli.hub_branch: master` in the CrowdSec config for
 deterministic hub access (an operator-set value is preserved).
 
+**Hub fallback:** every hub request attempt gets its own share of the remaining time budget (`attemptContext`, `internal/crowdsec/hub_budget.go`, floor 5 s). When `cscli hub update`, upgrade, or an item install fails on the live hub address, Charon runs the same command once more under a derived cscli configuration: a copy of the live file with cscli's hidden `__hub_url_template__` key pointed at the GitHub mirror. The live file is never written, and the copy is removed afterwards. `hub update` gives the live address half of its budget first. A winning mirror retry opens a mirror-first window of 10 minutes (`mirrorMemoryTTL`, not extended by later wins) that the API process keeps in memory. The window applies only to cscli operations (hub update and item installs): if the mirror then fails, cscli tries the live address again. The presets list and preset pulls always try the live address first, so each of those requests can take about 11 seconds longer during an outage. Startup and item installs use the POSIX helper `.docker/cscli-hub-mirror.sh` (installed as `/usr/local/lib/charon/cscli-hub-mirror.sh`, sourced by `.docker/docker-entrypoint.sh` and `configs/crowdsec/install_hub_items.sh`), which keeps its mirror-first flag only for that startup run. The `CHARON_CSCLI_MIRROR_CONFIG` and `CHARON_CSCLI_MIRROR_FIRST` variables are internal state set by that helper; they are not operator settings, and the entrypoint clears them at start. Derived `.charon-hub-mirror-*` files are excluded from listings, reads, exports and imports. The presets list answers 200 with `hub_offline: true` when it was served without a usable hub index; a pull or apply that reaches no hub route answers 503 `hub_unreachable`.
+
 **Modes:**
 
 - **Local Only:** No external API calls
diff --git a/Dockerfile b/Dockerfile
index 526f319fc..3ebe84f76 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1158,6 +1158,9 @@ COPY --from=frontend-builder --chown=charon:charon /app/frontend/dist /app/front
 COPY .docker/docker-entrypoint.sh /docker-entrypoint.sh
 RUN chmod +x /docker-entrypoint.sh
 
+# Hub mirror retry helper, sourced by the startup script (sourced, not executed, so no chmod)
+COPY .docker/cscli-hub-mirror.sh /usr/local/lib/charon/cscli-hub-mirror.sh
+
 # Copy utility scripts (used for DB recovery and maintenance)
 COPY --chown=charon:charon scripts/ /app/scripts/
 RUN chmod +x /app/scripts/db-recovery.sh
diff --git a/backend/internal/api/handlers/crowdsec_cscli.go b/backend/internal/api/handlers/crowdsec_cscli.go
index c18e282b7..860f93969 100644
--- a/backend/internal/api/handlers/crowdsec_cscli.go
+++ b/backend/internal/api/handlers/crowdsec_cscli.go
@@ -39,9 +39,36 @@ const (
 // time returns an error that wraps context.DeadlineExceeded, whether the process was killed or reported the
 // context error itself.
 func (h *CrowdsecHandler) runCSCLI(ctx context.Context, timeout time.Duration, args ...string) ([]byte, error) {
+	return h.runTimedCSCLI(ctx, timeout, func(runCtx context.Context) ([]byte, error) {
+		return crowdsec.RunCSCLI(runCtx, h.CmdExec, crowdsec.FindConfigFile(h.DataDir), args...)
+	})
+}
+
+// runHubCSCLI runs one cscli hub download under its own deadline, as runCSCLI does. A failed hub address is retried
+// once on the hub mirror (see crowdsec.RunHubCSCLI) with the handler's executor.
+func (h *CrowdsecHandler) runHubCSCLI(ctx context.Context, timeout time.Duration, args ...string) ([]byte, error) {
+	return h.runTimedCSCLI(ctx, timeout, func(runCtx context.Context) ([]byte, error) {
+		return crowdsec.RunHubCSCLI(runCtx, h.CmdExec, h.hubMirrorOptions(), args...)
+	})
+}
+
+// hubMirrorOptions returns the mirror retry settings for the handler's data directory. Without a hub service
+// there is no mirror window and no mirror template, so a failed hub address is not retried.
+func (h *CrowdsecHandler) hubMirrorOptions() crowdsec.HubCSCLIOptions {
+	opts := crowdsec.HubCSCLIOptions{ConfigPath: crowdsec.FindConfigFile(h.DataDir)}
+	if h.Hub != nil {
+		hubOpts := h.Hub.MirrorOptions()
+		opts.Template, opts.Memory = hubOpts.Template, hubOpts.Memory
+	}
+	return opts
+}
+
+// runTimedCSCLI runs one cscli call under a deadline of timeout. A call that ran out of time returns an error that
+// wraps context.DeadlineExceeded, whether the process was killed or reported the context error itself.
+func (h *CrowdsecHandler) runTimedCSCLI(ctx context.Context, timeout time.Duration, run func(context.Context) ([]byte, error)) ([]byte, error) {
 	runCtx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
-	out, err := crowdsec.RunCSCLI(runCtx, h.CmdExec, crowdsec.FindConfigFile(h.DataDir), args...)
+	out, err := run(runCtx)
 	if err != nil && errors.Is(runCtx.Err(), context.DeadlineExceeded) && !errors.Is(err, context.DeadlineExceeded) {
 		err = fmt.Errorf("cscli did not finish in time: %w: %w", context.DeadlineExceeded, err)
 	}
diff --git a/backend/internal/api/handlers/crowdsec_files_test.go b/backend/internal/api/handlers/crowdsec_files_test.go
index b197529f3..4f4472e7c 100644
--- a/backend/internal/api/handlers/crowdsec_files_test.go
+++ b/backend/internal/api/handlers/crowdsec_files_test.go
@@ -97,32 +97,37 @@ func errorOf(t *testing.T, w *httptest.ResponseRecorder) string {
 func TestCrowdsecFiles_Predicates(t *testing.T) {
 	t.Parallel()
 	readable := map[string]bool{
-		"config.yaml":                           true,
-		"config/config.yaml":                    true,
-		"config/scenarios/x.yaml":               true,
-		"config/acquis.d/a.conf":                true,
-		"notes.md":                              true,
-		"config/data/nested.yaml":               true, // only the top-level data/ is protected
-		"bouncer_key":                           false,
-		"bouncer_key.tmp-1234":                  false,
-		"config/bouncer_key":                    false,
-		"crowdsec.db":                           false,
-		"config/crowdsec.db-wal":                false,
-		"data/crowdsec.db":                      false,
-		"data/GeoLite2-City.mmdb":               false,
-		"hub_cache/a.tgz":                       false,
-		"config/other.db":                       false,
-		"config/other.db-journal":               false,
-		"config/CASE.DB":                        false,
-		"data":                                  false,
-		"hub_cache":                             false,
-		"local_api_credentials.yaml":            false,
-		"config/local_api_credentials.yaml":     false,
-		"config/online_api_credentials.yaml":    false,
-		"config/Local_API_Credentials.YAML":     false,
-		"config/ONLINE_API_CREDENTIALS.yaml":    false,
-		"config/local_api_credentials.yaml.bak": true,
-		"config/hub_cache/thing.yaml":           true,
+		"config.yaml":                               true,
+		"config/config.yaml":                        true,
+		"config/scenarios/x.yaml":                   true,
+		"config/acquis.d/a.conf":                    true,
+		"notes.md":                                  true,
+		"config/data/nested.yaml":                   true, // only the top-level data/ is protected
+		"bouncer_key":                               false,
+		"bouncer_key.tmp-1234":                      false,
+		"config/bouncer_key":                        false,
+		"crowdsec.db":                               false,
+		"config/crowdsec.db-wal":                    false,
+		"data/crowdsec.db":                          false,
+		"data/GeoLite2-City.mmdb":                   false,
+		"hub_cache/a.tgz":                           false,
+		"config/other.db":                           false,
+		"config/other.db-journal":                   false,
+		"config/CASE.DB":                            false,
+		"data":                                      false,
+		"hub_cache":                                 false,
+		"local_api_credentials.yaml":                false,
+		"config/local_api_credentials.yaml":         false,
+		"config/online_api_credentials.yaml":        false,
+		"config/Local_API_Credentials.YAML":         false,
+		"config/ONLINE_API_CREDENTIALS.yaml":        false,
+		"config/local_api_credentials.yaml.bak":     true,
+		"config/hub_cache/thing.yaml":               true,
+		".charon-hub-mirror-a1b2.yaml":              false,
+		".charon-hub-mirror-a1b2.yaml.local":        false,
+		"config/.charon-hub-mirror-a1b2.yaml":       false,
+		"config/.charon-hub-mirror-a1b2.yaml.local": false,
+		".charon-hub-mirror-a1b2.yaml.bak":          true,
 	}
 	for rel, want := range readable {
 		assert.Equal(t, want, isReadable(rel), "isReadable(%q)", rel)
diff --git a/backend/internal/api/handlers/crowdsec_hub_items.go b/backend/internal/api/handlers/crowdsec_hub_items.go
index 2d54b26f9..7f8f80aa6 100644
--- a/backend/internal/api/handlers/crowdsec_hub_items.go
+++ b/backend/internal/api/handlers/crowdsec_hub_items.go
@@ -232,7 +232,7 @@ func (h *CrowdsecHandler) hubUpdate(ctx context.Context, limit time.Duration) er
 		return fmt.Errorf("wait for the data lock: %w", err)
 	}
 	defer h.dataMu.Unlock()
-	if out, err := h.runCSCLI(ctx, limit, "hub", "update"); err != nil {
+	if out, err := h.runHubCSCLI(ctx, limit, "hub", "update"); err != nil {
 		return fmt.Errorf("hub update: %w (%s)", err, hubLogDetail(string(out)))
 	}
 	return nil
@@ -312,7 +312,7 @@ func (h *CrowdsecHandler) installHubItem(ctx context.Context, itemLimit time.Dur
 
 	// Literal binary, no shell, one item per call; type and name passed ValidHubItem checks and cannot
 	// read as a flag.
-	out, err := h.runCSCLI(ctx, limit, it.Type, "install", it.Name)
+	out, err := h.runHubCSCLI(ctx, limit, it.Type, "install", it.Name)
 	if err != nil {
 		logger.Log().
 			WithField("type", hubLogDetail(it.Type)).WithField("name", hubLogDetail(it.Name)).
diff --git a/backend/internal/api/handlers/crowdsec_hub_mirror_memory_test.go b/backend/internal/api/handlers/crowdsec_hub_mirror_memory_test.go
new file mode 100644
index 000000000..353d8590a
--- /dev/null
+++ b/backend/internal/api/handlers/crowdsec_hub_mirror_memory_test.go
@@ -0,0 +1,59 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/Wikid82/charon/backend/internal/crowdsec"
+)
+
+// hubDialFailure is the cscli output of a hub address that refuses the connection.
+const hubDialFailure = "failed http request for https://cdn-hub.crowdsec.net/crowdsecurity/hub/.index.json: dial tcp 1.2.3.4:443: connection refused"
+
+// dialFirstExec fails its first failCalls cscli calls with a dial error and answers every later call.
+type dialFirstExec struct {
+	failCalls int
+	calls     int
+}
+
+func (e *dialFirstExec) Execute(_ context.Context, _ string, _ ...string) ([]byte, error) {
+	e.calls++
+	if e.calls <= e.failCalls {
+		return []byte(hubDialFailure), errors.New("exit status 1")
+	}
+	return []byte("ok"), nil
+}
+
+// TestHubMirrorMemoryIsSharedByHandlerAndApply pins that the handler's hub downloads and the hub service's own
+// downloads (the apply job path) read and write one mirror-first window: a win on either side is seen by the other.
+func TestHubMirrorMemoryIsSharedByHandlerAndApply(t *testing.T) {
+	dataDir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(dataDir, "config"), 0o750))
+	require.NoError(t, os.WriteFile(filepath.Join(dataDir, "config", "config.yaml"), []byte("cscli:\n  hub_branch: master\n"), 0o600))
+
+	hub := crowdsec.NewHubService(nil, nil, dataDir)
+	hub.MirrorBaseURL = "https://raw.githubusercontent.com/crowdsecurity/hub/master"
+	h := newTestCrowdsecHandler(t, OpenTestDB(t), &fakeExec{}, "/bin/false", dataDir)
+	h.Hub = hub
+	h.CmdExec = &dialFirstExec{failCalls: 1}
+
+	require.Same(t, hub.MirrorOptions().Memory, h.hubMirrorOptions().Memory, "handler and hub service share one mirror window")
+	require.False(t, hub.MirrorOptions().Memory.Active())
+
+	// A handler download wins on the mirror: the apply side sees the window open.
+	_, err := h.runHubCSCLI(context.Background(), 10*time.Second, "collections", "install", "demo")
+	require.NoError(t, err)
+	require.True(t, hub.MirrorOptions().Memory.Active(), "the apply job sees the window the handler opened")
+
+	// An apply-side download (the mirror-first attempt fails, the live address answers) clears the window the handler sees.
+	applyExec := &dialFirstExec{failCalls: 1}
+	_, err = crowdsec.RunHubCSCLI(context.Background(), applyExec, hub.MirrorOptions(), "collections", "install", "demo")
+	require.NoError(t, err)
+	require.False(t, h.hubMirrorOptions().Memory.Active(), "the handler sees the window the apply job cleared")
+}
diff --git a/backend/internal/api/handlers/crowdsec_hub_mirror_retry_test.go b/backend/internal/api/handlers/crowdsec_hub_mirror_retry_test.go
new file mode 100644
index 000000000..cff3c9729
--- /dev/null
+++ b/backend/internal/api/handlers/crowdsec_hub_mirror_retry_test.go
@@ -0,0 +1,100 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/Wikid82/charon/backend/internal/crowdsec"
+)
+
+// hubMirrorDialFailure is the output cscli prints when the hub address refuses the connection.
+const hubMirrorDialFailure = "failed http request for https://cdn-hub.crowdsec.net/crowdsecurity/hub/.index.json: dial tcp 1.2.3.4:443: connection refused"
+
+// hubMirrorExec answers each cscli call from respond and records the arguments of every call.
+type hubMirrorExec struct {
+	calls   [][]string
+	respond func(n int, args []string) ([]byte, error)
+}
+
+func (e *hubMirrorExec) Execute(_ context.Context, name string, args ...string) ([]byte, error) {
+	if name != "cscli" {
+		return nil, errors.New("unexpected executable: " + name)
+	}
+	n := len(e.calls)
+	e.calls = append(e.calls, append([]string(nil), args...))
+	return e.respond(n, args)
+}
+
+// hubMirrorConfigFlag returns the path after -c in a cscli call, or "".
+func hubMirrorConfigFlag(args []string) string {
+	for i := 0; i+1 < len(args); i++ {
+		if args[i] == "-c" {
+			return args[i+1]
+		}
+	}
+	return ""
+}
+
+// newHubMirrorHandler returns a handler whose live configuration exists in its data directory and whose cscli runs
+// through exec, the executor the handler uses for hub requests.
+func newHubMirrorHandler(t *testing.T, exec CommandExecutor) *CrowdsecHandler {
+	t.Helper()
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "config.yaml"), []byte("cscli:\n  hub_branch: master\n"), 0o600))
+	h := newTestCrowdsecHandler(t, OpenTestDB(t), &countingExec{running: true}, "/bin/false", dir)
+	h.CmdExec = exec
+	// The hub service has no executor of its own: a retry that used it instead of CmdExec would fail the test.
+	h.Hub = crowdsec.NewHubService(nil, nil, dir)
+	return h
+}
+
+func TestHubUpdateRetriesOnMirrorThroughHandlerExecutor(t *testing.T) {
+	exec := &hubMirrorExec{respond: func(n int, args []string) ([]byte, error) {
+		if n == 0 {
+			require.Equal(t, "-c", args[0])
+			return []byte(hubMirrorDialFailure), errors.New("exit status 1")
+		}
+		return nil, nil
+	}}
+	h := newHubMirrorHandler(t, exec)
+
+	require.NoError(t, h.hubUpdate(context.Background(), time.Minute))
+	require.Len(t, exec.calls, 2)
+	require.False(t, strings.HasPrefix(filepath.Base(hubMirrorConfigFlag(exec.calls[0])), ".charon-hub-mirror-"))
+	require.True(t, strings.HasPrefix(filepath.Base(hubMirrorConfigFlag(exec.calls[1])), ".charon-hub-mirror-"),
+		"the second hub update runs under the derived mirror configuration")
+	require.Equal(t, []string{"hub", "update"}, exec.calls[1][2:])
+}
+
+func TestInstallHubItemFailsWhenMirrorRetryFails(t *testing.T) {
+	exec := &hubMirrorExec{respond: func(_ int, args []string) ([]byte, error) {
+		if strings.Contains(strings.Join(args, " "), " install ") {
+			return []byte(hubMirrorDialFailure), errors.New("exit status 1")
+		}
+		return nil, nil
+	}}
+	h := newHubMirrorHandler(t, exec)
+
+	reason := h.installHubItem(context.Background(), time.Minute, crowdsec.HubItem{Type: "collections", Name: "crowdsecurity/demo"})
+	require.Equal(t, hubReasonInstallFail, reason)
+	require.Len(t, exec.calls, 3, "live install, mirror hub update, mirror install")
+	require.Equal(t, []string{"collections", "install", "crowdsecurity/demo"}, exec.calls[2][2:])
+}
+
+func TestHubUpdateWithoutHubServiceIsNotRetried(t *testing.T) {
+	exec := &hubMirrorExec{respond: func(_ int, _ []string) ([]byte, error) {
+		return []byte(hubMirrorDialFailure), errors.New("exit status 1")
+	}}
+	h := newHubMirrorHandler(t, exec)
+	h.Hub = nil
+
+	require.Error(t, h.hubUpdate(context.Background(), time.Minute))
+	require.Len(t, exec.calls, 1)
+}
diff --git a/backend/internal/api/handlers/crowdsec_preset_handler.go b/backend/internal/api/handlers/crowdsec_preset_handler.go
index 2f24f145e..ffe2f1035 100644
--- a/backend/internal/api/handlers/crowdsec_preset_handler.go
+++ b/backend/internal/api/handlers/crowdsec_preset_handler.go
@@ -80,10 +80,15 @@ func (h *CrowdsecHandler) ListPresets(c *gin.Context) {
 		return result[key]
 	}
 
+	// hubOffline is true when the list was served without the hub: no hub service, no index, or the index the
+	// local cscli data listed instead of the HTTP index.
+	hubOffline := h.Hub == nil
+
 	// Merge hub index when available
 	if h.Hub != nil {
 		ctx := c.Request.Context()
 		if idx, err := h.Hub.FetchIndex(ctx); err == nil {
+			hubOffline = idx.Offline()
 			for _, item := range idx.Items {
 				slug := strings.TrimSpace(item.Name)
 				if slug == "" {
@@ -101,6 +106,7 @@ func (h *CrowdsecHandler) ListPresets(c *gin.Context) {
 				}).Available = true
 			}
 		} else {
+			hubOffline = true
 			logger.Log().WithError(err).Warn("crowdsec hub index unavailable")
 		}
 	}
@@ -129,12 +135,20 @@ func (h *CrowdsecHandler) ListPresets(c *gin.Context) {
 		}
 	}
 
+	// Without the hub, a hub-backed preset can only be pulled when it is cached already. Curated non-hub presets
+	// and cached presets work offline. Online, availability stays as the index merge set it.
+	if hubOffline {
+		for _, v := range result {
+			v.Available = v.Cached || !v.RequiresHub
+		}
+	}
+
 	list := make([]presetInfo, 0, len(result))
 	for _, v := range result {
 		list = append(list, *v)
 	}
 
-	c.JSON(http.StatusOK, gin.H{"presets": list})
+	c.JSON(http.StatusOK, gin.H{"presets": list, "hub_offline": hubOffline})
 }
 
 // PullPreset downloads and caches a hub preset while returning a preview.
diff --git a/backend/internal/api/handlers/crowdsec_preset_handler_test.go b/backend/internal/api/handlers/crowdsec_preset_handler_test.go
index 86bbac230..111b94dff 100644
--- a/backend/internal/api/handlers/crowdsec_preset_handler_test.go
+++ b/backend/internal/api/handlers/crowdsec_preset_handler_test.go
@@ -120,8 +120,9 @@ func TestPullPresetHandlerTimeout(t *testing.T) {
 	req.Header.Set("Content-Type", "application/json")
 	r.ServeHTTP(w, req)
 
-	require.Equal(t, http.StatusGatewayTimeout, w.Code)
-	require.Contains(t, w.Body.String(), "deadline")
+	// Every address failed at transport level, so the hub is unreachable rather than the request timing out.
+	require.Equal(t, http.StatusServiceUnavailable, w.Code)
+	require.Contains(t, w.Body.String(), "hub_unreachable")
 }
 
 func TestGetCachedPresetNotFound(t *testing.T) {
diff --git a/backend/internal/api/handlers/crowdsec_preset_hub_bounded_test.go b/backend/internal/api/handlers/crowdsec_preset_hub_bounded_test.go
new file mode 100644
index 000000000..19ee00c0f
--- /dev/null
+++ b/backend/internal/api/handlers/crowdsec_preset_hub_bounded_test.go
@@ -0,0 +1,75 @@
+package handlers
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+
+	"github.com/Wikid82/charon/backend/internal/crowdsec"
+)
+
+// hangingHubTransport holds every hub request until its context ends, the way a dropped connection does.
+func hangingHubTransport(req *http.Request) (*http.Response, error) {
+	<-req.Context().Done()
+	return nil, req.Context().Err()
+}
+
+// newHangingHubPresetRouter wires a handler whose hub never answers and whose overall pull budget is short.
+func newHangingHubPresetRouter(t *testing.T, budget time.Duration) *gin.Engine {
+	t.Helper()
+	cache, err := crowdsec.NewHubCache(t.TempDir(), time.Hour)
+	require.NoError(t, err)
+	hub := crowdsec.NewHubService(nil, cache, t.TempDir())
+	hub.PullTimeout = budget
+	hub.HTTPClient = &http.Client{Transport: presetRoundTripper(hangingHubTransport)}
+
+	h := newTestCrowdsecHandler(t, OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
+	h.Hub = hub
+	r := gin.New()
+	h.RegisterRoutes(r.Group("/api/v1"))
+	return r
+}
+
+// The preset list answers inside the hub's overall budget when every hub address hangs, with the curated presets.
+func TestListPresetsBoundedWhenEveryHubAddressHangs(t *testing.T) {
+	const budget = 6 * time.Second
+	r := newHangingHubPresetRouter(t, budget)
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/presets", http.NoBody)
+	start := time.Now()
+	r.ServeHTTP(w, req)
+	elapsed := time.Since(start)
+
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Less(t, elapsed, budget+time.Second, "the list waits no longer than the hub's overall budget")
+	var body struct {
+		Presets []map[string]any `json:"presets"`
+	}
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &body))
+	require.NotEmpty(t, body.Presets, "curated presets are still listed")
+}
+
+// A pull whose hub addresses both hang ends as hub_unreachable inside the budget, not as a generic gateway error.
+func TestPullPresetHubUnreachableWhenEveryHubAddressHangs(t *testing.T) {
+	const budget = 6 * time.Second
+	r := newHangingHubPresetRouter(t, budget)
+
+	body, err := json.Marshal(map[string]string{"slug": "crowdsecurity/missing"})
+	require.NoError(t, err)
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/presets/pull", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	start := time.Now()
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusServiceUnavailable, w.Code)
+	require.Contains(t, w.Body.String(), "hub_unreachable")
+	require.Less(t, time.Since(start), budget+time.Second)
+}
diff --git a/backend/internal/api/handlers/crowdsec_preset_hub_log_test.go b/backend/internal/api/handlers/crowdsec_preset_hub_log_test.go
index 50dff0a4b..f7b21509d 100644
--- a/backend/internal/api/handlers/crowdsec_preset_hub_log_test.go
+++ b/backend/internal/api/handlers/crowdsec_preset_hub_log_test.go
@@ -27,7 +27,6 @@ func TestPullPresetHandlerLogNamesEveryAttemptedHubURL(t *testing.T) {
 
 	const cdnIndex = "https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json"
 	const mirrorIndex = "https://raw.githubusercontent.com/crowdsecurity/hub/master/.index.json"
-	const mirrorAPIIndex = "https://raw.githubusercontent.com/crowdsecurity/hub/master/api/index.json"
 
 	cache, err := crowdsec.NewHubCache(t.TempDir(), time.Hour)
 	require.NoError(t, err)
@@ -55,7 +54,7 @@ func TestPullPresetHandlerLogNamesEveryAttemptedHubURL(t *testing.T) {
 	require.Contains(t, out, `"crowdsec preset pull failed"`)
 	require.Contains(t, out, cdnIndex, "the CDN attempt is named")
 	require.Contains(t, out, mirrorIndex, "the mirror attempt is named")
-	require.Contains(t, out, mirrorAPIIndex, "the second mirror attempt is named")
+	require.NotContains(t, out, "/api/index.json", "the GitHub-hosted mirror has no api/index.json target")
 	require.NotContains(t, out, `"hub_base_url"`, "the configured base is not reported as the URL that failed")
 	require.NotContains(t, out, "s3cret", "credentials in the configured base never reach the log")
 	require.NotContains(t, out, "operator:")
diff --git a/backend/internal/api/handlers/crowdsec_preset_hub_offline_test.go b/backend/internal/api/handlers/crowdsec_preset_hub_offline_test.go
new file mode 100644
index 000000000..82a23b833
--- /dev/null
+++ b/backend/internal/api/handlers/crowdsec_preset_hub_offline_test.go
@@ -0,0 +1,149 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	hubDownMsg       = "dial tcp: lookup hub.crowdsec.net: no such host"
+	cscliIndexNginx  = `{"collections":[{"name":"crowdsecurity/nginx","title":"Nginx","description":"nginx","type":"collections"}]}`
+	curatedHubBacked = "crowdsecurity/base-http-scenarios"
+	curatedLocal     = "honeypot-friendly-defaults"
+)
+
+// hubOfflineHTTPDown answers every hub HTTP request with a transport failure.
+func hubOfflineHTTPDown(*http.Request) (*http.Response, error) {
+	return nil, errors.New(hubDownMsg)
+}
+
+// cscliIndexOnly answers the local cscli listing with a small index and fails every other cscli command.
+func cscliIndexOnly(cmd string) ([]byte, error) {
+	if cmd == "hub list -a -o json" {
+		return []byte(cscliIndexNginx), nil
+	}
+	return []byte("Error: hub unreachable"), errors.New("exit status 1")
+}
+
+// cscliDown fails every cscli command, so no local index answers.
+func cscliDown(string) ([]byte, error) {
+	return []byte("Error: hub unreachable"), errors.New("exit status 1")
+}
+
+// getPresetList calls the list endpoint and returns the hub_offline flag (and whether the key is present) and
+// the rows keyed by slug, or by type/slug for hub rows that carry a type.
+func getPresetList(t *testing.T, e *presetEnv) (offline, hasKey bool, rows map[string]map[string]any) {
+	t.Helper()
+	w := httptest.NewRecorder()
+	e.r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, presetsURL, http.NoBody))
+	require.Equal(t, http.StatusOK, w.Code, w.Body.String())
+
+	var raw map[string]json.RawMessage
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &raw))
+	var body struct {
+		Presets []map[string]any `json:"presets"`
+	}
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &body))
+
+	rawFlag, hasKey := raw["hub_offline"]
+	if hasKey {
+		require.NoError(t, json.Unmarshal(rawFlag, &offline))
+	}
+
+	rows = map[string]map[string]any{}
+	for _, p := range body.Presets {
+		key, _ := p["slug"].(string)
+		if typ, _ := p["type"].(string); typ != "" {
+			key = typ + "/" + key
+		}
+		rows[key] = p
+	}
+	return offline, hasKey, rows
+}
+
+// The hub answers over HTTP: the flag is false, the hub rows are pullable and the cache-only row keeps the baseline.
+func TestListPresetsHubOfflineFalseWhenHubIsUp(t *testing.T) {
+	t.Parallel()
+	e := newPresetEnv(t)
+	_, err := e.hub.Cache.Store(context.Background(), "crowdsecurity/legacy-only", "collections", "etag", "hub", []byte("name: crowdsecurity/legacy-only\n"))
+	require.NoError(t, err)
+
+	offline, hasKey, rows := getPresetList(t, e)
+
+	assert.True(t, hasKey, "hub_offline is always present")
+	assert.False(t, offline)
+	assert.Equal(t, true, rows["appsec-rules/crowdsecurity/crs"]["available"])
+	assert.Equal(t, true, rows["collections/crowdsecurity/nginx"]["available"])
+	assert.Equal(t, true, rows[curatedHubBacked]["available"], "online, a hub-backed curated preset keeps its baseline")
+	assert.Equal(t, true, rows[curatedLocal]["available"])
+	assert.Equal(t, false, rows["collections/crowdsecurity/legacy-only"]["available"], "online, a cache-only row keeps the baseline")
+	assert.Equal(t, true, rows["collections/crowdsecurity/legacy-only"]["cached"])
+}
+
+// The HTTP index fails but the local cscli index answers: the list is marked offline, the cscli rows cannot be
+// pulled (no cache entry), and the curated rows follow their own rule.
+func TestListPresetsHubOfflineTrueWhenCSCLIIndexAnswers(t *testing.T) {
+	t.Parallel()
+	e := newPresetEnv(t)
+	e.network = hubOfflineHTTPDown
+	e.cscli = cscliIndexOnly
+
+	offline, hasKey, rows := getPresetList(t, e)
+
+	assert.True(t, hasKey)
+	assert.True(t, offline)
+	assert.Equal(t, false, rows["collections/crowdsecurity/nginx"]["available"], "an offline hub row with no cache entry is not pullable")
+	assert.Equal(t, false, rows[curatedHubBacked]["available"], "a hub-backed curated preset with no cache entry is not pullable")
+	assert.Equal(t, true, rows[curatedLocal]["available"], "a curated preset that needs no hub stays available")
+}
+
+// Every hub source is down: the list still answers with the curated presets and the cached rows. A cached row
+// works offline, a hub row that is not cached does not.
+func TestListPresetsHubOfflineTrueWhenEverySourceIsDown(t *testing.T) {
+	t.Parallel()
+	e := newPresetEnv(t)
+	ctx := context.Background()
+	_, err := e.hub.Cache.Store(ctx, "crowdsecurity/nginx", "collections", "etag", "hub", []byte(itemNginx))
+	require.NoError(t, err)
+	_, err = e.hub.Cache.Store(ctx, "crowdsecurity/ghost", "collections", "etag", "hub", []byte("name: crowdsecurity/ghost\n"))
+	require.NoError(t, err)
+	e.network = hubOfflineHTTPDown
+	e.cscli = cscliDown
+
+	offline, hasKey, rows := getPresetList(t, e)
+
+	assert.True(t, hasKey)
+	assert.True(t, offline)
+	assert.Equal(t, true, rows["collections/crowdsecurity/nginx"]["available"], "a cached row works offline")
+	assert.Equal(t, true, rows["collections/crowdsecurity/nginx"]["cached"])
+	assert.Equal(t, true, rows["collections/crowdsecurity/ghost"]["available"], "a cache-only row works offline")
+	assert.NotContains(t, rows, "appsec-rules/crowdsecurity/crs", "an index row that is not cached is not listed without the index")
+	assert.Equal(t, false, rows[curatedHubBacked]["available"])
+	assert.Equal(t, true, rows[curatedLocal]["available"])
+	assert.Equal(t, true, rows["geoip-enrichment"]["available"])
+}
+
+// A handler without a hub service serves the curated list and reports the hub as not used.
+func TestListPresetsHubOfflineTrueWithoutHubService(t *testing.T) {
+	t.Parallel()
+	h := newTestCrowdsecHandler(t, OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
+	h.Hub = nil
+	r := gin.New()
+	h.RegisterRoutes(r.Group("/api/v1"))
+
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, presetsURL, http.NoBody))
+
+	require.Equal(t, http.StatusOK, w.Code, w.Body.String())
+	var body map[string]any
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &body))
+	assert.Equal(t, true, body["hub_offline"])
+}
diff --git a/backend/internal/crowdsec/cscli_mirror_contract_test.go b/backend/internal/crowdsec/cscli_mirror_contract_test.go
new file mode 100644
index 000000000..e4fb2d449
--- /dev/null
+++ b/backend/internal/crowdsec/cscli_mirror_contract_test.go
@@ -0,0 +1,81 @@
+package crowdsec
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+)
+
+// contractLiveConfig writes a live cscli configuration that cscli can load: a config_paths section whose
+// directories exist under a temporary root. Without config_paths, cscli refuses to start with "no configuration
+// paths provided".
+func contractLiveConfig(t *testing.T) string {
+	t.Helper()
+	root := t.TempDir()
+	dirs := map[string]string{
+		"config_dir":       "config",
+		"data_dir":         "data",
+		"hub_dir":          "hub",
+		"notification_dir": "notifications",
+		"plugin_dir":       "plugins",
+	}
+	paths := make(map[string]string, len(dirs)+2)
+	for key, name := range dirs {
+		p := filepath.Join(root, name)
+		require.NoError(t, os.MkdirAll(p, 0o750))
+		paths[key] = p
+	}
+	paths["simulation_path"] = filepath.Join(paths["config_dir"], "simulation.yaml")
+	paths["index_path"] = filepath.Join(paths["hub_dir"], ".index.json")
+	raw, err := yaml.Marshal(map[string]any{
+		"config_paths": paths,
+		"cscli":        map[string]any{mirrorBranchKey: "master"},
+	})
+	require.NoError(t, err)
+	return writeCSCLIConfig(t, root, string(raw))
+}
+
+// TestCSCLIContractAcceptsMirrorConfig runs the cscli on the PATH with a derived mirror configuration. It makes no hub
+// request. The fixture is parsed on every host; the cscli run skips when cscli is not installed, as the other cscli
+// checks do on hosts without the binary.
+func TestCSCLIContractAcceptsMirrorConfig(t *testing.T) {
+	live := contractLiveConfig(t)
+	raw, err := os.ReadFile(live) //nolint:gosec // G304: t.TempDir-derived path
+	require.NoError(t, err)
+	var fixture map[string]any
+	require.NoError(t, yaml.Unmarshal(raw, &fixture))
+	require.Contains(t, fixture, "config_paths", "the live fixture must be loadable by cscli")
+
+	if _, lookErr := exec.LookPath("cscli"); lookErr != nil {
+		t.Skip("cscli is not installed")
+	}
+	derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+	require.NoError(t, err)
+	defer cleanup()
+
+	info, err := os.Stat(derived)
+	require.NoError(t, err)
+	require.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+
+	derivedRaw, err := os.ReadFile(derived) //nolint:gosec // G304: t.TempDir-derived path
+	require.NoError(t, err)
+	var doc struct {
+		CSCLI map[string]any `yaml:"cscli"`
+	}
+	require.NoError(t, yaml.Unmarshal(derivedRaw, &doc))
+	require.Equal(t, testMirrorTemplate, doc.CSCLI[mirrorTemplateKey], "the derived configuration carries the mirror key")
+
+	// The binary is fixed; the only variable argument is a configuration file this test created.
+	out, err := exec.CommandContext(t.Context(), "cscli", "-c", derived, "version").CombinedOutput() //nolint:gosec // G204: fixed binary, test-owned config path
+	require.NoError(t, err, string(out))
+	require.NotContains(t, strings.ToLower(string(out)), "yaml", "cscli must parse the derived configuration")
+
+	cleanup()
+	_, statErr := os.Stat(derived)
+	require.ErrorIs(t, statErr, os.ErrNotExist, "the derived configuration is removed by cleanup")
+}
diff --git a/backend/internal/crowdsec/cscli_run.go b/backend/internal/crowdsec/cscli_run.go
index 6abf1374c..5184dd739 100644
--- a/backend/internal/crowdsec/cscli_run.go
+++ b/backend/internal/crowdsec/cscli_run.go
@@ -1,6 +1,14 @@
 package crowdsec
 
-import "context"
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"strings"
+
+	"github.com/Wikid82/charon/backend/internal/logger"
+	"github.com/Wikid82/charon/backend/internal/util"
+)
 
 // withConfigFlag puts `-c <configPath>` in front of cscli arguments so cscli reads the engine configuration
 // (and hub directory). An empty configPath leaves the arguments unchanged.
@@ -11,13 +19,175 @@ func withConfigFlag(configPath string, args []string) []string {
 	return append([]string{"-c", configPath}, args...)
 }
 
+// subcommand returns the cscli arguments without a leading -c flag pair.
+func subcommand(args []string) []string {
+	if len(args) >= 2 && args[0] == "-c" {
+		return args[2:]
+	}
+	return args
+}
+
 // RunCSCLI runs cscli with the engine configuration file in front of the arguments, so cscli reads the same
 // configuration (and hub directory) as the managed engine. An empty configPath runs cscli without -c.
 func RunCSCLI(ctx context.Context, exec CommandExecutor, configPath string, args ...string) ([]byte, error) {
 	return exec.Execute(ctx, "cscli", withConfigFlag(configPath, args)...)
 }
 
+// HubCSCLIOptions says how RunHubCSCLI retries a hub request on the hub mirror.
+type HubCSCLIOptions struct {
+	// ConfigPath is the live cscli configuration file. An empty path disables the mirror retry.
+	ConfigPath string
+	// Template is the cscli hub URL template of the mirror (see mirrorHubTemplate). An empty template disables the
+	// mirror retry.
+	Template string
+	// Memory is the mirror-first window. A nil memory is always closed.
+	Memory *MirrorMemory
+}
+
+// RunHubCSCLI runs a cscli command against the live configuration. A command that downloads from the hub (see
+// isHubNetworkOp) is retried once on the hub mirror when the live hub address fails: cscli is run under a derived
+// configuration that points its hub at the mirror, and the derived copy is removed on every path. While the mirror
+// window of opts.Memory is open, the mirror is tried first and the live address is the single retry. Any other
+// command, and any call without a mirror configuration, is a plain RunCSCLI call.
+func RunHubCSCLI(ctx context.Context, exec CommandExecutor, opts HubCSCLIOptions, args ...string) ([]byte, error) {
+	if opts.ConfigPath == "" || opts.Template == "" || !isHubNetworkOp(args) {
+		return RunCSCLI(ctx, exec, opts.ConfigPath, args...)
+	}
+	if opts.Memory.Active() {
+		derived, cleanup, err := mirrorCSCLIConfig(opts.ConfigPath, opts.Template)
+		if err == nil {
+			defer cleanup()
+			return mirrorFirst(ctx, exec, opts, derived, args)
+		}
+		logMirrorUnavailable(err)
+	}
+	return liveFirst(ctx, exec, opts, args)
+}
+
+// liveFirst runs args on the live address and, on a retryable failure, once on the mirror.
+func liveFirst(ctx context.Context, exec CommandExecutor, opts HubCSCLIOptions, args []string) ([]byte, error) {
+	out, timedOut, err := runShare(ctx, exec, opts.ConfigPath, args)
+	if err == nil || !isRetryableAttempt(ctx, args, out, timedOut, err) {
+		return out, err
+	}
+	derived, cleanup, derr := mirrorCSCLIConfig(opts.ConfigPath, opts.Template)
+	if derr != nil {
+		logMirrorUnavailable(derr)
+		return out, err
+	}
+	defer cleanup()
+	logHubRetry(args, err, hubAddressLive, hubAddressMirror)
+	retryOut, retryErr := runOnConfig(ctx, exec, derived, args)
+	if retryErr != nil {
+		return retryOut, fmt.Errorf("retry on hub mirror: %w; live hub address: %w", retryErr, err)
+	}
+	opts.Memory.Remember()
+	logger.Log().WithField("hub_fallback_used", true).WithField("operation", hubOperation(args)).
+		Info("cscli hub request answered by the hub mirror")
+	return retryOut, nil
+}
+
+// mirrorFirst runs args on the derived mirror configuration and, on a retryable failure, once on the live address.
+// A live answer that rescues the request closes the mirror-first window, because the hub address is back.
+func mirrorFirst(ctx context.Context, exec CommandExecutor, opts HubCSCLIOptions, derived string, args []string) ([]byte, error) {
+	out, timedOut, err := runShare(ctx, exec, derived, args)
+	if err == nil || !isRetryableAttempt(ctx, args, out, timedOut, err) {
+		return out, err
+	}
+	logHubRetry(args, err, hubAddressMirror, hubAddressLive)
+	liveOut, liveErr := runOnConfig(ctx, exec, opts.ConfigPath, args)
+	if liveErr != nil {
+		return liveOut, fmt.Errorf("retry on live hub address: %w; hub mirror: %w", liveErr, err)
+	}
+	opts.Memory.Forget()
+	logger.Log().WithField("operation", hubOperation(args)).Info("cscli hub request answered by the live hub address; mirror-first window cleared")
+	return liveOut, nil
+}
+
+// runShare runs args under this operation's share of the time left on ctx. A hub update gets half of it, so a hung
+// hub leaves time for the retry; every other operation gets all of it, so a slow healthy install is not cut short.
+// timedOut reports that the share ran out while ctx itself is still alive.
+func runShare(ctx context.Context, exec CommandExecutor, configPath string, args []string) (out []byte, timedOut bool, err error) {
+	attemptsLeft := 1
+	if isHubUpdate(args) {
+		attemptsLeft = 2
+	}
+	attemptCtx, cancel := attemptContext(ctx, attemptsLeft)
+	defer cancel()
+	out, err = exec.Execute(attemptCtx, "cscli", withConfigFlag(configPath, args)...)
+	timedOut = err != nil && attemptCtx.Err() != nil && ctx.Err() == nil
+	return out, timedOut, err
+}
+
+// isRetryableAttempt reports whether a failed attempt may be retried on the other address. A dead ctx is never
+// retried. A hub update is retried on a network failure, a timeout or an expired share. Install and upgrade are
+// retried on a network failure only, never on a bare deadline, so a healthy slow install is not killed.
+func isRetryableAttempt(ctx context.Context, args []string, out []byte, timedOut bool, err error) bool {
+	if ctx.Err() != nil {
+		return false
+	}
+	text := string(out) + " " + err.Error()
+	if isHubUpdate(args) {
+		return timedOut || isRetryableHubFailure(text)
+	}
+	return isMirrorRetryableFailure(text)
+}
+
+// runOnConfig runs args under configPath. An install or upgrade refreshes the hub index under the same configuration
+// first, so the index and the items come from one source; a failed refresh ends the run.
+func runOnConfig(ctx context.Context, exec CommandExecutor, configPath string, args []string) ([]byte, error) {
+	if !isHubUpdate(args) {
+		if out, err := RunCSCLI(ctx, exec, configPath, "hub", "update"); err != nil {
+			return out, fmt.Errorf("hub update before retry: %w", err)
+		}
+	}
+	return RunCSCLI(ctx, exec, configPath, args...)
+}
+
+// hubURLInText matches a URL inside cscli output, so the log shows it without credentials or query strings.
+var hubURLInText = regexp.MustCompile(`https?://[^\s"']+`)
+
+// hubLogText makes cscli output safe for a log line: URLs are reduced by HubURLForLog and control characters are
+// replaced.
+func hubLogText(text string) string {
+	return util.SanitizeForLog(hubURLInText.ReplaceAllStringFunc(text, HubURLForLog))
+}
+
+// hubOperation names the hub operation of args for a log line, for example "collections install".
+func hubOperation(args []string) string {
+	return util.SanitizeForLog(strings.Join(subcommand(args), " "))
+}
+
+// Names of the two hub addresses in retry log lines.
+const (
+	hubAddressLive   = "live hub address"
+	hubAddressMirror = "hub mirror"
+)
+
+// logHubRetry records that a hub request failed on one address and is retried on the other. Callers log it only
+// once the retry is certain to run, so the line never announces a retry that is declined.
+func logHubRetry(args []string, err error, failedOn, retryOn string) {
+	logger.Log().WithField("operation", hubOperation(args)).WithField("error", hubLogText(err.Error())).
+		Warnf("cscli hub request failed on the %s; retrying on the %s", failedOn, retryOn)
+}
+
+func logMirrorUnavailable(err error) {
+	logger.Log().WithField("error", hubLogText(err.Error())).Warn("hub mirror retry unavailable")
+}
+
 // runCSCLI runs cscli for the hub service against the configuration file of its data directory.
 func (s *HubService) runCSCLI(ctx context.Context, args ...string) ([]byte, error) {
 	return RunCSCLI(ctx, s.Exec, FindConfigFile(s.DataDir), args...)
 }
+
+// runHubCSCLI runs a hub download for the hub service: it is retried on the mirror as RunHubCSCLI describes.
+func (s *HubService) runHubCSCLI(ctx context.Context, args ...string) ([]byte, error) {
+	return RunHubCSCLI(ctx, s.Exec, s.MirrorOptions(), args...)
+}
+
+// MirrorOptions returns the mirror retry settings of the service: the live configuration of its data directory, the
+// mirror template for MirrorBaseURL, and the shared mirror-first window.
+func (s *HubService) MirrorOptions() HubCSCLIOptions {
+	template := s.mirrorTemplate.get(s.MirrorBaseURL)
+	return HubCSCLIOptions{ConfigPath: FindConfigFile(s.DataDir), Template: template, Memory: s.mirror}
+}
diff --git a/backend/internal/crowdsec/curated_apply.go b/backend/internal/crowdsec/curated_apply.go
index 0cd19a482..719154b8c 100644
--- a/backend/internal/crowdsec/curated_apply.go
+++ b/backend/internal/crowdsec/curated_apply.go
@@ -71,14 +71,14 @@ func (s *HubService) ApplyCurated(ctx context.Context, preset Preset) (ApplyResu
 
 // installAndVerify runs hub update, then install + inspect for every item, stopping at the first failure.
 func (s *HubService) installAndVerify(ctx context.Context, preset Preset) error {
-	if _, err := s.runCSCLI(ctx, "hub", "update"); err != nil {
+	if _, err := s.runHubCSCLI(ctx, "hub", "update"); err != nil {
 		logger.Log().WithError(err).Warn("cscli hub update failed; continuing with the local hub index")
 	}
 	for _, item := range preset.Items {
 		if err := ctx.Err(); err != nil {
 			return fmt.Errorf("install %s %s: %w", item.Type, item.Name, err)
 		}
-		if _, err := s.runCSCLI(ctx, item.Type, "install", item.Name); err != nil {
+		if _, err := s.runHubCSCLI(ctx, item.Type, "install", item.Name); err != nil {
 			return fmt.Errorf("install %s %s: %w", item.Type, item.Name, err)
 		}
 		if err := VerifyHubItem(ctx, s.Exec, FindConfigFile(s.DataDir), item.Type, item.Name); err != nil {
diff --git a/backend/internal/crowdsec/hub_apply.go b/backend/internal/crowdsec/hub_apply.go
index 49e12271d..95daa55d6 100644
--- a/backend/internal/crowdsec/hub_apply.go
+++ b/backend/internal/crowdsec/hub_apply.go
@@ -220,7 +220,7 @@ func (s *HubService) ApplyWith(ctx context.Context, req ApplyRequest) (ApplyResu
 	}
 
 	req.enter(PhaseInstall)
-	installOut, err := s.runCSCLI(applyCtx, meta.Type, "install", meta.Name)
+	installOut, err := s.runHubCSCLI(applyCtx, meta.Type, "install", meta.Name)
 	if err != nil {
 		return rollBack(installFailure(meta, installOut, err))
 	}
@@ -241,7 +241,7 @@ func (s *HubService) ApplyWith(ctx context.Context, req ApplyRequest) (ApplyResu
 			return s.rollBackMismatch(applyCtx, result, backupPath, meta)
 		}
 		// An older, unmodified version was already installed and install left it alone.
-		if _, upErr := s.runCSCLI(applyCtx, meta.Type, "upgrade", meta.Name); upErr != nil {
+		if _, upErr := s.runHubCSCLI(applyCtx, meta.Type, "upgrade", meta.Name); upErr != nil {
 			return rollBack(fmt.Errorf("upgrade %s %s: %w", meta.Type, meta.Name, upErr))
 		}
 		if installed, err = s.inspectItem(applyCtx, meta.Type, meta.Name); err != nil {
@@ -303,7 +303,7 @@ func (s *HubService) updateHubIndex(ctx context.Context) {
 	}
 	updateCtx, cancel := context.WithTimeout(ctx, budget)
 	defer cancel()
-	if _, err := s.runCSCLI(updateCtx, "hub", "update"); err != nil {
+	if _, err := s.runHubCSCLI(updateCtx, "hub", "update"); err != nil {
 		logger.Log().WithError(err).Warn("cscli hub update failed; continuing with the local hub index")
 	}
 }
diff --git a/backend/internal/crowdsec/hub_budget.go b/backend/internal/crowdsec/hub_budget.go
new file mode 100644
index 000000000..e97443b6f
--- /dev/null
+++ b/backend/internal/crowdsec/hub_budget.go
@@ -0,0 +1,34 @@
+package crowdsec
+
+import (
+	"context"
+	"time"
+)
+
+// minHubAttemptBudget is the least time one hub request attempt receives, so a short remaining budget still
+// leaves a real attempt. The parent deadline still bounds every attempt.
+const minHubAttemptBudget = 5 * time.Second
+
+// attemptContext returns the context for the next of attemptsLeft hub attempts made under parent. The attempt
+// gets its share of the time left before parent's deadline (remaining/attemptsLeft), never less than
+// minHubAttemptBudget and never more than what remains. A non-positive attemptsLeft counts as one. A parent
+// without a deadline is returned unchanged with a no-op cancel: the caller that owns the overall deadline sets
+// it before calling.
+func attemptContext(parent context.Context, attemptsLeft int) (context.Context, context.CancelFunc) {
+	deadline, ok := parent.Deadline()
+	if !ok {
+		return parent, func() {}
+	}
+	if attemptsLeft < 1 {
+		attemptsLeft = 1
+	}
+	remaining := time.Until(deadline)
+	budget := remaining / time.Duration(attemptsLeft)
+	if budget < minHubAttemptBudget {
+		budget = minHubAttemptBudget
+	}
+	if budget > remaining {
+		budget = remaining
+	}
+	return context.WithTimeout(parent, budget)
+}
diff --git a/backend/internal/crowdsec/hub_budget_test.go b/backend/internal/crowdsec/hub_budget_test.go
new file mode 100644
index 000000000..ca76acf32
--- /dev/null
+++ b/backend/internal/crowdsec/hub_budget_test.go
@@ -0,0 +1,131 @@
+package crowdsec
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// remainingWithin reports the time left until ctx's deadline and fails the test when the deadline is absent.
+func remainingWithin(t *testing.T, ctx context.Context) time.Duration {
+	t.Helper()
+	deadline, ok := ctx.Deadline()
+	require.True(t, ok, "attempt context must carry a deadline")
+	return time.Until(deadline)
+}
+
+func TestAttemptContextWithoutDeadlineReturnsParent(t *testing.T) {
+	t.Parallel()
+	parent := context.Background()
+	ctx, cancel := attemptContext(parent, 2)
+	require.Equal(t, parent, ctx)
+	_, ok := ctx.Deadline()
+	require.False(t, ok)
+	cancel() // no-op: the caller keeps the parent alive
+	require.NoError(t, ctx.Err())
+}
+
+func TestAttemptContextSharesRemainingTime(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name         string
+		attemptsLeft int
+		min, max     time.Duration
+	}{
+		{name: "single attempt takes all", attemptsLeft: 1, min: 29 * time.Second, max: 30 * time.Second},
+		{name: "two attempts take half", attemptsLeft: 2, min: 14 * time.Second, max: 15 * time.Second},
+		{name: "three attempts take a third", attemptsLeft: 3, min: 9 * time.Second, max: 10 * time.Second},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Each case owns its parent, created when the case runs, so the window is not spent by the
+			// scheduling of the other cases.
+			parent, cancelParent := context.WithTimeout(context.Background(), 30*time.Second)
+			defer cancelParent()
+			ctx, cancel := attemptContext(parent, tc.attemptsLeft)
+			defer cancel()
+			left := remainingWithin(t, ctx)
+			require.GreaterOrEqual(t, left, tc.min)
+			require.LessOrEqual(t, left, tc.max)
+		})
+	}
+}
+
+func TestAttemptContextFloorApplies(t *testing.T) {
+	t.Parallel()
+	parent, cancelParent := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancelParent()
+
+	// 10 s over 4 attempts is 2.5 s, below the 5 s floor, so the attempt gets the floor.
+	ctx, cancel := attemptContext(parent, 4)
+	defer cancel()
+	left := remainingWithin(t, ctx)
+	require.Greater(t, left, 4*time.Second)
+	require.LessOrEqual(t, left, minHubAttemptBudget)
+}
+
+func TestAttemptContextCapsAtRemainingBelowFloor(t *testing.T) {
+	t.Parallel()
+	parent, cancelParent := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancelParent()
+
+	// Only 2 s remain, so a 5 s floor cannot be honoured: the attempt gets what is left.
+	ctx, cancel := attemptContext(parent, 1)
+	defer cancel()
+	left := remainingWithin(t, ctx)
+	require.Greater(t, left, 1500*time.Millisecond)
+	require.LessOrEqual(t, left, 2*time.Second)
+}
+
+func TestAttemptContextNonPositiveAttemptsCountsAsOne(t *testing.T) {
+	t.Parallel()
+	parent, cancelParent := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancelParent()
+
+	for _, attemptsLeft := range []int{0, -3} {
+		ctx, cancel := attemptContext(parent, attemptsLeft)
+		left := remainingWithin(t, ctx)
+		require.Greater(t, left, 9*time.Second)
+		require.LessOrEqual(t, left, 10*time.Second)
+		cancel()
+	}
+}
+
+func TestAttemptContextExpiredParent(t *testing.T) {
+	t.Parallel()
+	parent, cancelParent := context.WithTimeout(context.Background(), 0)
+	defer cancelParent()
+
+	ctx, cancel := attemptContext(parent, 2)
+	defer cancel()
+	require.ErrorIs(t, ctx.Err(), context.DeadlineExceeded)
+}
+
+func TestAttemptContextCancelledParentStaysCancelled(t *testing.T) {
+	t.Parallel()
+	parent, cancelParent := context.WithTimeout(context.Background(), time.Minute)
+	cancelParent()
+
+	ctx, cancel := attemptContext(parent, 1)
+	defer cancel()
+	require.ErrorIs(t, ctx.Err(), context.Canceled)
+}
+
+func TestAttemptContextCancelReleasesChild(t *testing.T) {
+	t.Parallel()
+	parent, cancelParent := context.WithTimeout(context.Background(), time.Minute)
+	defer cancelParent()
+
+	ctx, cancel := attemptContext(parent, 2)
+	cancel()
+	require.ErrorIs(t, ctx.Err(), context.Canceled)
+	require.NoError(t, parent.Err(), "cancelling an attempt must not cancel its parent")
+}
+
+func TestHubIndexOffline(t *testing.T) {
+	t.Parallel()
+	require.False(t, HubIndex{}.Offline())
+	require.True(t, HubIndex{offline: true}.Offline())
+}
diff --git a/backend/internal/crowdsec/hub_budget_walk.go b/backend/internal/crowdsec/hub_budget_walk.go
new file mode 100644
index 000000000..3e75e5f2e
--- /dev/null
+++ b/backend/internal/crowdsec/hub_budget_walk.go
@@ -0,0 +1,40 @@
+package crowdsec
+
+import (
+	"context"
+	"time"
+)
+
+// cscliListReserve is the time kept back from the index walk for the local `cscli hub list` that FetchIndex runs
+// when no hub address answers. The reserve applies only when the walk has more than two attempt floors of time.
+const cscliListReserve = 2 * time.Second
+
+// pullBudget returns total, or the default pull timeout when total is not set (a HubService built without one).
+func pullBudget(total time.Duration) time.Duration {
+	if total <= 0 {
+		return defaultPullTimeout
+	}
+	return total
+}
+
+// overallContext returns the deadline that bounds one index fetch. A caller that set a deadline keeps its own;
+// otherwise the fetch gets total from now. The caller must call cancel.
+func overallContext(parent context.Context, total time.Duration) (context.Context, context.CancelFunc) {
+	if _, ok := parent.Deadline(); ok {
+		return parent, func() {}
+	}
+	return context.WithTimeout(parent, pullBudget(total))
+}
+
+// walkContext returns the deadline of the HTTP candidate walk inside parent: the time left on parent (total when
+// parent has no deadline), less the cscli listing reserve when there is room for it. The caller must call cancel.
+func walkContext(parent context.Context, total time.Duration) (context.Context, context.CancelFunc) {
+	remaining := pullBudget(total)
+	if deadline, ok := parent.Deadline(); ok {
+		remaining = time.Until(deadline)
+	}
+	if remaining > 2*minHubAttemptBudget {
+		remaining -= cscliListReserve
+	}
+	return context.WithTimeout(parent, remaining)
+}
diff --git a/backend/internal/crowdsec/hub_index_fallback_test.go b/backend/internal/crowdsec/hub_index_fallback_test.go
index d6266125c..837cd3eab 100644
--- a/backend/internal/crowdsec/hub_index_fallback_test.go
+++ b/backend/internal/crowdsec/hub_index_fallback_test.go
@@ -90,10 +90,9 @@ func TestFetchIndexStopsWhenCallerContextEnds(t *testing.T) {
 // When every candidate fails, each URL appears exactly once in the aggregated error, with transport and HTTP failures alike.
 func TestHubIndexErrorNamesEachURLOnce(t *testing.T) {
 	captureHubIndexLogs(t)
-	mirrorAPI := defaultHubMirrorBaseURL + defaultHubIndexPath
 	transport := &hubTransport{
 		errs:   map[string]error{cdnIndexURL: errors.New("connection refused")},
-		status: map[string]int{rawIndexURL: http.StatusServiceUnavailable, mirrorAPI: http.StatusNotFound},
+		status: map[string]int{rawIndexURL: http.StatusServiceUnavailable},
 	}
 	svc := NewHubService(nil, nil, t.TempDir())
 	svc.HTTPClient = &http.Client{Transport: transport}
@@ -102,12 +101,11 @@ func TestHubIndexErrorNamesEachURLOnce(t *testing.T) {
 	require.Error(t, err)
 
 	msg := err.Error()
-	for _, u := range []string{cdnIndexURL, rawIndexURL, mirrorAPI} {
+	for _, u := range []string{cdnIndexURL, rawIndexURL} {
 		require.Equal(t, 1, strings.Count(msg, u), "URL %s must appear exactly once in: %s", u, msg)
 	}
 	require.Contains(t, msg, "connection refused")
 	require.Contains(t, msg, "status 503")
-	require.Contains(t, msg, "status 404")
 }
 
 // An operator-set hub URL that does not parse is logged as a placeholder, never echoed back.
diff --git a/backend/internal/crowdsec/hub_log_urls_test.go b/backend/internal/crowdsec/hub_log_urls_test.go
index 3cb03fd92..6e5cc501e 100644
--- a/backend/internal/crowdsec/hub_log_urls_test.go
+++ b/backend/internal/crowdsec/hub_log_urls_test.go
@@ -65,11 +65,9 @@ func TestHubIndexLogNamesFailedCDNAndServingMirror(t *testing.T) {
 // When every candidate fails, the returned error names each URL that was requested, in attempt order.
 func TestHubIndexErrorNamesEveryFailedCandidate(t *testing.T) {
 	logs := captureHubIndexLogs(t)
-	mirrorAPI := defaultHubMirrorBaseURL + defaultHubIndexPath
 	transport := &hubTransport{status: map[string]int{
 		cdnIndexURL: http.StatusServiceUnavailable,
 		rawIndexURL: http.StatusServiceUnavailable,
-		mirrorAPI:   http.StatusServiceUnavailable,
 	}}
 	svc := NewHubService(nil, nil, t.TempDir())
 	svc.HTTPClient = &http.Client{Transport: transport}
@@ -80,11 +78,10 @@ func TestHubIndexErrorNamesEveryFailedCandidate(t *testing.T) {
 	msg := err.Error()
 	require.Contains(t, msg, cdnIndexURL)
 	require.Contains(t, msg, rawIndexURL)
-	require.Contains(t, msg, mirrorAPI)
-	require.Equal(t, []string{cdnIndexURL, rawIndexURL, mirrorAPI}, transport.seen())
+	require.Equal(t, []string{cdnIndexURL, rawIndexURL}, transport.seen())
 
 	out := logs.String()
-	require.Equal(t, 3, strings.Count(out, `"hub index fetch failed, trying mirror"`), "each failed candidate is logged once")
+	require.Equal(t, 2, strings.Count(out, `"hub index fetch failed, trying mirror"`), "each failed candidate is logged once")
 	require.NotContains(t, out, `"hub index fetched"`)
 }
 
@@ -131,7 +128,6 @@ func TestHubIndexLogAndErrorOmitUserinfo(t *testing.T) {
 			indexWithUserinfo: http.StatusServiceUnavailable,
 			cdnIndexURL:       http.StatusServiceUnavailable,
 			rawIndexURL:       http.StatusServiceUnavailable,
-			defaultHubMirrorBaseURL + defaultHubIndexPath: http.StatusServiceUnavailable,
 		}}
 		svc := NewHubService(nil, nil, t.TempDir())
 		svc.HubBaseURL = withUserinfo
diff --git a/backend/internal/crowdsec/hub_mirror.go b/backend/internal/crowdsec/hub_mirror.go
new file mode 100644
index 000000000..3f178336e
--- /dev/null
+++ b/backend/internal/crowdsec/hub_mirror.go
@@ -0,0 +1,455 @@
+package crowdsec
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/Wikid82/charon/backend/internal/logger"
+
+	"gopkg.in/yaml.v3"
+)
+
+const (
+	// mirrorConfigPrefix starts the names of the short-lived cscli configuration copies that point cscli at the
+	// hub mirror (see mirrorCSCLIConfig). IsHubMirrorConfig recognises them.
+	mirrorConfigPrefix = ".charon-hub-mirror-"
+	// mirrorTemplateKey is cscli's hidden hub URL template key. It is a test hook of cscli 1.8.2, not a documented
+	// option, so the contract doc records it.
+	mirrorTemplateKey = "__hub_url_template__"
+	mirrorBranchKey   = "hub_branch"
+	mirrorCSCLISec    = "cscli"
+	// mirrorDefaultBranch is the hub branch cscli is pinned to when the configuration names none.
+	mirrorDefaultBranch = "master"
+	// builtinMirrorTemplate is the template of the built-in mirror: the GitHub hub mirror, branch and file.
+	builtinMirrorTemplate = "https://raw.githubusercontent.com/crowdsecurity/hub/%s/%s"
+	// mirrorMemoryTTL is how long requests go mirror-first after the mirror answered one. A hung hub then costs one
+	// attempt per job instead of one per item.
+	mirrorMemoryTTL = 10 * time.Minute
+)
+
+var (
+	// errMirrorTemplateSet means the live configuration already names a hub URL template. The retry must not
+	// replace an operator's own hub, so it is refused.
+	errMirrorTemplateSet = errors.New("the cscli config already sets a hub URL template")
+	// errMirrorLocalTemplateSet means the local override (config.yaml.local) sets a hub URL template. The override is
+	// merged over the derived configuration, so it would replace the mirror; the retry is refused for the same reason.
+	errMirrorLocalTemplateSet = errors.New("the cscli local override already sets a hub URL template")
+	// errMirrorTemplateInvalid means the template is not an https URL with exactly the two verbs cscli fills in.
+	errMirrorTemplateInvalid = errors.New("the hub mirror template must be an https URL with exactly two %s verbs")
+	// createMirrorTemp creates the derived configuration file. It is a variable so tests can make creation fail.
+	createMirrorTemp = os.CreateTemp
+)
+
+// MirrorMemory remembers for a short window that the hub mirror answered a cscli hub request, so later requests
+// in that window go mirror-first. The window starts at the first win and is not extended by later wins; Forget
+// closes it when the live configuration answers again. A nil *MirrorMemory is always inactive.
+type MirrorMemory struct {
+	mu    sync.Mutex
+	ttl   time.Duration
+	until time.Time
+	now   func() time.Time
+}
+
+// NewMirrorMemory returns a memory whose window lasts ttl. A nil clock means time.Now.
+func NewMirrorMemory(ttl time.Duration, now func() time.Time) *MirrorMemory {
+	return &MirrorMemory{ttl: ttl, now: now}
+}
+
+func (m *MirrorMemory) clock() time.Time {
+	if m.now == nil {
+		return time.Now()
+	}
+	return m.now()
+}
+
+// Active reports whether the mirror-first window is open.
+func (m *MirrorMemory) Active() bool {
+	if m == nil {
+		return false
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.clock().Before(m.until)
+}
+
+// Remember opens the window for ttl after a mirror win. A win while the window is already open changes nothing.
+func (m *MirrorMemory) Remember() {
+	if m == nil {
+		return
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if now := m.clock(); !now.Before(m.until) {
+		m.until = now.Add(m.ttl)
+	}
+}
+
+// Forget closes the window.
+func (m *MirrorMemory) Forget() {
+	if m == nil {
+		return
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.until = time.Time{}
+}
+
+// isHubNetworkOp reports whether cscli arguments name an operation that downloads from the hub: `hub update`,
+// `hub upgrade`, and `<type> install` or `<type> upgrade`. Local reads such as `inspect` and `list` are not.
+func isHubNetworkOp(args []string) bool {
+	if len(args) < 2 {
+		return false
+	}
+	if args[0] == "hub" {
+		return args[1] == "update" || args[1] == "upgrade"
+	}
+	return args[1] == "install" || args[1] == "upgrade"
+}
+
+// transportTimeoutMarkers are the output fragments of an HTTP request that timed out inside the client. They name a
+// request that never got an answer, which a retry on another address can fix.
+var transportTimeoutMarkers = []string{"client.timeout", "tls handshake timeout"}
+
+// deadlineMarker is the text of an expired context. On its own it can be a healthy slow install that ran out of its
+// time, so only a hub update retries on it.
+const deadlineMarker = "context deadline exceeded"
+
+// isHubUpdate reports whether args are `hub update`.
+func isHubUpdate(args []string) bool {
+	return len(args) >= 2 && args[0] == "hub" && args[1] == "update"
+}
+
+// isMirrorRetryableFailure reports whether cscli output names a network failure or a transport timeout. An item
+// error (unknown, tainted) and a bare deadline are not retryable here.
+func isMirrorRetryableFailure(text string) bool {
+	if hasNetworkFailure(text) {
+		return true
+	}
+	lower := strings.ToLower(text)
+	for _, marker := range transportTimeoutMarkers {
+		if strings.Contains(lower, marker) {
+			return true
+		}
+	}
+	return false
+}
+
+// isRetryableHubFailure reports whether cscli output names a failure a hub update can retry on the other address: a
+// network failure, a transport timeout, or an expired deadline. Other failures (an unknown item, a tainted item) are
+// not retried.
+func isRetryableHubFailure(text string) bool {
+	return isMirrorRetryableFailure(text) || strings.Contains(strings.ToLower(text), deadlineMarker)
+}
+
+// mirrorHubTemplate returns the cscli hub URL template for a mirror base, such as
+// https://raw.githubusercontent.com/crowdsecurity/hub/master. The second result reports whether the operator's base
+// was used. An operator base is used only when it passes validateHubURL and ends in the master branch that cscli
+// is pinned to; otherwise the built-in mirror is used and a warning names the reason. An empty base means the
+// built-in mirror without a warning.
+func mirrorHubTemplate(mirrorBase string) (string, bool) {
+	base := strings.TrimRight(strings.TrimSpace(mirrorBase), "/")
+	if base == "" {
+		return builtinMirrorTemplate, false
+	}
+	template, refusal := operatorMirrorTemplate(base)
+	if refusal != "" {
+		logger.Log().WithField("hub_mirror", HubURLForLog(base)).WithField("reason", refusal).
+			Warn("hub mirror base not usable, using the built-in mirror")
+		return builtinMirrorTemplate, false
+	}
+	return template, true
+}
+
+// mirrorTemplateCache keeps the resolved hub URL template of a service's mirror base. The base is resolved, and an
+// unusable base logged, once per distinct base rather than on every cscli call. The zero value is ready to use.
+type mirrorTemplateCache struct {
+	mu       sync.Mutex
+	base     string
+	template string
+	resolved bool
+}
+
+// get returns the template for base, resolving it again only when base differs from the last one.
+func (c *mirrorTemplateCache) get(base string) string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if !c.resolved || c.base != base {
+		c.template, _ = mirrorHubTemplate(base)
+		c.base, c.resolved = base, true
+	}
+	return c.template
+}
+
+// operatorMirrorTemplate turns an operator mirror base into a template, or names why it cannot be used.
+func operatorMirrorTemplate(base string) (template, refusal string) {
+	if err := validateHubURL(base); err != nil {
+		return "", "not an allowlisted https hub address"
+	}
+	prefix, branch := path.Split(base)
+	if branch != mirrorDefaultBranch {
+		return "", "the address does not end in the master branch"
+	}
+	template = strings.TrimSuffix(prefix, "/") + "/%s/%s"
+	if !validMirrorTemplate(template) {
+		return "", "the address cannot form a valid template"
+	}
+	return template, ""
+}
+
+// validMirrorTemplate reports whether template is an https URL with exactly two %s verbs and no other percent
+// sign, and no control characters. Any other template could make cscli format something unintended.
+func validMirrorTemplate(template string) bool {
+	return strings.HasPrefix(template, "https://") &&
+		strings.Count(template, "%s") == 2 &&
+		strings.Count(template, "%") == 2 &&
+		!strings.ContainsAny(template, "\r\n\x00")
+}
+
+// mirrorCSCLIConfig writes a copy of the cscli configuration at configPath whose cscli section points the hub at
+// template, and returns the copy's path with a cleanup that removes it. The copy is built with yaml.v3 (never by
+// text concatenation), created with mode 0600 in the same directory so relative paths in it resolve as before, and
+// a sibling config.yaml.local is copied next to it because CrowdSec merges that file by name. A live configuration
+// that already sets a template is refused with errMirrorTemplateSet, and a local override that sets one is refused
+// with errMirrorLocalTemplateSet, since the override would replace the mirror. An override that cannot be read or
+// parsed fails the call too, so the caller never retries with a configuration it cannot reproduce. On error the
+// cleanup is a no-op. The copy holds the live settings, so IsHubMirrorConfig keeps it out of listings, reads, exports
+// and imports.
+func mirrorCSCLIConfig(configPath, template string) (derivedPath string, cleanup func(), err error) {
+	noop := func() {}
+	if configPath == "" {
+		return "", noop, errors.New("cscli config path is empty")
+	}
+	if !validMirrorTemplate(template) {
+		return "", noop, errMirrorTemplateInvalid
+	}
+	live := filepath.Clean(configPath)
+	raw, err := os.ReadFile(live)
+	if err != nil {
+		return "", noop, fmt.Errorf("read cscli config: %w", err)
+	}
+	content, err := withMirrorTemplate(raw, template)
+	if err != nil {
+		return "", noop, err
+	}
+	local, hasLocal, err := readLocalOverride(live + ".local")
+	if err != nil {
+		return "", noop, err
+	}
+	if hasLocal {
+		set, parseErr := mirrorTemplateSetIn(local)
+		if parseErr != nil {
+			return "", noop, fmt.Errorf("parse cscli local override: %w", parseErr)
+		}
+		if set {
+			return "", noop, errMirrorLocalTemplateSet
+		}
+	}
+	f, err := createMirrorTemp(filepath.Dir(live), mirrorConfigPrefix+"*.yaml")
+	if err != nil {
+		return "", noop, fmt.Errorf("create hub mirror config: %w", err)
+	}
+	derived := f.Name()
+	cleanup = func() {
+		_ = os.Remove(derived)
+		_ = os.Remove(derived + ".local")
+	}
+	if err := writeMirrorFile(f, content); err != nil {
+		cleanup()
+		return "", noop, err
+	}
+	if hasLocal {
+		if err := writeLocalOverride(derived+".local", local); err != nil {
+			cleanup()
+			return "", noop, err
+		}
+	}
+	return derived, cleanup, nil
+}
+
+// mirrorTemplateSetIn reports whether the cscli section of a YAML configuration already sets a non-empty hub URL
+// template. An empty document, or a missing or null cscli section, sets none. A root or cscli section of the wrong
+// kind is an error, so the caller fails closed.
+func mirrorTemplateSetIn(raw []byte) (bool, error) {
+	var doc yaml.Node
+	if err := yaml.Unmarshal(raw, &doc); err != nil {
+		return false, err
+	}
+	if len(doc.Content) == 0 {
+		return false, nil
+	}
+	root := doc.Content[0]
+	if root.Kind != yaml.MappingNode {
+		return false, errors.New("cscli config root is not a mapping")
+	}
+	i := findMappingKey(root, mirrorCSCLISec)
+	if i < 0 || isNullScalar(root.Content[i+1]) {
+		return false, nil
+	}
+	section := root.Content[i+1]
+	if section.Kind != yaml.MappingNode {
+		return false, fmt.Errorf("cscli config %s is not a mapping", mirrorCSCLISec)
+	}
+	j := findMappingKey(section, mirrorTemplateKey)
+	return j >= 0 && !isEmptyScalar(section.Content[j+1]), nil
+}
+
+// withMirrorTemplate returns the YAML of a cscli configuration with the hub URL template set in its cscli section.
+// The section is created when missing, and hub_branch is set to master when it is missing or empty. Every other
+// key is kept.
+func withMirrorTemplate(raw []byte, template string) ([]byte, error) {
+	var doc yaml.Node
+	if err := yaml.Unmarshal(raw, &doc); err != nil {
+		return nil, fmt.Errorf("parse cscli config: %w", err)
+	}
+	if doc.Kind == 0 {
+		doc.Kind = yaml.DocumentNode
+	}
+	if len(doc.Content) == 0 {
+		doc.Content = []*yaml.Node{{Kind: yaml.MappingNode, Tag: "!!map"}}
+	}
+	root := doc.Content[0]
+	if root.Kind != yaml.MappingNode {
+		return nil, errors.New("cscli config root is not a mapping")
+	}
+	section, err := childMapping(root, mirrorCSCLISec)
+	if err != nil {
+		return nil, err
+	}
+	if i := findMappingKey(section, mirrorTemplateKey); i >= 0 && !isEmptyScalar(section.Content[i+1]) {
+		return nil, errMirrorTemplateSet
+	}
+	setMappingValue(section, mirrorTemplateKey, &yaml.Node{Kind: yaml.ScalarNode, Tag: "!!str", Value: template, Style: yaml.DoubleQuotedStyle})
+	if i := findMappingKey(section, mirrorBranchKey); i < 0 || isEmptyScalar(section.Content[i+1]) {
+		setMappingValue(section, mirrorBranchKey, &yaml.Node{Kind: yaml.ScalarNode, Tag: "!!str", Value: mirrorDefaultBranch})
+	}
+
+	out, err := yaml.Marshal(&doc)
+	if err != nil {
+		return nil, fmt.Errorf("encode hub mirror config: %w", err)
+	}
+	return out, nil
+}
+
+// childMapping returns the mapping under key in m, creating an empty one when the key is missing or null. Any
+// other kind of value is an error.
+func childMapping(m *yaml.Node, key string) (*yaml.Node, error) {
+	i := findMappingKey(m, key)
+	if i < 0 {
+		value := &yaml.Node{Kind: yaml.MappingNode, Tag: "!!map"}
+		m.Content = append(m.Content, &yaml.Node{Kind: yaml.ScalarNode, Tag: "!!str", Value: key}, value)
+		return value, nil
+	}
+	value := m.Content[i+1]
+	if isNullScalar(value) {
+		value.Kind, value.Tag, value.Value, value.Style = yaml.MappingNode, "!!map", "", 0
+	}
+	if value.Kind != yaml.MappingNode {
+		return nil, fmt.Errorf("cscli config %s is not a mapping", key)
+	}
+	return value, nil
+}
+
+// findMappingKey returns the index of key's key node in the mapping m, or -1. Keys sit at even positions of Content.
+func findMappingKey(m *yaml.Node, key string) int {
+	for i := 0; i+1 < len(m.Content); i += 2 {
+		if m.Content[i].Value == key {
+			return i
+		}
+	}
+	return -1
+}
+
+// setMappingValue replaces the value under key in the mapping m, or appends the key when it is missing.
+func setMappingValue(m *yaml.Node, key string, value *yaml.Node) {
+	if i := findMappingKey(m, key); i >= 0 {
+		m.Content[i+1] = value
+		return
+	}
+	m.Content = append(m.Content, &yaml.Node{Kind: yaml.ScalarNode, Tag: "!!str", Value: key}, value)
+}
+
+// isNullScalar reports whether n is a YAML null (an empty value or ~).
+func isNullScalar(n *yaml.Node) bool {
+	return n.Kind == yaml.ScalarNode && n.Tag == "!!null"
+}
+
+// isEmptyScalar reports whether n is a null or an empty string.
+func isEmptyScalar(n *yaml.Node) bool {
+	return isNullScalar(n) || (n.Kind == yaml.ScalarNode && n.Value == "")
+}
+
+// writeMirrorFile writes data into the file f and closes it. The file was created with mode 0600 by
+// os.CreateTemp, so the content is never readable by other users.
+func writeMirrorFile(f *os.File, data []byte) error {
+	_, err := f.Write(data)
+	if closeErr := f.Close(); err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return fmt.Errorf("write hub mirror config: %w", err)
+	}
+	return nil
+}
+
+// readLocalOverride returns the CrowdSec local override at src. The second result reports whether the override exists.
+// A missing override is not an error; an unreadable one is, so the caller does not retry without it.
+func readLocalOverride(src string) (raw []byte, present bool, err error) {
+	raw, err = os.ReadFile(src) //nolint:gosec // G304: path derives from the server-controlled cscli config directory
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil, false, nil
+	}
+	if err != nil {
+		return nil, false, fmt.Errorf("read cscli local override: %w", err)
+	}
+	return raw, true, nil
+}
+
+// writeLocalOverride creates dst exclusively with mode 0600 and writes the override content raw into it.
+func writeLocalOverride(dst string, raw []byte) error {
+	f, err := os.OpenFile(dst, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600) //nolint:gosec // G304: path derives from the server-controlled cscli config directory
+	if err != nil {
+		return fmt.Errorf("create hub mirror local override: %w", err)
+	}
+	return writeMirrorFile(f, raw)
+}
+
+// isMirrorConfigName reports whether a lower-case file name is a derived mirror configuration or its local copy.
+func isMirrorConfigName(lower string) bool {
+	return strings.HasPrefix(lower, mirrorConfigPrefix) &&
+		(strings.HasSuffix(lower, ".yaml") || strings.HasSuffix(lower, ".yaml.local"))
+}
+
+// sweepMirrorLeftovers removes derived mirror configurations that a crash left in the data directory or its config
+// directory. It returns an error only when a leftover cannot be removed; a missing directory is not an error.
+func sweepMirrorLeftovers(dataDir string) error {
+	if dataDir == "" {
+		return nil
+	}
+	var errs []error
+	for _, dir := range []string{dataDir, filepath.Join(dataDir, "config")} {
+		entries, err := os.ReadDir(dir)
+		if errors.Is(err, fs.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			errs = append(errs, fmt.Errorf("list hub mirror leftovers: %w", err))
+			continue
+		}
+		for _, e := range entries {
+			if !isMirrorConfigName(strings.ToLower(e.Name())) {
+				continue
+			}
+			if err := os.Remove(filepath.Join(dir, e.Name())); err != nil {
+				errs = append(errs, fmt.Errorf("remove hub mirror leftover: %w", err))
+			}
+		}
+	}
+	return errors.Join(errs...)
+}
diff --git a/backend/internal/crowdsec/hub_mirror_pins_test.go b/backend/internal/crowdsec/hub_mirror_pins_test.go
new file mode 100644
index 000000000..1dccfaf9b
--- /dev/null
+++ b/backend/internal/crowdsec/hub_mirror_pins_test.go
@@ -0,0 +1,146 @@
+package crowdsec
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// The tests below pin behaviour that later commits of the hub outage fallback implement. Each commit removes the
+// skip for its own pins.
+
+const pinMirrorItemURL = "https://raw.githubusercontent.com/crowdsecurity/hub/master/collections/demo.yaml"
+
+// pinHubService serves a hub whose CDN index never answers. When mirrorHangs is set the mirror hangs too; otherwise
+// the mirror serves an index listing the demo item and the item itself. PullTimeout is 12 s, so the CDN attempt gets
+// its 5 s floor and the rest of the walk is left for the mirror. Every request is recorded in the returned slice.
+func pinHubService(t *testing.T, mirrorHangs bool) (svc *HubService, requested *[]string) {
+	t.Helper()
+	cache, err := NewHubCache(t.TempDir(), time.Hour)
+	require.NoError(t, err)
+	svc = NewHubService(nil, cache, t.TempDir())
+	svc.PullTimeout = 12 * time.Second
+
+	var mu sync.Mutex
+	var requests []string
+	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
+		mu.Lock()
+		requests = append(requests, req.URL.String())
+		mu.Unlock()
+		switch {
+		case req.URL.String() == cdnIndexURL:
+			return hangUntilDone(req)
+		case mirrorHangs && req.URL.String() == rawIndexURL:
+			return hangUntilDone(req)
+		case req.URL.String() == rawIndexURL:
+			resp := newResponse(http.StatusOK, `{"items":[`+demoEntry("collections", pinMirrorItemURL)+`]}`)
+			resp.Header.Set("Content-Type", "application/json")
+			return resp, nil
+		case req.URL.String() == pinMirrorItemURL:
+			return newResponse(http.StatusOK, pullDemoItem), nil
+		default:
+			return newResponse(http.StatusNotFound, ""), nil
+		}
+	})}
+	return svc, &requests
+}
+
+// hangUntilDone holds a request until its context ends, the way a dropped connection does.
+func hangUntilDone(req *http.Request) (*http.Response, error) {
+	<-req.Context().Done()
+	return nil, req.Context().Err()
+}
+
+func TestHubPinPullTriesMirrorWhenFirstAddressHangs(t *testing.T) {
+	t.Parallel()
+	svc, _ := pinHubService(t, false)
+
+	start := time.Now()
+	res, err := svc.Pull(context.Background(), "crowdsecurity/demo", "collections")
+	require.NoError(t, err)
+	require.Equal(t, pullDemoItem, res.Preview)
+	require.Less(t, time.Since(start), svc.PullTimeout, "the mirror answers inside the pull budget")
+}
+
+func TestHubPinFetchIndexWithoutDeadlineBoundedWhenBothAddressesHang(t *testing.T) {
+	t.Parallel()
+	svc, requested := pinHubService(t, true)
+
+	start := time.Now()
+	_, err := svc.FetchIndex(context.Background())
+	elapsed := time.Since(start)
+
+	require.ErrorIs(t, err, ErrHubUnreachable)
+	require.Equal(t, []string{cdnIndexURL, rawIndexURL}, *requested, "both addresses are tried")
+	require.Less(t, elapsed, svc.PullTimeout, "the walk ends inside its own budget")
+}
+
+func TestHubPinCSCLIRetriesOnMirrorAfterNetworkFailure(t *testing.T) {
+	t.Parallel()
+	svc, live := mirrorTestSetup(t)
+	exec := &scriptedCSCLI{respond: func(_ context.Context, n int, args []string) ([]byte, error) {
+		if n == 0 {
+			require.Equal(t, live, configFlag(args))
+			return []byte(dialFailureText), errLiveCSCLI
+		}
+		return nil, nil
+	}}
+	svc.Exec = exec
+
+	_, err := svc.runHubCSCLI(context.Background(), "collections", "install", "demo")
+	require.NoError(t, err)
+	calls := exec.recorded()
+	require.Len(t, calls, 3)
+	require.True(t, isDerivedConfig(configFlag(calls[2])), "the install is retried under the mirror configuration")
+}
+
+func TestHubPinCSCLIDoesNotRetryOnNonNetworkFailure(t *testing.T) {
+	t.Parallel()
+	svc, _ := mirrorTestSetup(t)
+	exec := &scriptedCSCLI{respond: func(_ context.Context, _ int, _ []string) ([]byte, error) {
+		return []byte("can't find collections/nope"), errLiveCSCLI
+	}}
+	svc.Exec = exec
+
+	_, err := svc.runHubCSCLI(context.Background(), "collections", "install", "nope")
+	require.ErrorIs(t, err, errLiveCSCLI)
+	require.Len(t, exec.recorded(), 1)
+}
+
+// pinCSCLIIndexExec answers the local cscli listing with one item and fails everything else.
+type pinCSCLIIndexExec struct{}
+
+func (pinCSCLIIndexExec) Execute(_ context.Context, _ string, args ...string) ([]byte, error) {
+	if len(args) > 0 && args[len(args)-1] == "json" {
+		return []byte(`{"collections":[{"name":"crowdsecurity/demo","title":"Demo","type":"collections"}]}`), nil
+	}
+	return nil, errors.New("unexpected cscli call")
+}
+
+// The index says whether the local cscli data answered instead of the HTTP index; the preset list reads that flag.
+func TestHubPinPresetListReportsHubOffline(t *testing.T) {
+	t.Parallel()
+	svc := NewHubService(pinCSCLIIndexExec{}, nil, t.TempDir())
+
+	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(*http.Request) (*http.Response, error) {
+		return nil, errors.New("dial tcp: no route to host")
+	})}
+	idx, err := svc.FetchIndex(context.Background())
+	require.NoError(t, err)
+	require.True(t, idx.Offline(), "the cscli listing answered for the HTTP index")
+	require.NotEmpty(t, idx.Items)
+
+	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(*http.Request) (*http.Response, error) {
+		resp := newResponse(http.StatusOK, `{"items":[`+demoEntry("collections", pinMirrorItemURL)+`]}`)
+		resp.Header.Set("Content-Type", "application/json")
+		return resp, nil
+	})}
+	idx, err = svc.FetchIndex(context.Background())
+	require.NoError(t, err)
+	require.False(t, idx.Offline(), "the HTTP index answered")
+}
diff --git a/backend/internal/crowdsec/hub_mirror_retry_test.go b/backend/internal/crowdsec/hub_mirror_retry_test.go
new file mode 100644
index 000000000..0db6f52ef
--- /dev/null
+++ b/backend/internal/crowdsec/hub_mirror_retry_test.go
@@ -0,0 +1,474 @@
+package crowdsec
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	"github.com/Wikid82/charon/backend/internal/logger"
+)
+
+// dialFailureText is the output cscli prints when the hub address refuses the connection.
+const dialFailureText = "failed http request for https://cdn-hub.crowdsec.net/crowdsecurity/hub/.index.json: dial tcp 1.2.3.4:443: connection refused"
+
+var (
+	errLiveCSCLI   = errors.New("live cscli failed")
+	errMirrorCSCLI = errors.New("mirror cscli failed")
+)
+
+// scriptedCSCLI answers each cscli call from respond and records the arguments of every call.
+type scriptedCSCLI struct {
+	mu      sync.Mutex
+	calls   [][]string
+	respond func(ctx context.Context, n int, args []string) ([]byte, error)
+}
+
+func (e *scriptedCSCLI) Execute(ctx context.Context, name string, args ...string) ([]byte, error) {
+	if name != "cscli" {
+		return nil, errors.New("unexpected executable: " + name)
+	}
+	e.mu.Lock()
+	n := len(e.calls)
+	e.calls = append(e.calls, append([]string(nil), args...))
+	e.mu.Unlock()
+	if e.respond == nil {
+		return nil, nil
+	}
+	return e.respond(ctx, n, args)
+}
+
+// recorded returns a copy of the calls made so far.
+func (e *scriptedCSCLI) recorded() [][]string {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	return append([][]string(nil), e.calls...)
+}
+
+// configFlag returns the path after the -c flag of a cscli call, or "" when there is none.
+func configFlag(args []string) string {
+	for i := 0; i+1 < len(args); i++ {
+		if args[i] == "-c" {
+			return args[i+1]
+		}
+	}
+	return ""
+}
+
+// isDerivedConfig reports whether path names a derived mirror configuration.
+func isDerivedConfig(path string) bool {
+	return strings.HasPrefix(filepath.Base(path), mirrorConfigPrefix)
+}
+
+// assertDerivedConfig checks a derived mirror configuration while it exists: owner-only mode, the mirror template in
+// the cscli section, and the local override copy next to it with the live content.
+func assertDerivedConfig(t *testing.T, path string) {
+	t.Helper()
+	require.True(t, isDerivedConfig(path), path)
+	info, err := os.Stat(path)
+	require.NoError(t, err)
+	require.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+
+	raw, err := os.ReadFile(path) //nolint:gosec // G304: t.TempDir-derived path
+	require.NoError(t, err)
+	var doc struct {
+		CSCLI map[string]any `yaml:"cscli"`
+	}
+	require.NoError(t, yaml.Unmarshal(raw, &doc))
+	require.Equal(t, testMirrorTemplate, doc.CSCLI[mirrorTemplateKey])
+	require.Equal(t, "master", doc.CSCLI[mirrorBranchKey])
+
+	local, err := os.ReadFile(path + ".local") //nolint:gosec // G304: t.TempDir-derived path
+	require.NoError(t, err)
+	require.Contains(t, string(local), "/local/hub")
+	localInfo, err := os.Stat(path + ".local")
+	require.NoError(t, err)
+	require.Equal(t, os.FileMode(0o600), localInfo.Mode().Perm())
+}
+
+// mirrorTestSetup creates a data directory with a live config.yaml and a service without an executor; tests set Exec.
+func mirrorTestSetup(t *testing.T) (svc *HubService, live string) {
+	t.Helper()
+	dir := t.TempDir()
+	live = writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n  hub_dir: /etc/crowdsec/hub\n")
+	svc = NewHubService(nil, nil, dir)
+	return svc, live
+}
+
+func mirrorTestOpts(live string, mem *MirrorMemory) HubCSCLIOptions {
+	return HubCSCLIOptions{ConfigPath: live, Template: testMirrorTemplate, Memory: mem}
+}
+
+func TestRunHubCSCLIPlainSuccessIsOneCall(t *testing.T) {
+	t.Parallel()
+	svc, live := mirrorTestSetup(t)
+	exec := &scriptedCSCLI{respond: func(_ context.Context, _ int, _ []string) ([]byte, error) {
+		return []byte("ok"), nil
+	}}
+	out, err := RunHubCSCLI(context.Background(), exec, mirrorTestOpts(live, NewMirrorMemory(time.Minute, nil)), "collections", "install", "demo")
+	require.NoError(t, err)
+	require.Equal(t, "ok", string(out))
+	calls := exec.recorded()
+	require.Len(t, calls, 1)
+	require.Equal(t, live, configFlag(calls[0]))
+	require.Equal(t, []string{"collections", "install", "demo"}, subcommand(calls[0]))
+	require.NotNil(t, svc)
+}
+
+func TestRunHubCSCLIInstallNetworkFailureRetriesUnderDerivedConfig(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n")
+	require.NoError(t, os.WriteFile(live+".local", []byte("cscli:\n  hub_dir: /local/hub\n"), 0o600))
+	mem := NewMirrorMemory(time.Minute, nil)
+	exec := &scriptedCSCLI{respond: func(_ context.Context, n int, args []string) ([]byte, error) {
+		switch n {
+		case 0:
+			require.Equal(t, live, configFlag(args))
+			return []byte(dialFailureText), errLiveCSCLI
+		case 1:
+			// The retried install refreshes the index under the same derived configuration first.
+			require.Equal(t, []string{"hub", "update"}, subcommand(args))
+			assertDerivedConfig(t, configFlag(args))
+			return nil, nil
+		case 2:
+			require.Equal(t, []string{"collections", "install", "demo"}, subcommand(args))
+			assertDerivedConfig(t, configFlag(args))
+			return []byte("installed"), nil
+		}
+		t.Fatalf("unexpected call %d: %v", n, args)
+		return nil, nil
+	}}
+
+	out, err := RunHubCSCLI(context.Background(), exec, mirrorTestOpts(live, mem), "collections", "install", "demo")
+	require.NoError(t, err)
+	require.Equal(t, "installed", string(out))
+	require.Len(t, exec.recorded(), 3)
+	require.True(t, mem.Active(), "a mirror win opens the mirror-first window")
+	require.Equal(t, []string{"config.yaml", "config.yaml.local"}, dirEntryNames(t, dir), "derived copies are removed after the retry")
+}
+
+func TestRunHubCSCLIHubUpdateRetriesOnMirrorAfterAttemptTimeout(t *testing.T) {
+	t.Parallel()
+	_, live := mirrorTestSetup(t)
+	exec := &scriptedCSCLI{respond: func(ctx context.Context, n int, args []string) ([]byte, error) {
+		if n == 0 {
+			// The live attempt hangs until its share of the time is spent.
+			<-ctx.Done()
+			return nil, ctx.Err()
+		}
+		require.True(t, isDerivedConfig(configFlag(args)))
+		require.Equal(t, []string{"hub", "update"}, subcommand(args))
+		return nil, nil
+	}}
+	parent, cancel := context.WithTimeout(context.Background(), 9*time.Second)
+	defer cancel()
+
+	_, err := RunHubCSCLI(parent, exec, mirrorTestOpts(live, nil), "hub", "update")
+	require.NoError(t, err)
+	require.Len(t, exec.recorded(), 2)
+}
+
+func TestRunHubCSCLIInstallDoesNotRetryOnBareDeadlineText(t *testing.T) {
+	t.Parallel()
+	_, live := mirrorTestSetup(t)
+	exec := &scriptedCSCLI{respond: func(_ context.Context, _ int, _ []string) ([]byte, error) {
+		return []byte("context deadline exceeded"), errLiveCSCLI
+	}}
+	_, err := RunHubCSCLI(context.Background(), exec, mirrorTestOpts(live, nil), "collections", "install", "demo")
+	require.ErrorIs(t, err, errLiveCSCLI)
+	require.Len(t, exec.recorded(), 1, "a healthy slow install is not killed by a retry")
+}
+
+func TestRunHubCSCLIItemErrorIsNotRetried(t *testing.T) {
+	t.Parallel()
+	_, live := mirrorTestSetup(t)
+	exec := &scriptedCSCLI{respond: func(_ context.Context, _ int, _ []string) ([]byte, error) {
+		return []byte("can't find collections/nope"), errLiveCSCLI
+	}}
+	_, err := RunHubCSCLI(context.Background(), exec, mirrorTestOpts(live, nil), "collections", "install", "nope")
+	require.ErrorIs(t, err, errLiveCSCLI)
+	require.Len(t, exec.recorded(), 1)
+}
+
+func TestRunHubCSCLIDeadParentIsNotRetried(t *testing.T) {
+	t.Parallel()
+	_, live := mirrorTestSetup(t)
+	parent, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	exec := &scriptedCSCLI{respond: func(_ context.Context, _ int, _ []string) ([]byte, error) {
+		cancel()
+		return []byte(dialFailureText), errLiveCSCLI
+	}}
+	_, err := RunHubCSCLI(parent, exec, mirrorTestOpts(live, nil), "collections", "install", "demo")
+	require.ErrorIs(t, err, errLiveCSCLI)
+	require.Len(t, exec.recorded(), 1)
+}
+
+func TestRunHubCSCLIWithoutMirrorConfigIsNotRetried(t *testing.T) {
+	t.Parallel()
+	_, live := mirrorTestSetup(t)
+	cases := map[string]HubCSCLIOptions{
+		"empty template":    {ConfigPath: live},
+		"empty config path": {Template: testMirrorTemplate},
+	}
+	for name, opts := range cases {
+		exec := &scriptedCSCLI{respond: func(_ context.Context, _ int, _ []string) ([]byte, error) {
+			return []byte(dialFailureText), errLiveCSCLI
+		}}
+		_, err := RunHubCSCLI(context.Background(), exec, opts, "collections", "install", "demo")
+		require.ErrorIs(t, err, errLiveCSCLI, name)
+		require.Len(t, exec.recorded(), 1, name)
+	}
+}
+
+func TestRunHubCSCLIOperatorTemplateFailsClosed(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	const operatorConfig = "cscli:\n  hub_branch: master\n  __hub_url_template__: \"https://hub.example.org/%s/%s\"\n"
+	live := writeCSCLIConfig(t, dir, operatorConfig)
+	mem := NewMirrorMemory(time.Minute, nil)
+	exec := &scriptedCSCLI{respond: func(_ context.Context, _ int, _ []string) ([]byte, error) {
+		return []byte(dialFailureText), errLiveCSCLI
+	}}
+
+	_, err := RunHubCSCLI(context.Background(), exec, mirrorTestOpts(live, mem), "collections", "install", "demo")
+	require.ErrorIs(t, err, errLiveCSCLI)
+	require.Len(t, exec.recorded(), 1, "the operator's own hub is never replaced by the mirror")
+	require.False(t, mem.Active())
+	raw, readErr := os.ReadFile(live) //nolint:gosec // G304: t.TempDir-derived path
+	require.NoError(t, readErr)
+	require.Equal(t, operatorConfig, string(raw))
+}
+
+func TestRunHubCSCLILocalOperatorTemplateFailsClosed(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n")
+	const localConfig = "cscli:\n  __hub_url_template__: \"https://hub.example.org/%s/%s\"\n"
+	require.NoError(t, os.WriteFile(live+".local", []byte(localConfig), 0o600))
+	mem := NewMirrorMemory(time.Minute, nil)
+	exec := &scriptedCSCLI{respond: func(_ context.Context, _ int, _ []string) ([]byte, error) {
+		return []byte(dialFailureText), errLiveCSCLI
+	}}
+
+	_, err := RunHubCSCLI(context.Background(), exec, mirrorTestOpts(live, mem), "collections", "install", "demo")
+	require.ErrorIs(t, err, errLiveCSCLI)
+	require.Len(t, exec.recorded(), 1, "a .local template that the mirror would override is never retried")
+	require.False(t, mem.Active())
+	require.Equal(t, []string{"config.yaml", "config.yaml.local"}, dirEntryNames(t, dir), "no derived copy is left behind")
+}
+
+func TestHubServiceMirrorTemplateLogsUnusableBaseOnce(t *testing.T) {
+	// Not parallel: the test swaps the global logger output.
+	logs := captureHubLogs(t)
+
+	svc, _ := mirrorTestSetup(t)
+	svc.MirrorBaseURL = "https://example.com/hub/master"
+	for range 3 {
+		opts := svc.MirrorOptions()
+		require.Equal(t, builtinMirrorTemplate, opts.Template)
+	}
+	require.Equal(t, 1, strings.Count(logs.String(), "hub mirror base not usable"), "a repeated call does not repeat the warning")
+
+	svc.MirrorBaseURL = "https://raw.githubusercontent.com/example/hub/master"
+	require.Equal(t, "https://raw.githubusercontent.com/example/hub/%s/%s", svc.MirrorOptions().Template)
+	require.Equal(t, 1, strings.Count(logs.String(), "hub mirror base not usable"), "a usable base logs nothing")
+
+	svc.MirrorBaseURL = "https://example.com/other/master"
+	require.Equal(t, builtinMirrorTemplate, svc.MirrorOptions().Template)
+	require.Equal(t, 2, strings.Count(logs.String(), "hub mirror base not usable"), "a new unusable base is named once")
+}
+
+func TestRunHubCSCLIMirrorFirstSkipsLiveWhileWindowIsOpen(t *testing.T) {
+	t.Parallel()
+	_, live := mirrorTestSetup(t)
+	mem := NewMirrorMemory(time.Minute, nil)
+	mem.Remember()
+	exec := &scriptedCSCLI{respond: func(_ context.Context, n int, args []string) ([]byte, error) {
+		require.Equal(t, 0, n, "the live attempt is skipped")
+		require.True(t, isDerivedConfig(configFlag(args)))
+		return []byte("installed"), nil
+	}}
+
+	out, err := RunHubCSCLI(context.Background(), exec, mirrorTestOpts(live, mem), "collections", "install", "demo")
+	require.NoError(t, err)
+	require.Equal(t, "installed", string(out))
+	require.Len(t, exec.recorded(), 1)
+	require.True(t, mem.Active())
+}
+
+func TestRunHubCSCLIMirrorFailureRescuedByLiveClearsWindow(t *testing.T) {
+	t.Parallel()
+	_, live := mirrorTestSetup(t)
+	mem := NewMirrorMemory(time.Minute, nil)
+	mem.Remember()
+	exec := &scriptedCSCLI{respond: func(_ context.Context, n int, args []string) ([]byte, error) {
+		switch n {
+		case 0:
+			require.True(t, isDerivedConfig(configFlag(args)))
+			return []byte(dialFailureText), errMirrorCSCLI
+		case 1:
+			require.Equal(t, live, configFlag(args))
+			require.Equal(t, []string{"hub", "update"}, subcommand(args))
+			return nil, nil
+		case 2:
+			require.Equal(t, live, configFlag(args))
+			return []byte("installed"), nil
+		}
+		t.Fatalf("unexpected call %d: %v", n, args)
+		return nil, nil
+	}}
+
+	out, err := RunHubCSCLI(context.Background(), exec, mirrorTestOpts(live, mem), "collections", "install", "demo")
+	require.NoError(t, err)
+	require.Equal(t, "installed", string(out))
+	require.Len(t, exec.recorded(), 3)
+	require.False(t, mem.Active(), "the live config answering again closes the window")
+}
+
+func TestRunHubCSCLIMirrorAndLiveFailureKeepsWindow(t *testing.T) {
+	t.Parallel()
+	_, live := mirrorTestSetup(t)
+	mem := NewMirrorMemory(time.Minute, nil)
+	mem.Remember()
+	exec := &scriptedCSCLI{respond: func(_ context.Context, n int, _ []string) ([]byte, error) {
+		if n == 0 {
+			return []byte(dialFailureText), errMirrorCSCLI
+		}
+		return []byte(dialFailureText), errLiveCSCLI
+	}}
+
+	_, err := RunHubCSCLI(context.Background(), exec, mirrorTestOpts(live, mem), "hub", "update")
+	require.ErrorIs(t, err, errMirrorCSCLI)
+	require.ErrorIs(t, err, errLiveCSCLI)
+	require.Len(t, exec.recorded(), 2)
+	require.True(t, mem.Active())
+}
+
+func TestRunHubCSCLIFailedMirrorUpdateEndsRetry(t *testing.T) {
+	t.Parallel()
+	_, live := mirrorTestSetup(t)
+	mem := NewMirrorMemory(time.Minute, nil)
+	exec := &scriptedCSCLI{respond: func(_ context.Context, n int, _ []string) ([]byte, error) {
+		if n == 0 {
+			return []byte(dialFailureText), errLiveCSCLI
+		}
+		return []byte(dialFailureText), errMirrorCSCLI
+	}}
+
+	_, err := RunHubCSCLI(context.Background(), exec, mirrorTestOpts(live, mem), "collections", "install", "demo")
+	require.ErrorIs(t, err, errLiveCSCLI)
+	require.ErrorIs(t, err, errMirrorCSCLI)
+	calls := exec.recorded()
+	require.Len(t, calls, 2, "the install does not run when the mirror index refresh fails")
+	require.Equal(t, []string{"hub", "update"}, subcommand(calls[1]))
+	require.False(t, mem.Active())
+}
+
+func TestHubServiceMirrorOptionsUseBuiltInMirrorAndSharedMemory(t *testing.T) {
+	t.Parallel()
+	svc, live := mirrorTestSetup(t)
+	opts := svc.MirrorOptions()
+	require.Equal(t, live, opts.ConfigPath)
+	require.Equal(t, testMirrorTemplate, opts.Template)
+	require.NotNil(t, opts.Memory)
+	require.Same(t, opts.Memory, svc.MirrorOptions().Memory)
+}
+
+func TestNewHubServiceSweepsMirrorLeftovers(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "config"), 0o750))
+	for _, rel := range []string{
+		".charon-hub-mirror-a.yaml",
+		".charon-hub-mirror-a.yaml.local",
+		filepath.Join("config", ".charon-hub-mirror-b.yaml"),
+		filepath.Join("config", ".CHARON-HUB-MIRROR-c.YAML.local"),
+	} {
+		require.NoError(t, os.WriteFile(filepath.Join(dir, rel), []byte("x"), 0o600))
+	}
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "config.yaml"), []byte("cscli: {}\n"), 0o600))
+
+	NewHubService(nil, nil, dir)
+
+	require.Equal(t, []string{"config", "config.yaml"}, dirEntryNames(t, dir))
+	require.Empty(t, dirEntryNames(t, filepath.Join(dir, "config")))
+}
+
+// captureHubLogs points the global logger at a buffer until the test ends. A test that uses it must not run in
+// parallel, because the logger output is shared.
+func captureHubLogs(t *testing.T) *bytes.Buffer {
+	t.Helper()
+	var logs bytes.Buffer
+	logger.Init(false, &logs)
+	t.Cleanup(func() { logger.Init(false, os.Stdout) })
+	return &logs
+}
+
+const (
+	liveFailureRetryLog   = "cscli hub request failed on the live hub address; retrying on the hub mirror"
+	mirrorFailureRetryLog = "cscli hub request failed on the hub mirror; retrying on the live hub address"
+)
+
+func TestRunHubCSCLILiveFailureLogsRetryOnMirror(t *testing.T) {
+	// Not parallel: the test swaps the global logger output.
+	logs := captureHubLogs(t)
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n")
+	exec := &scriptedCSCLI{respond: func(_ context.Context, n int, _ []string) ([]byte, error) {
+		if n == 0 {
+			return []byte(dialFailureText), errLiveCSCLI
+		}
+		return nil, nil
+	}}
+
+	_, err := RunHubCSCLI(context.Background(), exec, mirrorTestOpts(live, NewMirrorMemory(time.Minute, nil)), "collections", "install", "demo")
+	require.NoError(t, err)
+	require.Equal(t, 1, strings.Count(logs.String(), liveFailureRetryLog), logs.String())
+	require.NotContains(t, logs.String(), mirrorFailureRetryLog)
+}
+
+func TestRunHubCSCLIMirrorFailureLogsRetryOnLive(t *testing.T) {
+	// Not parallel: the test swaps the global logger output.
+	logs := captureHubLogs(t)
+	_, live := mirrorTestSetup(t)
+	mem := NewMirrorMemory(time.Minute, nil)
+	mem.Remember()
+	exec := &scriptedCSCLI{respond: func(_ context.Context, n int, _ []string) ([]byte, error) {
+		if n == 0 {
+			return []byte(dialFailureText), errMirrorCSCLI
+		}
+		return nil, nil
+	}}
+
+	_, err := RunHubCSCLI(context.Background(), exec, mirrorTestOpts(live, mem), "collections", "install", "demo")
+	require.NoError(t, err)
+	require.Equal(t, 1, strings.Count(logs.String(), mirrorFailureRetryLog), logs.String())
+	require.NotContains(t, logs.String(), liveFailureRetryLog, "a mirror-first failure never names the live address as the failed one")
+}
+
+func TestRunHubCSCLIDeclinedRetryLogsNoRetryWarning(t *testing.T) {
+	// Not parallel: the test swaps the global logger output.
+	logs := captureHubLogs(t)
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n")
+	require.NoError(t, os.WriteFile(live+".local", []byte("cscli:\n  __hub_url_template__: \"https://hub.example.org/%s/%s\"\n"), 0o600))
+	exec := &scriptedCSCLI{respond: func(_ context.Context, _ int, _ []string) ([]byte, error) {
+		return []byte(dialFailureText), errLiveCSCLI
+	}}
+
+	_, err := RunHubCSCLI(context.Background(), exec, mirrorTestOpts(live, NewMirrorMemory(time.Minute, nil)), "collections", "install", "demo")
+	require.ErrorIs(t, err, errLiveCSCLI)
+	require.Len(t, exec.recorded(), 1)
+	require.NotContains(t, logs.String(), "retrying on", "no retry runs, so no retry warning is printed")
+	require.Contains(t, logs.String(), "hub mirror retry unavailable")
+}
diff --git a/backend/internal/crowdsec/hub_mirror_test.go b/backend/internal/crowdsec/hub_mirror_test.go
new file mode 100644
index 000000000..66d5771d5
--- /dev/null
+++ b/backend/internal/crowdsec/hub_mirror_test.go
@@ -0,0 +1,570 @@
+package crowdsec
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+)
+
+const testMirrorTemplate = "https://raw.githubusercontent.com/crowdsecurity/hub/%s/%s"
+
+func writeCSCLIConfig(t *testing.T, dir, content string) string {
+	t.Helper()
+	p := filepath.Join(dir, "config.yaml")
+	require.NoError(t, os.WriteFile(p, []byte(content), 0o600))
+	return p
+}
+
+// dirEntryNames lists the file names in dir, sorted by the OS.
+func dirEntryNames(t *testing.T, dir string) []string {
+	t.Helper()
+	entries, err := os.ReadDir(dir)
+	require.NoError(t, err)
+	names := make([]string, 0, len(entries))
+	for _, e := range entries {
+		names = append(names, e.Name())
+	}
+	return names
+}
+
+func TestIsHubNetworkOp(t *testing.T) {
+	t.Parallel()
+	cases := map[string]bool{
+		"hub update":                  true,
+		"hub upgrade":                 true,
+		"collections install x/y":     true,
+		"parsers install x/y":         true,
+		"scenarios upgrade x/y":       true,
+		"postoverflows install x/y":   true,
+		"collections inspect x/y":     false,
+		"collections list":            false,
+		"hub list":                    false,
+		"version":                     false,
+		"hub":                         false,
+		"install":                     false,
+		"":                            false,
+		"collections remove x/y":      false,
+		"hub install x":               false,
+		"collections install-old x/y": false,
+	}
+	for line, want := range cases {
+		args := strings.Fields(line)
+		require.Equal(t, want, isHubNetworkOp(args), line)
+	}
+	require.False(t, isHubNetworkOp(nil))
+}
+
+func TestIsRetryableHubFailure(t *testing.T) {
+	t.Parallel()
+	cases := map[string]bool{
+		"failed http request for https://cdn-hub.crowdsec.net: dial tcp 1.2.3.4:443: connection refused": true,
+		"lookup cdn-hub.crowdsec.net: no such host":                                                      true,
+		"context deadline exceeded":                                                                      true,
+		"Get \"https://x\": Client.Timeout exceeded while awaiting headers":                              true,
+		"net/http: TLS handshake timeout":                                                                true,
+		"item not found":                                                                                 false,
+		"item is tainted":                                                                                false,
+		"":                                                                                               false,
+	}
+	for text, want := range cases {
+		require.Equal(t, want, isRetryableHubFailure(text), text)
+	}
+}
+
+func TestMirrorMemoryWindow(t *testing.T) {
+	clock := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	now := func() time.Time { return clock }
+	m := NewMirrorMemory(10*time.Minute, now)
+
+	require.False(t, m.Active())
+	m.Remember()
+	require.True(t, m.Active())
+
+	// A later mirror win inside the window does not extend it.
+	clock = clock.Add(5 * time.Minute)
+	m.Remember()
+	require.True(t, m.Active())
+
+	clock = clock.Add(5 * time.Minute)
+	require.False(t, m.Active(), "window ends ttl after the first win")
+
+	// A win after the window closed opens a new one.
+	m.Remember()
+	require.True(t, m.Active())
+
+	// The live config answering again closes the window.
+	m.Forget()
+	require.False(t, m.Active())
+}
+
+func TestMirrorMemoryNilAndZeroValues(t *testing.T) {
+	t.Parallel()
+	var nilMemory *MirrorMemory
+	require.False(t, nilMemory.Active())
+	nilMemory.Remember()
+	nilMemory.Forget()
+
+	var zero MirrorMemory
+	require.False(t, zero.Active())
+	zero.Remember()
+	zero.Forget()
+}
+
+func TestMirrorHubTemplate(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name     string
+		base     string
+		want     string
+		operator bool
+	}{
+		{name: "unset uses the built-in mirror", base: "", want: testMirrorTemplate, operator: false},
+		{name: "built-in base", base: defaultHubMirrorBaseURL, want: testMirrorTemplate, operator: true},
+		{name: "operator master with trailing slash", base: defaultHubMirrorBaseURL + "/", want: testMirrorTemplate, operator: true},
+		{
+			name:     "operator fork on the allowlisted mirror host",
+			base:     "https://raw.githubusercontent.com/example/hub/master",
+			want:     "https://raw.githubusercontent.com/example/hub/%s/%s",
+			operator: true,
+		},
+		{name: "operator other branch is refused", base: "https://raw.githubusercontent.com/crowdsecurity/hub/dev", want: testMirrorTemplate},
+		{name: "operator plain http is refused", base: "http://raw.githubusercontent.com/crowdsecurity/hub/master", want: testMirrorTemplate},
+		{name: "operator host outside the allowlist is refused", base: "https://example.com/hub/master", want: testMirrorTemplate},
+		{name: "operator percent escape would add a verb", base: "https://raw.githubusercontent.com/x%41/hub/master", want: testMirrorTemplate},
+		{name: "unparseable operator value is refused", base: "https://[::1", want: testMirrorTemplate},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got, operator := mirrorHubTemplate(tc.base)
+			require.Equal(t, tc.want, got)
+			require.Equal(t, tc.operator, operator)
+		})
+	}
+}
+
+func TestValidMirrorTemplate(t *testing.T) {
+	t.Parallel()
+	require.True(t, validMirrorTemplate(testMirrorTemplate))
+	for _, bad := range []string{
+		"",
+		"https://x/%s",
+		"https://x/%s/%s/%s",
+		"https://x/%s/%s%",
+		"https://x/%41/%s/%s",
+		"http://x/%s/%s",
+		"https://x/%s/%s\n__hub_url_template__: evil",
+		"https://x/%s/%s\r",
+		"https://x/%s/%s\x00",
+	} {
+		require.False(t, validMirrorTemplate(bad), "%q", bad)
+	}
+}
+
+func TestMirrorCSCLIConfigInsertsTemplateAndKeepsOtherKeys(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "common:\n  log_level: info\ncscli:\n  output: human\n  hub_branch: dev\n")
+
+	derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+	require.NoError(t, err)
+	require.Equal(t, dir, filepath.Dir(derived))
+	require.True(t, strings.HasPrefix(filepath.Base(derived), mirrorConfigPrefix))
+	require.True(t, strings.HasSuffix(derived, ".yaml"))
+
+	info, err := os.Stat(derived)
+	require.NoError(t, err)
+	require.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+
+	raw, err := os.ReadFile(derived) //nolint:gosec // G304: t.TempDir-derived path
+	require.NoError(t, err)
+	var got map[string]map[string]string
+	require.NoError(t, yaml.Unmarshal(raw, &got))
+	require.Equal(t, testMirrorTemplate, got["cscli"]["__hub_url_template__"])
+	require.Equal(t, "dev", got["cscli"]["hub_branch"], "an existing branch is kept")
+	require.Equal(t, "human", got["cscli"]["output"])
+	require.Equal(t, "info", got["common"]["log_level"])
+
+	// The live file is never touched.
+	liveRaw, err := os.ReadFile(live) //nolint:gosec // G304: t.TempDir-derived path
+	require.NoError(t, err)
+	require.Contains(t, string(liveRaw), "hub_branch: dev")
+	require.NotContains(t, string(liveRaw), "__hub_url_template__")
+
+	cleanup()
+	_, err = os.Stat(derived)
+	require.True(t, errors.Is(err, os.ErrNotExist), "cleanup removes the derived file")
+}
+
+func TestMirrorCSCLIConfigSetsBranchWhenMissingOrEmpty(t *testing.T) {
+	t.Parallel()
+	cases := map[string]string{
+		"section missing":        "common:\n  log_level: info\n",
+		"section empty":          "cscli:\n",
+		"branch empty":           "cscli:\n  hub_branch: \"\"\n",
+		"branch missing":         "cscli:\n  output: human\n",
+		"empty file":             "",
+		"comment only":           "# nothing configured yet\n",
+		"section null tilde":     "cscli: ~\n",
+		"branch null with value": "cscli:\n  hub_branch:\n",
+	}
+	for name, content := range cases {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			dir := t.TempDir()
+			live := writeCSCLIConfig(t, dir, content)
+			derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+			require.NoError(t, err)
+			defer cleanup()
+
+			raw, err := os.ReadFile(derived) //nolint:gosec // G304: t.TempDir-derived path
+			require.NoError(t, err)
+			var got map[string]map[string]string
+			require.NoError(t, yaml.Unmarshal(raw, &got))
+			require.Equal(t, "master", got["cscli"]["hub_branch"])
+			require.Equal(t, testMirrorTemplate, got["cscli"]["__hub_url_template__"])
+		})
+	}
+}
+
+func TestMirrorCSCLIConfigQuotesTemplateValue(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n")
+	derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+	require.NoError(t, err)
+	defer cleanup()
+
+	raw, err := os.ReadFile(derived) //nolint:gosec // G304: t.TempDir-derived path
+	require.NoError(t, err)
+	require.Contains(t, string(raw), `__hub_url_template__: "https://raw.githubusercontent.com/crowdsecurity/hub/%s/%s"`)
+}
+
+func TestMirrorCSCLIConfigRefusesOperatorTemplate(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  __hub_url_template__: https://private.example/%s/%s\n")
+
+	derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+	require.ErrorIs(t, err, errMirrorTemplateSet)
+	require.Empty(t, derived)
+	require.NotNil(t, cleanup)
+	cleanup()
+	require.Equal(t, []string{"config.yaml"}, dirEntryNames(t, dir), "no derived file is left behind")
+}
+
+func TestMirrorCSCLIConfigAllowsEmptyOperatorTemplate(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  __hub_url_template__:\n")
+	derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+	require.NoError(t, err)
+	defer cleanup()
+
+	raw, err := os.ReadFile(derived) //nolint:gosec // G304: t.TempDir-derived path
+	require.NoError(t, err)
+	require.Contains(t, string(raw), testMirrorTemplate)
+}
+
+func TestMirrorCSCLIConfigRefusesInvalidTemplate(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n")
+	for _, bad := range []string{"https://x/%s", "https://x/%s/%s\nevil: true", "http://x/%s/%s"} {
+		derived, cleanup, err := mirrorCSCLIConfig(live, bad)
+		require.ErrorIs(t, err, errMirrorTemplateInvalid, "%q", bad)
+		require.Empty(t, derived)
+		cleanup()
+	}
+	require.Equal(t, []string{"config.yaml"}, dirEntryNames(t, dir))
+}
+
+func TestMirrorCSCLIConfigRejectsUnusableInput(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	cases := map[string]string{
+		"malformed yaml":      "cscli: [\n",
+		"root is a sequence":  "- a\n- b\n",
+		"cscli is a scalar":   "cscli: 5\n",
+		"cscli is a sequence": "cscli: [1]\n",
+	}
+	for name, content := range cases {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			sub := t.TempDir()
+			live := writeCSCLIConfig(t, sub, content)
+			derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+			require.Error(t, err)
+			require.Empty(t, derived)
+			cleanup()
+			require.Equal(t, []string{"config.yaml"}, dirEntryNames(t, sub))
+		})
+	}
+
+	t.Run("missing config", func(t *testing.T) {
+		t.Parallel()
+		_, cleanup, err := mirrorCSCLIConfig(filepath.Join(dir, "absent.yaml"), testMirrorTemplate)
+		require.Error(t, err)
+		cleanup()
+	})
+	t.Run("empty path", func(t *testing.T) {
+		t.Parallel()
+		_, cleanup, err := mirrorCSCLIConfig("", testMirrorTemplate)
+		require.Error(t, err)
+		cleanup()
+	})
+}
+
+func TestMirrorCSCLIConfigCopiesLocalOverride(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n")
+	const local = "cscli:\n  hub_dir: /custom/hub\n"
+	require.NoError(t, os.WriteFile(live+".local", []byte(local), 0o600))
+
+	derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+	require.NoError(t, err)
+
+	copied, err := os.ReadFile(derived + ".local") //nolint:gosec // G304: t.TempDir-derived path
+	require.NoError(t, err)
+	require.Equal(t, local, string(copied))
+	info, err := os.Stat(derived + ".local")
+	require.NoError(t, err)
+	require.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+
+	cleanup()
+	for _, p := range []string{derived, derived + ".local"} {
+		_, err := os.Stat(p)
+		require.True(t, errors.Is(err, os.ErrNotExist), p)
+	}
+	require.Equal(t, []string{"config.yaml", "config.yaml.local"}, dirEntryNames(t, dir))
+}
+
+func TestMirrorCSCLIConfigFailsClosedWhenLocalUnreadable(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n")
+	// A directory where the override file should be cannot be read, so no retry may run without it.
+	require.NoError(t, os.Mkdir(live+".local", 0o750))
+
+	derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+	require.Error(t, err)
+	require.Empty(t, derived)
+	cleanup()
+	require.Equal(t, []string{"config.yaml", "config.yaml.local"}, dirEntryNames(t, dir))
+}
+
+func TestMirrorCSCLIConfigFailsWhenTempFileCannotBeCreated(t *testing.T) {
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n")
+	original := createMirrorTemp
+	createMirrorTemp = func(string, string) (*os.File, error) { return nil, errors.New("disk full") }
+	t.Cleanup(func() { createMirrorTemp = original })
+
+	derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+	require.ErrorContains(t, err, "disk full")
+	require.Empty(t, derived)
+	cleanup()
+}
+
+func TestSweepMirrorLeftovers(t *testing.T) {
+	t.Parallel()
+	dataDir := t.TempDir()
+	configDir := filepath.Join(dataDir, "config")
+	require.NoError(t, os.MkdirAll(configDir, 0o750))
+	leftovers := []string{
+		filepath.Join(configDir, mirrorConfigPrefix+"a1.yaml"),
+		filepath.Join(configDir, mirrorConfigPrefix+"a1.yaml.local"),
+		filepath.Join(dataDir, mirrorConfigPrefix+"b2.yaml"),
+		filepath.Join(dataDir, mirrorConfigPrefix+"b2.yaml.local"),
+	}
+	keep := []string{
+		filepath.Join(configDir, "config.yaml"),
+		filepath.Join(configDir, "config.yaml.local"),
+		filepath.Join(dataDir, ".charon-hub-other.yaml"),
+	}
+	for _, p := range append(append([]string{}, leftovers...), keep...) {
+		require.NoError(t, os.WriteFile(p, []byte("x"), 0o600))
+	}
+
+	require.NoError(t, sweepMirrorLeftovers(dataDir))
+	for _, p := range leftovers {
+		_, err := os.Stat(p)
+		require.True(t, errors.Is(err, os.ErrNotExist), "leftover kept: %s", p)
+	}
+	for _, p := range keep {
+		_, err := os.Stat(p)
+		require.NoError(t, err, "unrelated file removed: %s", p)
+	}
+}
+
+func TestSweepMirrorLeftoversEdgeCases(t *testing.T) {
+	t.Parallel()
+	t.Run("empty data dir is a no-op", func(t *testing.T) {
+		t.Parallel()
+		require.NoError(t, sweepMirrorLeftovers(""))
+	})
+	t.Run("missing data dir is a no-op", func(t *testing.T) {
+		t.Parallel()
+		require.NoError(t, sweepMirrorLeftovers(filepath.Join(t.TempDir(), "absent")))
+	})
+	t.Run("a leftover that cannot be removed is reported", func(t *testing.T) {
+		t.Parallel()
+		dataDir := t.TempDir()
+		stuck := filepath.Join(dataDir, mirrorConfigPrefix+"c3.yaml")
+		require.NoError(t, os.Mkdir(stuck, 0o750))
+		require.NoError(t, os.WriteFile(filepath.Join(stuck, "inner"), []byte("x"), 0o600))
+		require.Error(t, sweepMirrorLeftovers(dataDir))
+	})
+}
+
+func TestMirrorCSCLIConfigFailsWhenTempFileIsUnusable(t *testing.T) {
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n")
+	original := createMirrorTemp
+	createMirrorTemp = func(d, pattern string) (*os.File, error) {
+		f, err := os.CreateTemp(d, pattern)
+		if err != nil {
+			return nil, err
+		}
+		closeErr := f.Close()
+		return f, closeErr
+	}
+	t.Cleanup(func() { createMirrorTemp = original })
+
+	derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+	require.ErrorContains(t, err, "write hub mirror config")
+	require.Empty(t, derived)
+	cleanup()
+	require.Equal(t, []string{"config.yaml"}, dirEntryNames(t, dir), "the unusable temp file is removed")
+}
+
+func TestWriteMirrorFileReportsClosedFile(t *testing.T) {
+	t.Parallel()
+	f, err := os.CreateTemp(t.TempDir(), "x*.yaml")
+	require.NoError(t, err)
+	require.NoError(t, f.Close())
+	require.ErrorContains(t, writeMirrorFile(f, []byte("x")), "write hub mirror config")
+}
+
+func TestWriteLocalOverrideRefusesExistingTarget(t *testing.T) {
+	t.Parallel()
+	dst := filepath.Join(t.TempDir(), "derived.yaml.local")
+	require.NoError(t, os.WriteFile(dst, []byte("keep"), 0o600))
+
+	require.ErrorContains(t, writeLocalOverride(dst, []byte("new")), "create hub mirror local override")
+	kept, err := os.ReadFile(dst) //nolint:gosec // G304: t.TempDir-derived path
+	require.NoError(t, err)
+	require.Equal(t, "keep", string(kept), "an existing target is never overwritten")
+}
+
+func TestReadLocalOverrideMissingSourceIsAbsent(t *testing.T) {
+	t.Parallel()
+	raw, present, err := readLocalOverride(filepath.Join(t.TempDir(), "absent.local"))
+	require.NoError(t, err)
+	require.False(t, present)
+	require.Nil(t, raw)
+}
+
+func TestReadLocalOverridePresentEmptyFile(t *testing.T) {
+	t.Parallel()
+	src := filepath.Join(t.TempDir(), "config.yaml.local")
+	require.NoError(t, os.WriteFile(src, nil, 0o600))
+	raw, present, err := readLocalOverride(src)
+	require.NoError(t, err)
+	require.True(t, present, "an empty override file is still an override")
+	require.Empty(t, raw)
+}
+
+func TestMirrorCSCLIConfigRefusesLocalOperatorTemplate(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n")
+	require.NoError(t, os.WriteFile(live+".local", []byte("cscli:\n  __hub_url_template__: https://private.example/%s/%s\n"), 0o600))
+
+	derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+	require.ErrorIs(t, err, errMirrorLocalTemplateSet)
+	require.Empty(t, derived)
+	cleanup()
+	require.Equal(t, []string{"config.yaml", "config.yaml.local"}, dirEntryNames(t, dir), "no derived copy is left behind")
+}
+
+func TestMirrorCSCLIConfigAllowsEmptyLocalTemplate(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n")
+	require.NoError(t, os.WriteFile(live+".local", []byte("cscli:\n  __hub_url_template__:\n"), 0o600))
+
+	derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+	require.NoError(t, err)
+	defer cleanup()
+	require.FileExists(t, derived+".local")
+}
+
+func TestMirrorCSCLIConfigFailsClosedOnUnparseableLocal(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	live := writeCSCLIConfig(t, dir, "cscli:\n  hub_branch: master\n")
+	require.NoError(t, os.WriteFile(live+".local", []byte("cscli: [\n"), 0o600))
+
+	derived, cleanup, err := mirrorCSCLIConfig(live, testMirrorTemplate)
+	require.ErrorContains(t, err, "parse cscli local override")
+	require.Empty(t, derived)
+	cleanup()
+	require.Equal(t, []string{"config.yaml", "config.yaml.local"}, dirEntryNames(t, dir))
+}
+
+func TestMirrorTemplateSetIn(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name    string
+		raw     string
+		want    bool
+		wantErr bool
+	}{
+		{name: "empty document", raw: "", want: false},
+		{name: "no cscli section", raw: "common:\n  log_level: info\n", want: false},
+		{name: "null cscli section", raw: "cscli:\n", want: false},
+		{name: "no template key", raw: "cscli:\n  hub_branch: master\n", want: false},
+		{name: "empty template value", raw: "cscli:\n  __hub_url_template__:\n", want: false},
+		{name: "empty string template", raw: "cscli:\n  __hub_url_template__: \"\"\n", want: false},
+		{name: "non-empty template", raw: "cscli:\n  __hub_url_template__: https://x/%s/%s\n", want: true},
+		{name: "non-scalar template is treated as set", raw: "cscli:\n  __hub_url_template__: [a]\n", want: true},
+		{name: "root is a sequence", raw: "- a\n", wantErr: true},
+		{name: "cscli is a scalar", raw: "cscli: 5\n", wantErr: true},
+		{name: "malformed yaml", raw: "cscli: [\n", wantErr: true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got, err := mirrorTemplateSetIn([]byte(tc.raw))
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestIsMirrorConfigName(t *testing.T) {
+	t.Parallel()
+	require.True(t, isMirrorConfigName(".charon-hub-mirror-a.yaml"))
+	require.True(t, isMirrorConfigName(".charon-hub-mirror-a.yaml.local"))
+	require.False(t, isMirrorConfigName(".charon-hub-mirror-a.yml"))
+	require.False(t, isMirrorConfigName("config.yaml"))
+}
+
+func TestSweepMirrorLeftoversUnusableDataDir(t *testing.T) {
+	t.Parallel()
+	notADir := filepath.Join(t.TempDir(), "file")
+	require.NoError(t, os.WriteFile(notADir, []byte("x"), 0o600))
+	require.Error(t, sweepMirrorLeftovers(notADir))
+}
diff --git a/backend/internal/crowdsec/hub_sync.go b/backend/internal/crowdsec/hub_sync.go
index cf4a98298..fe2ad835b 100644
--- a/backend/internal/crowdsec/hub_sync.go
+++ b/backend/internal/crowdsec/hub_sync.go
@@ -77,6 +77,9 @@ type HubIndex struct {
 	offline bool
 }
 
+// Offline reports whether the index was listed from the local cscli data because the HTTP index was unreachable.
+func (idx HubIndex) Offline() bool { return idx.offline }
+
 // PullResult bundles the pull metadata, preview text, and cache entry.
 type PullResult struct {
 	Meta    CachedPreset
@@ -131,6 +134,10 @@ type HubService struct {
 	// legacySweepMu guards legacySweepDone, which is set once the old-layout cache sweep has succeeded.
 	legacySweepMu   sync.Mutex
 	legacySweepDone bool
+	// mirror is the mirror-first window shared by every cscli hub request of this service.
+	mirror *MirrorMemory
+	// mirrorTemplate caches the hub URL template of MirrorBaseURL, so cscli calls do not re-resolve it.
+	mirrorTemplate mirrorTemplateCache
 }
 
 // errHubURLUnparseable is the cause when net/url rejects a hub URL. The parser error quotes the whole input, which
@@ -205,6 +212,11 @@ func NewHubService(exec CommandExecutor, cache *HubCache, dataDir string) *HubSe
 		}
 	}
 
+	// Derived mirror configurations a crash left behind are removed before any request can use the directory.
+	if err := sweepMirrorLeftovers(dataDir); err != nil {
+		logger.Log().WithError(err).Warn("could not remove leftover hub mirror configurations")
+	}
+
 	return &HubService{
 		Exec:          exec,
 		Cache:         cache,
@@ -216,6 +228,7 @@ func NewHubService(exec CommandExecutor, cache *HubCache, dataDir string) *HubSe
 		ApplyTimeout:  applyTimeout,
 
 		HubUpdateTimeout: defaultHubUpdateTimeout,
+		mirror:           NewMirrorMemory(mirrorMemoryTTL, nil),
 	}
 }
 
@@ -294,15 +307,15 @@ func buildIndexURL(base string) string {
 	return strings.TrimRight(normalized, "/") + defaultHubIndexPath
 }
 
+// indexURLCandidates lists the index files to try for one hub base. A GitHub-hosted base has only its .index.json:
+// the api/index.json path that buildIndexURL would add there does not exist on those hosts.
 func indexURLCandidates(base string) []string {
 	normalized := normalizeHubBaseURL(base)
-	primary := buildIndexURL(normalized)
 	if strings.Contains(normalized, "github.io") || strings.Contains(normalized, "githubusercontent.com") {
-		mirrorIndex := strings.TrimRight(normalized, "/") + "/.index.json"
-		return uniqueStrings([]string{mirrorIndex, primary})
+		return []string{strings.TrimRight(normalized, "/") + "/.index.json"}
 	}
 
-	return []string{primary}
+	return []string{buildIndexURL(normalized)}
 }
 
 func uniqueStrings(values []string) []string {
@@ -322,25 +335,38 @@ func uniqueStrings(values []string) []string {
 // to the index cscli holds locally (`cscli hub list -a`), which lists every item but carries no download
 // URLs, so it serves listing only.
 func (s *HubService) FetchIndex(ctx context.Context) (HubIndex, error) {
-	idx, httpErr := s.fetchIndexHTTP(ctx)
+	// The walk and the local cscli listing share one overall deadline: the caller's own, or PullTimeout from now.
+	overall, cancel := overallContext(ctx, s.PullTimeout)
+	defer cancel()
+
+	idx, httpErr := s.fetchIndexHTTP(overall)
 	if httpErr == nil {
 		return idx, nil
 	}
-	if s.Exec == nil {
+	if s.Exec != nil {
+		cscliIdx, cscliErr := s.fetchIndexCSCLI(overall)
+		if cscliErr == nil {
+			logger.Log().WithError(httpErr).Debug("hub index unreachable, listing from the local cscli index")
+			cscliIdx.offline = true
+			return cscliIdx, nil
+		}
+		httpErr = fmt.Errorf("%w; cscli fallback failed: %v", httpErr, cscliErr)
+	}
+	// A caller that left, or whose own deadline ended the fetch, is not told that the hub is unreachable.
+	if errors.Is(ctx.Err(), context.Canceled) {
 		return HubIndex{}, httpErr
 	}
-	idx, cscliErr := s.fetchIndexCSCLI(ctx)
-	if cscliErr != nil {
-		failure := fmt.Errorf("%w; cscli fallback failed: %v", httpErr, cscliErr)
-		if ctx.Err() != nil {
-			return HubIndex{}, failure
-		}
-		// Neither the hub nor the local index answered; callers show a fixed message and the detail stays in the log.
-		return HubIndex{}, fmt.Errorf("%w: %w", ErrHubUnreachable, failure)
+	if _, callerDeadline := ctx.Deadline(); callerDeadline && ctx.Err() != nil {
+		return HubIndex{}, httpErr
 	}
-	logger.Log().WithError(httpErr).Debug("hub index unreachable, listing from the local cscli index")
-	idx.offline = true
-	return idx, nil
+	// Only a hub that never answered (every address failed at transport level or by timing out) is unreachable;
+	// an address that answered with an error keeps its own status.
+	var walkErr hubWalkError
+	if !errors.As(httpErr, &walkErr) || !walkErr.transportOnly {
+		return HubIndex{}, httpErr
+	}
+	// Neither the hub nor the local index answered; callers show a fixed message and the detail stays in the log.
+	return HubIndex{}, fmt.Errorf("%w: %w", ErrHubUnreachable, httpErr)
 }
 
 func (s *HubService) fetchIndexCSCLI(ctx context.Context) (HubIndex, error) {
@@ -517,16 +543,25 @@ func (s *HubService) fetchIndexHTTP(ctx context.Context) (HubIndex, error) {
 	}
 	targets = uniqueStrings(targets)
 	var errs []error
+	transportOnly := true
 
+	// The walk owns one overall deadline; each candidate gets its share of what is left of it, so a hanging
+	// address cannot use up the time the next address needs.
+	walkCtx, cancelWalk := walkContext(ctx, s.PullTimeout)
+	defer cancelWalk()
 	for attempt, target := range targets {
-		idx, err := s.fetchIndexHTTPFromURL(ctx, target)
+		attemptCtx, cancelAttempt := attemptContext(walkCtx, len(targets)-attempt)
+		idx, err := s.fetchIndexHTTPFromURL(attemptCtx, target)
+		cancelAttempt()
 		if err == nil {
 			logger.Log().WithField("hub_index", HubURLForLog(target)).WithField("fallback_used", attempt > 0).Info("hub index fetched")
 			return idx, nil
 		}
 		errs = append(errs, candidateError(target, err))
-		// A caller that cancelled or whose deadline passed has no use for the remaining candidates.
-		if ctx.Err() != nil {
+		var transportErr hubTransportError
+		transportOnly = transportOnly && errors.As(err, &transportErr)
+		// The walk's deadline or the caller's context ended: the remaining candidates have no time left.
+		if walkCtx.Err() != nil {
 			break
 		}
 		if e, ok := err.(interface{ CanFallback() bool }); ok && e.CanFallback() {
@@ -536,13 +571,23 @@ func (s *HubService) fetchIndexHTTP(ctx context.Context) (HubIndex, error) {
 		break
 	}
 
+	joined := errors.Join(errs...)
 	if len(errs) == 1 {
-		return HubIndex{}, fmt.Errorf("fetch hub index: %w", errs[0])
+		joined = errs[0]
 	}
+	return HubIndex{}, hubWalkError{err: fmt.Errorf("fetch hub index: %w", joined), transportOnly: transportOnly}
+}
 
-	return HubIndex{}, fmt.Errorf("fetch hub index: %w", errors.Join(errs...))
+// hubWalkError is the failure of the HTTP candidate walk. transportOnly is set when no candidate answered at all:
+// every failure was a transport failure, including an attempt that timed out.
+type hubWalkError struct {
+	err           error
+	transportOnly bool
 }
 
+func (h hubWalkError) Error() string { return h.err.Error() }
+func (h hubWalkError) Unwrap() error { return h.err }
+
 type hubHTTPError struct {
 	url        string
 	statusCode int
@@ -620,7 +665,8 @@ func (s *HubService) fetchIndexHTTPFromURL(ctx context.Context, target string) (
 	}
 	data, err := io.ReadAll(io.LimitReader(resp.Body, maxArchiveSize))
 	if err != nil {
-		return HubIndex{}, fmt.Errorf("read hub index: %w", err)
+		// A body that stalls past the attempt's share or breaks mid-way is a transport failure: the next address may answer.
+		return HubIndex{}, hubTransportError{url: target, inner: transportCause(err)}
 	}
 	ct := strings.ToLower(resp.Header.Get("Content-Type"))
 	if ct != "" && !strings.Contains(ct, "application/json") && !strings.Contains(ct, "text/plain") {
@@ -672,7 +718,7 @@ func (s *HubService) Pull(ctx context.Context, slug, itemType string) (PullResul
 		var err error
 		if cachedType, ok := s.freshCachedType(ctx, slug); ok {
 			itemType = cachedType
-		} else if idx, err = s.fetchIndexRecorded(pullCtx); err == nil {
+		} else if idx, err = s.fetchIndexRecorded(ctx); err == nil {
 			haveIndex = true
 			if itemType, err = resolveItemType(idx, slug); err != nil {
 				return PullResult{}, err
@@ -694,7 +740,7 @@ func (s *HubService) Pull(ctx context.Context, slug, itemType string) (PullResul
 	}
 
 	if !haveIndex {
-		if idx, err = s.fetchIndexRecorded(pullCtx); err != nil {
+		if idx, err = s.fetchIndexRecorded(ctx); err != nil {
 			return PullResult{}, err
 		}
 	}
diff --git a/backend/internal/crowdsec/hub_sync_test.go b/backend/internal/crowdsec/hub_sync_test.go
index 6283ef374..c2b180281 100644
--- a/backend/internal/crowdsec/hub_sync_test.go
+++ b/backend/internal/crowdsec/hub_sync_test.go
@@ -389,9 +389,7 @@ func TestIndexURLCandidates_GitHubMirror(t *testing.T) {
 	t.Parallel()
 
 	candidates := indexURLCandidates("https://raw.githubusercontent.com/crowdsecurity/hub/master")
-	require.Len(t, candidates, 2)
-	require.Contains(t, candidates, "https://raw.githubusercontent.com/crowdsecurity/hub/master/.index.json")
-	require.Contains(t, candidates, "https://raw.githubusercontent.com/crowdsecurity/hub/master/api/index.json")
+	require.Equal(t, []string{"https://raw.githubusercontent.com/crowdsecurity/hub/master/.index.json"}, candidates)
 }
 
 func TestHubHTTPErrorMethods(t *testing.T) {
diff --git a/backend/internal/crowdsec/hub_walk_test.go b/backend/internal/crowdsec/hub_walk_test.go
new file mode 100644
index 000000000..54be74644
--- /dev/null
+++ b/backend/internal/crowdsec/hub_walk_test.go
@@ -0,0 +1,140 @@
+package crowdsec
+
+import (
+	"context"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// stalledBody answers the headers of a response and then never sends the body, until the request's context ends.
+type stalledBody struct{ ctx context.Context }
+
+func (b stalledBody) Read([]byte) (int, error) {
+	<-b.ctx.Done()
+	return 0, b.ctx.Err()
+}
+
+func (stalledBody) Close() error { return nil }
+
+// The index walk keeps the cscli listing reserve back when it has room for it, and never runs past its parent.
+func TestWalkContextSetsAsideCSCLIReserve(t *testing.T) {
+	t.Parallel()
+
+	t.Run("no deadline uses the total less the reserve", func(t *testing.T) {
+		t.Parallel()
+		ctx, cancel := walkContext(context.Background(), 25*time.Second)
+		defer cancel()
+		require.InDelta(t, float64(23*time.Second), float64(remainingWithin(t, ctx)), float64(time.Second))
+	})
+
+	t.Run("zero total falls back to the default pull timeout", func(t *testing.T) {
+		t.Parallel()
+		ctx, cancel := walkContext(context.Background(), 0)
+		defer cancel()
+		require.InDelta(t, float64(defaultPullTimeout-cscliListReserve), float64(remainingWithin(t, ctx)), float64(time.Second))
+	})
+
+	t.Run("a caller deadline with room keeps the reserve", func(t *testing.T) {
+		t.Parallel()
+		parent, cancelParent := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancelParent()
+		ctx, cancel := walkContext(parent, time.Second)
+		defer cancel()
+		require.InDelta(t, float64(28*time.Second), float64(remainingWithin(t, ctx)), float64(time.Second))
+	})
+
+	t.Run("a caller deadline within two floors is the walk's limit", func(t *testing.T) {
+		t.Parallel()
+		parent, cancelParent := context.WithTimeout(context.Background(), 8*time.Second)
+		defer cancelParent()
+		ctx, cancel := walkContext(parent, time.Second)
+		defer cancel()
+		deadline, _ := ctx.Deadline()
+		parentDeadline, _ := parent.Deadline()
+		require.Equal(t, parentDeadline, deadline)
+	})
+}
+
+// A hub index walk whose address hangs gives the next address its share and falls through to it.
+func TestFetchIndexHangingFirstAddressFallsThroughToMirror(t *testing.T) {
+	t.Parallel()
+	svc, requested := pinHubService(t, false)
+	idx, err := svc.FetchIndex(context.Background())
+	require.NoError(t, err)
+	require.Contains(t, itemNames(idx), "crowdsecurity/demo")
+	require.Equal(t, []string{cdnIndexURL, rawIndexURL}, *requested)
+}
+
+// The caller's own deadline ends the walk, so the failure is not reported as the hub being unreachable.
+func TestFetchIndexCallerDeadlineIsNotWrappedAsUnreachable(t *testing.T) {
+	t.Parallel()
+	parent, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	svc := NewHubService(nil, nil, t.TempDir())
+	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(hangUntilDone)}
+
+	_, err := svc.FetchIndex(parent)
+	require.Error(t, err)
+	require.NotErrorIs(t, err, ErrHubUnreachable)
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+}
+
+// With no deadline on the caller, two hanging addresses end inside the walk budget as hub unreachable.
+func TestFetchIndexWithoutDeadlineStaysWithinPullTimeout(t *testing.T) {
+	t.Parallel()
+	svc := NewHubService(nil, nil, t.TempDir())
+	svc.PullTimeout = 600 * time.Millisecond
+	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(hangUntilDone)}
+
+	start := time.Now()
+	_, err := svc.FetchIndex(context.Background())
+	require.ErrorIs(t, err, ErrHubUnreachable)
+	require.Less(t, time.Since(start), svc.PullTimeout+time.Second, "the walk does not run to 1.5 times its budget")
+}
+
+// A body that stalls after the headers uses up the attempt's share, and that counts as a transport failure, so the
+// next address is tried.
+func TestFetchIndexStalledBodyFallsBackToMirror(t *testing.T) {
+	t.Parallel()
+	svc := NewHubService(nil, nil, t.TempDir())
+	svc.PullTimeout = 12 * time.Second
+	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
+		switch req.URL.String() {
+		case cdnIndexURL:
+			resp := newResponse(http.StatusOK, "")
+			resp.Header.Set("Content-Type", "application/json")
+			resp.Body = stalledBody{ctx: req.Context()}
+			return resp, nil
+		case rawIndexURL:
+			resp := newResponse(http.StatusOK, readCSCLIFixture(t, "hub_index_raw_sample.json"))
+			resp.Header.Set("Content-Type", "application/json")
+			return resp, nil
+		default:
+			return newResponse(http.StatusNotFound, ""), nil
+		}
+	})}
+
+	idx, err := svc.FetchIndex(context.Background())
+	require.NoError(t, err)
+	require.Contains(t, itemNames(idx), "crowdsecurity/sshd")
+}
+
+// The local cscli listing still runs after both addresses hang: the walk leaves it the reserve.
+func TestFetchIndexCSCLIListingAnswersAfterBothAddressesHang(t *testing.T) {
+	t.Parallel()
+	exec := &recordingExec{outputs: map[string][]byte{
+		"cscli hub list -a -o json": []byte(readCSCLIFixture(t, "hub_list_all.json")),
+	}}
+	svc := NewHubService(exec, nil, t.TempDir())
+	svc.PullTimeout = 12 * time.Second
+	svc.HTTPClient = &http.Client{Transport: roundTripperFunc(hangUntilDone)}
+
+	idx, err := svc.FetchIndex(context.Background())
+	require.NoError(t, err)
+	require.True(t, idx.Offline())
+	require.NotEmpty(t, idx.Items)
+	require.Contains(t, exec.calls, "cscli hub list -a -o json")
+}
diff --git a/backend/internal/crowdsec/secrets.go b/backend/internal/crowdsec/secrets.go
index 2e720066d..08515dc37 100644
--- a/backend/internal/crowdsec/secrets.go
+++ b/backend/internal/crowdsec/secrets.go
@@ -2,6 +2,7 @@ package crowdsec
 
 import (
 	"os"
+	"path"
 	"path/filepath"
 	"strings"
 )
@@ -49,9 +50,22 @@ func isSecretName(part string) bool {
 }
 
 // IsPreservedPath reports whether rel is server-local state that imports must neither remove, replace
-// nor take from an upload: engine-owned state and stored secrets.
+// nor take from an upload: engine-owned state, stored secrets and derived hub mirror configurations.
 func IsPreservedPath(rel string) bool {
-	return IsEngineOwnedPath(rel) || IsSecretPath(rel)
+	return IsEngineOwnedPath(rel) || IsSecretPath(rel) || IsHubMirrorConfig(rel)
+}
+
+// IsHubMirrorConfig reports whether rel names a derived cscli configuration made for a hub mirror retry, or its
+// local override copy. Such a file repeats the live engine settings, so it is never listed, read, exported or
+// imported. Only the two places a live configuration can sit are matched: directly under DataDir or under
+// config/. Matching is case-insensitive.
+func IsHubMirrorConfig(rel string) bool {
+	slash := strings.ToLower(path.Clean(filepath.ToSlash(rel)))
+	dir := path.Dir(slash)
+	if dir != "." && dir != "config" {
+		return false
+	}
+	return isMirrorConfigName(path.Base(slash))
 }
 
 // FindConfigFile returns the CrowdSec config file below dataDir: config/config.yaml when it exists,
diff --git a/backend/internal/crowdsec/secrets_test.go b/backend/internal/crowdsec/secrets_test.go
index 90970abe8..5ba1995c2 100644
--- a/backend/internal/crowdsec/secrets_test.go
+++ b/backend/internal/crowdsec/secrets_test.go
@@ -1,6 +1,8 @@
 package crowdsec
 
 import (
+	"bytes"
+	"context"
 	"os"
 	"path/filepath"
 	"testing"
@@ -159,3 +161,68 @@ func TestRestoreKeepingLeavesLiveSecretsAlone(t *testing.T) {
 		require.Equal(t, "live-key", readFile(t, filepath.Join(dir, "bouncer_key")))
 	})
 }
+
+func TestIsHubMirrorConfig(t *testing.T) {
+	t.Parallel()
+	cases := map[string]bool{
+		".charon-hub-mirror-abc.yaml":              true,
+		".charon-hub-mirror-abc.yaml.local":        true,
+		"config/.charon-hub-mirror-abc.yaml":       true,
+		"config/.charon-hub-mirror-abc.yaml.local": true,
+		"./.charon-hub-mirror-abc.yaml":            true,
+		"CONFIG/.Charon-Hub-Mirror-ABC.YAML":       true,
+		".CHARON-HUB-MIRROR-ABC.YAML.LOCAL":        true,
+		`config\.charon-hub-mirror-abc.yaml`:       filepath.Separator == '\\',
+		"config.yaml":                              false,
+		"config/config.yaml":                       false,
+		"config/config.yaml.local":                 false,
+		"charon-hub-mirror-abc.yaml":               false,
+		".charon-hub-mirror-abc.txt":               false,
+		".charon-hub-mirror-abc.yaml.bak":          false,
+		"sub/.charon-hub-mirror-abc.yaml":          false,
+		"config/sub/.charon-hub-mirror-abc.yaml":   false,
+		"data/.charon-hub-mirror-abc.yaml":         false,
+		"xcharon-hub-mirror-abc.yaml":              false,
+		"":                                         false,
+		".":                                        false,
+	}
+	for rel, want := range cases {
+		require.Equal(t, want, IsHubMirrorConfig(rel), rel)
+	}
+}
+
+func TestHubMirrorConfigIsPreservedAndExcluded(t *testing.T) {
+	t.Parallel()
+	dataDir := t.TempDir()
+	for _, rel := range []string{
+		".charon-hub-mirror-abc.yaml",
+		".charon-hub-mirror-abc.yaml.local",
+		"config/.charon-hub-mirror-abc.yaml",
+		"config/.charon-hub-mirror-abc.yaml.local",
+	} {
+		require.True(t, IsPreservedPath(rel), "preserved %s", rel)
+		require.True(t, IsExportExcluded(rel), "export excludes %s", rel)
+		require.True(t, ImportKeeper(dataDir)(rel), "import keeps %s", rel)
+	}
+	require.False(t, IsPreservedPath("config/config.yaml"))
+	require.False(t, IsExportExcluded("config/config.yaml"))
+	require.False(t, ImportKeeper(dataDir)("config/config.yaml"))
+}
+
+func TestHubMirrorLeftoverIsLeftOutOfExportArchive(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	writeExportTree(t, dir, map[string]string{
+		"config/config.yaml":                       "common: {}\n",
+		"config/.charon-hub-mirror-abc.yaml":       "cscli:\n  password: s3cret\n",
+		"config/.charon-hub-mirror-abc.yaml.local": "cscli: {}\n",
+		".charon-hub-mirror-def.yaml":              "cscli:\n  password: s3cret\n",
+		"config/acquis.yaml":                       "source: file\n",
+	})
+
+	var buf bytes.Buffer
+	_, omitted, err := WriteExportArchive(context.Background(), dir, &buf)
+	require.NoError(t, err)
+	require.Equal(t, []string{"config/acquis.yaml", "config/config.yaml"}, exportNames(t, buf.Bytes()))
+	require.NotContains(t, omitted, "config/.charon-hub-mirror-abc.yaml")
+}
diff --git a/configs/crowdsec/install_hub_items.sh b/configs/crowdsec/install_hub_items.sh
index 5784524cc..5135d0b87 100644
--- a/configs/crowdsec/install_hub_items.sh
+++ b/configs/crowdsec/install_hub_items.sh
@@ -5,6 +5,20 @@
 
 set -e
 
+# Mirror-aware cscli_hub (shared with the entrypoint). When the helper is missing, installs run once each under a
+# plain timeout, so an older image still installs.
+CSCLI_HUB_MIRROR_HELPER=/usr/local/lib/charon/cscli-hub-mirror.sh
+if [ -r "$CSCLI_HUB_MIRROR_HELPER" ]; then
+    # shellcheck source=/dev/null
+    . "$CSCLI_HUB_MIRROR_HELPER"
+else
+    cscli_hub() {
+        _budget=$1
+        shift
+        timeout "$_budget" cscli "$@"
+    }
+fi
+
 echo "Installing CrowdSec hub items for Charon..."
 
 # Hub index update is handled by the entrypoint before this script is called.
@@ -28,7 +42,7 @@ install_if_missing() {
         echo "  ✓ ${label} already installed, skipping"
     else
         echo "  Installing ${label}..."
-        cscli "${type}" install "${name}" || echo "⚠️ Failed to install ${name}"
+        cscli_hub 60 "${type}" install "${name}" || echo "⚠️ Failed to install ${name}"
     fi
 }
 
diff --git a/docs/development/cscli-contract.md b/docs/development/cscli-contract.md
index 9d4c9b4d0..44ecb3296 100644
--- a/docs/development/cscli-contract.md
+++ b/docs/development/cscli-contract.md
@@ -48,6 +48,7 @@ Every `cscli` call, including hub `inspect`, verify and the startup bouncer comm
 | `cscli <type> inspect <name> -o json` | Parsed for the item's state. `path` is the item's own file relative to the hub directory (for example `collections/crowdsecurity/nginx.yaml`) and is what a preset apply saves before an in-place upgrade; `local_path` is the installed link in the configuration and is only a fallback. |
 | `cscli <type> install <name>` | Exit status. **`cscli hub install` does not exist**; items are installed per type (`collections`, `parsers`, ...). |
 | `cscli <type> upgrade <name>` | Exit status. |
+| `cscli -c <derived> ...` with `cscli.__hub_url_template__` set (hidden test hook; used for the hub mirror retry) | Charon runs the hub commands above a second time under a derived copy of the configuration when the hub address fails. Verified on cscli 1.8.2 only; re-check on every CrowdSec bump. A cscli that ignores the key repeats the request on the main hub address, and Charon reports both failures. |
 
 Not every path in the table is fixture-covered (see the recordings below); the fixtures
 are the authority for what each covered command prints.
diff --git a/docs/features/crowdsec.md b/docs/features/crowdsec.md
index 8b5ce4476..d10ce52cd 100644
--- a/docs/features/crowdsec.md
+++ b/docs/features/crowdsec.md
@@ -76,6 +76,8 @@ Access pre-built security configurations from the CrowdSec Hub:
 
 Hub presets are installed in two steps. First click **Pull** to download and preview the preset (a pulled preview can be shown again without downloading it again, and pulling a preset without picking a section reuses a recently fetched hub list for 10 minutes when only one section is saved on the server). Then click **Apply** to install exactly what you previewed, using the `cscli` tool that ships with Charon (it also installs anything the preset depends on). If the preview has gone out of date, Charon asks you to pull the preset again. Most installs finish in a few seconds. Large presets install in the background (see below) with a 30 minute limit; a quick install that does not finish within 120 seconds is stopped, rolled back, and your preview is kept. You can apply an already-downloaded preview without internet access if its items are already on the server; otherwise the apply fails and is rolled back, and pulling a preset you never downloaded needs internet access. If a name exists in more than one hub section (for example a parser and a collection with the same name), Charon asks you to choose which one you mean. If the hub cannot be reached, nothing is installed and Charon says so. Charon also checks each downloaded item against the hub's index to catch incomplete or inconsistent updates before keeping it; if an item does not match, Charon refuses it and asks you to try again later. See [CrowdSec troubleshooting](../troubleshooting/crowdsec.md#hub-preset-messages) if you see a message.
 
+If CrowdSec's main hub address is down, Charon tries a GitHub copy of the same hub, both when it loads the preset list and when it downloads or installs a preset, so a short outage at the main address often goes unnoticed. If the hub list still cannot be loaded, the presets page shows a quiet note saying that only built-in and downloaded presets are shown. Hub presets you have not downloaded yet appear greyed out and cannot be selected until the hub is reachable again. Presets you have already downloaded keep working. For details, see [When the CrowdSec hub cannot be reached](../troubleshooting/crowdsec.md#when-the-crowdsec-hub-cannot-be-reached).
+
 Popular presets include:
 
 - **HTTP Probing** — Detect reconnaissance and scanning
diff --git a/docs/reports/qa_report.md b/docs/reports/qa_report.md
index d0f2e6c79..b66a0f718 100644
--- a/docs/reports/qa_report.md
+++ b/docs/reports/qa_report.md
@@ -1,83 +1,126 @@
-# QA Report: CrowdSec Start, Reload and Import Readiness
+# QA Report: CrowdSec Hub Outage Fallback
 
-- Branch: `fix/crowdsec-wait-for-start`, audited at HEAD `2bba3480` (9 CrowdSec commits, patch-identical to the earlier `c2d660d2` tip; the branch was rebased onto the current `origin/development` during the run, which added 6 unrelated base commits: CI pins, i18n languages, agent file names).
+- Branch: `fix/crowdsec-hub-mirror-fallback`. Re-verified at HEAD `85334c334` (11 commits ahead of `origin/development`). The first audit ran at `e3310bfcc`; this pass re-checks the findings it raised.
 - Date: 2026-10-31
-- Scope: starting the CrowdSec engine, waiting for it to be ready before reloads, keeping the whitelist file present, and checking an imported configuration before it is used.
+- Scope: behaviour when the CrowdSec hub CDN is slow, refused or unreachable. Covers the bounded time for the hub index fetch, the mirror retry for cscli hub operations (API and startup), the mirror-first memory, the `hub_offline` indicator on the presets list, and the matching UI note.
 - Working tree: nothing committed, staged, stashed or pushed by QA. This report is the only file QA wrote.
-- **Verdict: READY, with three conditions** (see the end of this report).
+- **Verdict: READY.** QA-1 and QA-4 are verified fixed at HEAD. QA-3 (the real-cscli contract fixture) was fixed afterwards by removing the unknown `hub_dir` key from the fixture's `cscli` section, a change that had already passed in the container as a scratch copy. QA-2 is amended to a tracked, out-of-scope behaviour (#1796). The coverage and build gates (rows 2-5) were last run at `e3310bfcc`; later changes touched only the shell helper, test files and log wording, and CI repeats the full gates on this PR.
 
 ## Gate Summary
 
-| # | Gate | Result | Numbers |
+Rows marked "re-run" were executed at HEAD `85334c334` in this pass. Rows marked "last run" were executed at `e3310bfcc` and have not been repeated, because the code changed since (`fa3b0aa8f`, `85334c334`). Coverage (rows 2-4) must be re-run before merge.
+
+| # | Gate | Result | Numbers and notes |
 | --- | --- | --- | --- |
-| 1 | `cd backend && go build ./...` | PASS | clean |
-| 2 | Backend coverage (`scripts/go-test-coverage.sh`, gate 87%) | PASS (see Notes) | line coverage 91.85% (42258 of 46007); statements 93.0% |
-| 3 | Frontend coverage (`scripts/frontend-test-coverage.sh`, gate 85%) | PASS (see Notes) | lines 91.10% (8421 of 9243); statements 90.09%; branches 84.19%; functions 87.16% |
-| 4 | Local patch coverage (`scripts/local-patch-report.sh`) | PASS | overall 94.0% (313 of 333 changed lines); backend 94.0% (311 of 331); frontend 100% (2 of 2) |
-| 5 | `npm run type-check` | PASS | clean |
-| 6 | `npm run build` | PASS | clean |
-| 7 | `npm run lint` | PASS | 0 errors, 1359 warnings (existing backlog) |
-| 8 | `make lint-fast` (staticcheck, govet, errcheck, ineffassign, unused) | PASS | 0 issues (backend and agent) |
-| 9 | `lefthook run pre-commit` | PASS (no-op) | no files were staged, so every hook skipped; the fast linters were run directly in row 8 |
-| 10 | GORM security scan | NOT REQUIRED | no file under `backend/internal/models/` or any migration changed |
-| 11 | Playwright `tests/security/crowdsec-import.spec.ts` and `tests/security/crowdsec-first-enable.spec.ts` (`--project=security-tests`) | PASS | 62 of 62 on the final build |
-| 12 | Playwright `tests/crowdsec-whitelist.spec.ts` (`--project=firefox`) | PASS | 12 of 12 on the final build |
-| 13 | CodeQL and Trivy | DEFERRED TO CI | the commits are `fix:`, `test:` and `docs:`; no new feature commit; CI runs both on the PR |
+| 1 | Container image rebuilt from HEAD (`docker-rebuild-e2e`, no `--clean`) | PASS (re-run) | Built and healthy; `backend/internal/changelog/data/changelog.json` restored with `git checkout` afterwards |
+| 2 | Backend coverage (`scripts/go-test-coverage.sh`, gate 87%) | last run | At `e3310bfcc`: line 92.5%, statements 93.5%. Re-run required at HEAD |
+| 3 | Frontend coverage (`scripts/frontend-test-coverage.sh`, gate 85%) | last run | At `e3310bfcc`: lines 91.85%, statements 90.85%, branches 85.06%, functions 88.3%. Re-run required at HEAD |
+| 4 | Local patch coverage (`scripts/local-patch-report.sh`) | last run | At `e3310bfcc`: overall 98.7%. Re-run required at HEAD |
+| 5 | `npm run type-check`, `npm run build`, `go build ./...` | last run | Clean at `e3310bfcc`. Re-run required at HEAD |
+| 6 | `make lint-fast` (staticcheck, govet, errcheck, ineffassign, unused) | PASS (re-run) | 0 issues (backend and agent) |
+| 7 | shellcheck (`.docker/cscli-hub-mirror.sh`, `.docker/docker-entrypoint.sh`, `configs/crowdsec/install_hub_items.sh`, `scripts/cscli_hub_mirror_test.sh`) | PASS (re-run) | clean |
+| 8 | `scripts/cscli_hub_mirror_test.sh` under bash, dash and busybox sh | PASS (re-run) | 118 passed, 0 failed under each shell (109 at `e3310bfcc`; the new case covers the `terminated signal received` exit shape, QA-1) |
+| 9 | `go test -race -count=1 ./internal/crowdsec/` | PASS (re-run) | `ok` |
+| 10 | `go test -race -count=1 -run 'Hub\|Preset\|Mirror' ./internal/api/handlers/` | PASS (re-run) | `ok` |
+| 11 | Real-cscli contract test `TestCSCLIContractAcceptsMirrorConfig` (cscli 1.8.2, inside the container) | FIXED | Failed at `85334c334` because `cscli.hub_dir` is an unknown key for cscli 1.8.2; the key was removed from the fixture (see QA-3). Passed in the container as a scratch copy |
+| 12 | `hadolint` (`Dockerfile`) | last run | 9 pre-existing findings, the same rule codes as on `origin/development` (O-2) |
+| 13 | GORM security scan | NOT REQUIRED | no file under `backend/internal/models/` and no migration changed |
+| 14 | Playwright `tests/security/crowdsec-hub-offline.spec.ts`, `crowdsec-ui-states`, `crowdsec-import`, `crowdsec-first-enable`, `crowdsec-diagnostics`, `crowdsec-export-redaction` (`--project=security-tests`) | PASS (re-run) | 107 passed, against the image rebuilt at HEAD |
+| 15 | Playwright `tests/crowdsec-whitelist.spec.ts` (`--project=firefox`) | PASS (re-run) | 12 of 12 |
+| 16 | CodeQL and Trivy | DEFERRED TO CI | `fix:`, `test:` and `docs:` commits only; CI runs both on the PR |
 
 ## Container Gate
 
-Throwaway containers built from the locally built `charon:local` image, with their own volumes, published on high loopback ports only, and deleted afterwards. The live development container was not touched.
+Method: throwaway containers from the locally built `charon:local` image, rebuilt from HEAD for this pass. A netshoot holder container owns the network namespace, and the Charon container joins it. The holder carries the packet rules, so the rules survive Charon restarts. The Docker daemon was the rootless one. No host port was published, no Docker socket was mounted, and the live `charon` container was not touched. Rules were added to the hub CDN and mirror addresses resolved at run time, and removed by the holder's own state file. All QA containers and volumes were deleted by exact name at the end. The standard `charon-e2e` container from the rebuild skill was left running for the Playwright suites.
+
+Hub hosts: the CDN (`cdn-hub.crowdsec.net`) and the GitHub mirror (`raw.githubusercontent.com`). "Refused" means `REJECT` with TCP reset; "hung" means `DROP`.
 
-| Gate | Scenario | Repetitions | Result |
+| Case | What was run | Observed | Result |
 | --- | --- | --- | --- |
-| (a) | Whitelist add at 0.1, 0.5, 1.0, 1.5, 2.0, 2.5 and 3.0 s after Start | 3 each (21 runs) | 21 of 21: engine alive, the add was accepted, the reload was delivered after readiness (`Reload is finished` after the add), the entry was written, no fatal line |
-| (b) | Port 8085 occupied inside the container, then Start | 3 | 3 of 3: HTTP 500 `crowdsec_engine_exited` in about 1.2 s; the engine logged a bind failure on the occupied port |
-| (b2) | Two concurrent Starts | 3 | 3 of 3: one engine process; one request answered 200, the other 409 `crowdsec_busy` |
-| (b2) | Start then Stop 50 ms later | 3 | 3 of 3: Stop answered 200; no engine process left |
-| (c) | Placeholder whitelist file (events parsed, real entry matches, sibling file ignored) | 1 pass | Placeholder present and listed; `cscli explain` on a public test address showed `parser success` with the managed whitelist unchanged; a real entry matched after add, delete (empty) and re-add; the temporary sibling file was not loaded |
-| (c) | Managed-file guard | 1 | the canonical managed path answered 400 `file_managed_by_charon` on write and was readable |
-| (c) | 45 s stress: 8 adds and 8 deletes (16 mutations) | 1 | 41 s elapsed; 9 engine reloads delivered (the reloader coalesced the rest); engine alive at the end; placeholder present; no fatal line |
-| (d) | Import of an archive exported by a real Charon container | 1 | HTTP 200 `imported`; engine still running |
-| (d) | Stock CrowdSec layout (absolute `/etc/crowdsec` paths, missing nginx log file, journald source) | 1 | direct `crowdsec -t` exit 0; import HTTP 200 (engine logged the missing source as an error but the configuration check passed) |
-| (d) | Archive without `config_paths` | 1 | HTTP 422 `config validation failed: config.yaml has no config_paths section`; live configuration byte-identical (checksum) |
-| (d) | Archive with a broken `config_dir` | 1 | HTTP 422 `import_config_invalid`; live configuration byte-identical (checksum) |
-| (d) | `crowdsec -t` while an engine runs | 1 | exit 0 on the live configuration |
-| (e) | Decision ban against a created proxy host | 1 | baseline 200; after `ban` the proxy answered 403 in about 54 s (bouncer poll interval); after `unban` the proxy answered 200 within the next poll cycle (about 60 s) |
-| (e) | T2 refuse-at-once (async non-curated preset apply while a hub restore holds the data lock) | 0 | NOT EXECUTED; see Findings F6 |
-| (f) | Two SIGHUPs 0.2 s apart | 3 | 3 of 3: both signals received and each reload finished (roughly 3 s each, run one after the other); engine alive; no fatal line |
-
-### Output samples for the environmental-error pattern
-
-Captured from the engine log when the port was occupied (matched by the `environmentalEngineOutput` pattern):
-
-```
-level=fatal msg="local API server stopped with error: listening on 127.0.0.1:8085: listen tcp 127.0.0.1:8085: bind: address already in use"
-```
-
-`crowdsec -t` never reported a port or database-lock error in these runs (it exited 0 while the engine was running). A missing notification plugin did not reproduce under `-t` either (the engine loads plugins at start, not during the check). The database-lock and plugin texts are therefore not yet pinned by a captured sample.
+| (e) entrypoint startup, CDN hung, mirror reachable | 3 fresh starts with a new volume | Healthy after 41.2 s, 40.8 s and 41.5 s. The first `cscli hub update` ran its 30 s budget, failed with `terminated signal received`, and the log then shows `cscli hub update did not complete on the CDN; retrying through the hub mirror.` The retry downloaded the index and startup continued. No `.charon-hub-mirror-*` file remained. | PASS (QA-1 verified fixed) |
+| (e) entrypoint startup, CDN refused | 1 fresh start | Healthy after 10.7 s. The connect was refused at once, the mirror retry ran, and the install step followed. No derived file remained. | PASS |
+| (e) entrypoint startup, both hosts refused | 1 fresh start | Healthy after 5.3 s. Both attempts failed at once, then `Hub index update failed (network issue?)`; startup continued. No derived file remained. | PASS (bounded) |
+| (e) entrypoint startup, both hosts hung | 1 fresh start (no cached index, new volume) | Healthy after 66.6 s: two 30 s hub attempts, then the item installs failed fast on the missing index, as designed. No derived file remained. | PASS (bounded) |
+| (e) missing item installed under a hung CDN | One scenario removed from a running container (`http-sqli-probing`), container stopped, CDN hung, container started | The hub update fell back to the mirror after 30 s. The install of the missing scenario ran in about 0.3 s (17:35:57.3 to 17:35:57.6 in the container log) with no CDN connect delay, so it used the mirror-first window. The item was installed afterwards. No derived file remained. The 60 s install bound was not reached. | PASS (mirror-first install observed) |
+| (a) CDN refused, API list, pull and apply | 3 repetitions | List 0.09-0.37 s with `hub_offline` false. Pulls 0.17-0.21 s. Apply completed after the mirror answered the hub update. | PASS (last run at `e3310bfcc`) |
+| (b) CDN hung, API list, pull | 3 repetitions | List 5.07-5.09 s; pulls 5.18-5.27 s, inside the 25 s pull budget. | PASS (last run at `e3310bfcc`) |
+| (c) cscli through the derived config | Apply with CDN refused; apply with CDN hung in mirror-first; restore with both hung | Derived config used and removed; mirror-first apply 0.98-1.1 s; derived file excluded from the file list and export (0 entries). | PASS (last run at `e3310bfcc`) |
+| (d) CDN and mirror both down, API | Presets list, uncached pull, restore with a second restore, whitelist write and preset apply during the restore | List answered in 10.16 s with `hub_offline` true; pull returned 503 `hub_unreachable` in 10.16 s. Second restore returned 409 in 1.8 ms (`a restore is already running`, no `error_code`). Whitelist write 201. Preset apply during the restore waited and returned 200 after 76.7 s. | PASS-with-note (QA-2, tracked as #1796) |
+| (f) operator-set `__hub_url_template__` | Key in `config.yaml` and in `config.yaml.local`; restart with the CDN refused; API apply | Startup logged `Hub mirror retry unavailable (the cscli config could not be prepared)`, no retry, no derived file. The `.local` variant logged the local-override decline, made no retry and left no derived file. The `config.yaml` variant was checked at startup only. | PASS (last run at `e3310bfcc`) |
+| (QA-4) retry log wording, API | Live-first: CDN hung, first preset pull and apply. Mirror-first: CDN restored, mirror hung, second apply. | Live-first: `cscli hub request failed on the live hub address; retrying on the hub mirror`, followed by `cscli hub request answered by the hub mirror`. Mirror-first: `cscli hub request failed on the hub mirror; retrying on the live hub address`, followed by `answered by the live hub address; mirror-first window cleared`. Both wordings match the cause. | PASS (QA-4 verified fixed) |
+| Real cscli contract (QA-3) | `cscli_mirror_contract_test.go` built as a static test binary and run in the container with cscli 1.8.2 | `exec: cscli -c <derived> version` fails: `field hub_dir not found in type csconfig.CscliCfg`. The `config_paths` fix from the earlier run is in place; the new failure is the `hub_dir` key in the `cscli` section of the fixture. | FAIL (QA-3) |
+
+Other observations from the container runs:
+
+- A refused CDN never makes the presets list or a pull slow (about 0.1-0.4 s). A hung CDN costs about 5 s per call.
+- The export logs one warning per symlinked config entry (O-1).
+- The restore returned 502 `msgRestoreHubDown` at 60.0 s in every both-down run at `e3310bfcc`.
 
 ## Findings
 
-| ID | Severity | Summary | Status |
+Severity follows the public scale (critical, high, medium, low). "Blocking" means the finding must be fixed in this PR under the Definition of Done.
+
+| ID | Severity | Status | Title |
 | --- | --- | --- | --- |
-| F1 | Low | The scope of the managed-file guard in the CrowdSec file editor is narrower than intended. The engine does not read the affected location, so runtime behaviour is unaffected. | Hardening item; tracked privately. Details withheld from this public report. |
-| F2 | Info | The stock CrowdSec layout passes `crowdsec -t`. The hard refusal on the engine's own non-zero exit therefore does not block stock archives in this test. | Result, not a defect. Informs the decision to keep the hard refusal. |
-| F3 | Low | Under rapid whitelist changes the reloader coalesces reloads: 16 mutations in 41 s produced 9 engine reloads. The final engine state matched the last mutation. | Expected behaviour of the coalescing design; the test expectation of one reload per mutation does not hold. Document in the troubleshooting page if it matters to operators. |
-| F4 | Low | A truly concurrent second Start is answered 409 `crowdsec_busy`, not with the existing process as a 200. Only one engine is ever started. A sequential second Start still answers 200 `already_running`. | Safe. Confirm this is the intended contract; the UI should show the busy text. |
-| F5 | Low | Gate (b) checks that the security module setting is unchanged after the failed Start, but the setting was already disabled before the test, so the revert was not exercised. | Test gap. Re-run with the module enabled before the occupied-port Start. |
-| F6 | Medium (test gap) | T2 (refuse at once instead of waiting behind a hub update) was not executed. Reproducing it needs an in-flight hub restore that holds the data lock, and the throwaway container has no outbound hub access. | Carry to a follow-up test in an environment with hub access. Not a regression finding for this branch. |
-| F7 | Info | The database-lock and missing-plugin output samples were not reproduced with `crowdsec -t`. The pattern covers them, but only the bind-failure sample is pinned. | Capture samples when a reproducer is available. |
-| F8 | Info | One test file of the 312 in the frontend suite did not appear in the chunked run's file count (311 reported). The full suite was not run as one process in this session. | Re-check with the CI frontend job. |
-
-## Notes on the Gate Runs
-
-- The backend and frontend gate scripts run longer than the ten-minute limit of the QA session. The same measurements were produced by running the same packages and the same test files in chunks, merging the profiles with the same exclusions, and applying the script's line-coverage calculation. The numbers above are from those merged profiles. CI runs the scripts unchanged.
-- The frontend profile was merged with the same istanbul libraries used by the test runner. The totals are the coverage summary totals.
-- The Gotify test fixtures in the frontend notification tests use placeholder strings. No real token appeared in test artifacts, logs or screenshots.
-- No Gotify token or other secret was written to this report.
-
-## Conditions for Merge
-
-1. Re-run gate (e) T2 in an environment with hub access (F6), or record the accepted gap in the PR.
-2. Review and fix the managed-file scope item F1 through the private process; it does not block the functional change.
-3. CodeQL and Trivy results from CI must be clean before merge (deferred locally, per the project rule for `fix:`, `test:` and `docs:` commits).
+| QA-1 | Medium | Verified fixed | Startup mirror retry did not run when the hub CDN hung |
+| QA-2 | Medium | Amended: PASS-with-note, tracked as #1796 | A conflicting preset apply waits for an in-flight restore instead of refusing at once |
+| QA-3 | Low (test defect) | Fixed in this PR | The real-cscli contract test fails when cscli is installed |
+| QA-4 | Low | Verified fixed | Retry warnings named the wrong hub address and printed before a declined retry |
+| QA-5 | Info | Open (documentation) | Observed budgets differ from the change's design notes |
+| QA-6 | Info | Accepted, may improve | The presets list spends one CDN connect attempt per call while the outage lasts |
+
+### QA-1: Startup mirror retry did not run when the hub CDN hung (Medium, verified fixed)
+
+- **Where.** `.docker/cscli-hub-mirror.sh` (`_hub_retry_wanted`, `_hub_network_failure`), called from `cscli_hub` for `hub update` in `.docker/docker-entrypoint.sh`.
+- **Original cause.** The retry rule treated an attempt as timed out only on exit status 124 or 143, or on a network-error marker. cscli exits with status 1 and the text `terminated signal received` when its budget runs out, which matched neither rule.
+- **Verification at HEAD.** Three fresh hung-CDN starts each logged the retry line and became healthy at about 41 s. The derived file was absent afterwards. The shell test has the new case, and it passes under bash, dash and busybox sh.
+
+### QA-2: A conflicting preset apply waits for an in-flight restore instead of refusing at once (Medium, amended, tracked as #1796)
+
+- **Where.** `backend/internal/api/handlers/crowdsec_handler.go` `holdUnlessBusy` and `backend/internal/crowdsec/apply_jobs.go` `Hold`; the restore handler in `crowdsec_hub_items.go`.
+- **Evidence.** With both hosts hung, a restore was in flight. A preset apply returned 200 after 76.7 s, so it waited for the restore. A second restore returned 409 at once, but the response has no `error_code`.
+- **Decision.** The waiting behaviour is existing behaviour and is out of scope for this change. It is tracked as #1796, which also covers the missing `error_code` on the restore-versus-restore 409. The acceptance criterion for this change is amended to match. Both behaviours stay within their time bounds.
+- **Gate row (d)** is therefore PASS-with-note.
+
+### QA-3: The real-cscli contract test fails when cscli is installed (Low, test defect, fixed)
+
+- **Where.** `backend/internal/crowdsec/cscli_mirror_contract_test.go`, `contractLiveConfig` (the fixture written by `writeCSCLIConfig`, whose `cscli` section is `{hub_branch: master, hub_dir: <path>}`).
+- **Evidence.** Inside the container with cscli 1.8.2, the derived configuration is rejected: `line 11: field hub_dir not found in type csconfig.CscliCfg`. The earlier `no configuration paths provided` error is fixed; the `config_paths` block is now present. A hand-written configuration with `config_paths` and `cscli: {hub_branch: master}` is accepted (exit 0).
+- **Validation.** In a scratch copy outside the repository, the `"hub_dir"` entry was removed from the `cscli` map in the fixture. The test then passed in the container: `--- PASS: TestCSCLIContractAcceptsMirrorConfig`.
+- **Impact.** The test skips on hosts without cscli, so it passes in those environments and hides the defect. Where cscli is installed it fails.
+- **Remediation (done).** Removed `hub_dir` from the `cscli` section of the fixture (kept in `config_paths`). The fixture still parses on every host; the cscli run itself skips on hosts without cscli.
+
+### QA-4: Retry warnings named the wrong hub address and printed before a declined retry (Low, verified fixed)
+
+- **Where.** `backend/internal/crowdsec/cscli_run.go` `logHubRetry`, `logMirrorUnavailable`.
+- **Verification at HEAD.** The wording is built from the address that failed (live-first and mirror-first both observed in the container logs). The retry line is logged only once the retry is certain to run; a declined retry logs `hub mirror retry unavailable` alone. The shell helper's live-first line names the failed command and the mirror.
+
+### QA-5: Observed budgets differ from the change's design notes (Info, open)
+
+- The restore's hub update budget is 60 s (`hubRestoreUpdateTimeout`, `crowdsec_hub_items.go:39`). The design notes state 20 s.
+- A hung CDN connect fails after about 5 s (the dial timeout), not after the roughly 11 s per-attempt share the notes describe. The bounds still hold with a wide margin.
+- Remediation: correct the design notes, or the constant, so both agree.
+
+### QA-6: The presets list spends one CDN connect attempt per call while the outage lasts (Info, accepted)
+
+- While the cscli mirror-first window is open, the HTTP index walk still tries the CDN first on every list call, costing about 5 s per call under a hang (about 10 s when both hosts are down). This is inside every bound measured. Optionally, reorder the walk to try the mirror first while the window is open, or record the trade-off in the commit body.
+
+## Out-of-scope findings (for filing)
+
+| ID | Severity | Summary | Evidence and suggested approach |
+| --- | --- | --- | --- |
+| #1796 | Tracked (existing issue) | A preset apply during an in-flight hub restore waits for the restore; restore-versus-restore returns 409 without an `error_code`. | Already tracked. Not blocking under the amended criterion (QA-2). |
+| O-1 | Low | The export logs one warning per symlinked config entry, so one export writes dozens of warning lines. | Seen on every export in the container (`skipping non-regular entry config/... during export`). The export code is not in this branch's diff. Suggested: log once per export with a count, or downgrade to debug. |
+| O-2 | Low | The Dockerfile has 9 hadolint findings (DL3003, DL3025, DL3066, DL3067, DL4006, SC2012). | Present on `origin/development` too; not introduced here. Suggested: a hygiene pass on the Dockerfile. |
+| O-3 | Info | The frontend branch coverage (85.06% at `e3310bfcc`) is close to the 85% floor, although the gate passes on lines and statements. | Watch on future frontend changes; re-measure at HEAD before merge. |
+
+## Verdict
+
+**READY**.
+
+- **Fixed in this PR:** QA-3 (contract fixture), QA-1, QA-4.
+- **Left to CI:** the coverage, patch coverage, build, type-check and hadolint gates re-run on the PR (last measured at `e3310bfcc`: backend 92.5% lines, frontend 91.85% lines, patch 98.7%).
+- **Verified fixed:** QA-1 (startup mirror retry on a hung CDN, including the derived-file cleanup), QA-4 (retry wording for live-first and mirror-first).
+- **Amended:** QA-2 (PASS-with-note, tracked as #1796).
+- **Open (documentation):** QA-5 (design notes versus the 60 s restore budget).
+- **Verified and working:** CDN refusal and hang for the presets list and pulls, startup under refused, hung and both-down hub hosts (all bounded), the mirror-first install under a hung CDN, the three shell interpreters, the race-enabled crowdsec and handler suites, and the security and firefox Playwright suites.
diff --git a/docs/troubleshooting/crowdsec.md b/docs/troubleshooting/crowdsec.md
index d72e312f6..305eecc80 100644
--- a/docs/troubleshooting/crowdsec.md
+++ b/docs/troubleshooting/crowdsec.md
@@ -195,7 +195,7 @@ charon-local-machine     127.0.0.1      password     v1.x.x
 
 ## Common issues
 
-- Hub unreachable (503, `hub_unreachable`): retry once, then Charon falls back to cached Hub data if available; otherwise stay on curated/offline presets until connectivity returns. The same answer is given when a pull needs to download a preset that is not cached and the hub cannot be reached, and when an apply cannot download an item.
+- Hub unreachable (503, `hub_unreachable`): Charon has already tried the main hub address and the GitHub mirror (see [When the CrowdSec hub cannot be reached](#when-the-crowdsec-hub-cannot-be-reached)). Retry once, then Charon falls back to cached Hub data if available; otherwise stay on curated/offline presets until connectivity returns. The same answer is given when a pull needs to download a preset that is not cached and the hub cannot be reached, and when an apply cannot download an item.
 - Hub returns HTML/redirect: set HUB_BASE_URL to the JSON endpoint above or install cscli so the index is fetched locally.
 - Bad preset slug (400): the slug must match Hub naming; correct the slug before retrying.
 - **"Install missing hub items" says the hub could not be reached**: nothing was installed and nothing was changed. Check that the container has internet access and can resolve names (DNS), then click the button again. Items that were not reached in time can be retried with **Install remaining**.
@@ -251,6 +251,29 @@ These appear when Charon cannot read or save your log sources settings file (`ac
 3. Fix the owner or permissions on your computer, then restart Charon. `chown` changes the owner of a file or folder, and `chmod` changes who may read or write it. Ask someone who knows your server if you are not sure which owner to use.
 4. If you mounted your data folder as read-only (a `:ro` at the end of its line in your compose file), Charon cannot save anything. Remove the `:ro` from that line, restart Charon, and try again.
 
+## When the CrowdSec hub cannot be reached
+
+CrowdSec publishes its lists of rules and presets (the "hub"). Charon normally gets them from CrowdSec's main address. If that address does not answer, Charon tries a second copy of the hub on GitHub (the "mirror"). You do not need to turn anything on for this.
+
+The mirror is used in these places:
+
+- **Preset list and downloads.** The presets page and the **Pull** button try the main address first, then the mirror.
+- **Starting CrowdSec.** The hub update that runs when the container starts, and the installs of missing hub items, try the mirror too.
+- **Installing items.** Charon's `cscli` tool (CrowdSec's command-line helper, which ships inside Charon) retries on the mirror when a hub update or item install fails on the main address.
+
+**Slow connections.** A slow link can make the main address take a long time to fail before the mirror is tried. For `hub update`, Charon gives the main address about half of its time limit, then uses the rest for the mirror. For item installs, the main address gets the full time, so a slow install that runs out of time does not get a mirror retry. When the container starts, the `hub upgrade` step gives the main address about half its time (60 of 120 seconds) before the mirror is tried. On a very slow link, both attempts can run out of time where one longer attempt used to succeed. `hub update` and item installs behave as described above. If that happens, wait a few minutes and try again.
+
+**Staying on the mirror.** This applies only to the `cscli` operations (the hub update and item installs). After the mirror answers once, `cscli` tries the mirror first for up to 10 minutes. If the mirror itself then fails, `cscli` tries the main address again. The presets list and preset downloads always try the main address first, so during an outage each of those requests can take about 11 seconds longer before the mirror answers.
+
+**The presets page.** If the hub list could not be used, the page shows a quiet note: "Showing built-in and downloaded presets. The hub list was not loaded." It is information only. No action is needed.
+
+- Built-in presets and presets you have already downloaded keep working.
+- Hub presets you have not downloaded yet appear greyed out. You cannot select them until the hub is reachable again.
+
+**When both routes fail.** If neither the main address nor the mirror can be reached, Charon reports "CrowdSec could not reach the hub" (error `hub_unreachable`). Nothing is installed and your settings stay as they were. Check the container's internet and DNS access, then try again.
+
+**Temporary files.** During a mirror retry, Charon makes a short-lived copy of CrowdSec's settings file that points at the mirror. Its name starts with `.charon-hub-mirror-`. This copy is internal. Charon removes it automatically, and it never appears in the file list or in exports. You do not need to delete it.
+
 ## Hub preset messages
 
 Applying a hub preset shows one of these messages when it cannot finish or needs your attention. When an apply fails, your CrowdSec settings are put back as they were.
@@ -259,7 +282,7 @@ Applying a hub preset shows one of these messages when it cannot finish or needs
 - **"The hub is still updating, try again later."** (HTTP 409, `preset_hub_updating`): the hub is still publishing a newer version of this item. Charon checks every downloaded item against the hub's index before it keeps a copy, and refuses one that does not match, so an incomplete update is not used. Wait a while, pull the preset again, then apply it.
 - **"This item was edited on this server and was left unchanged. Reset it before applying the preset."**: you (or a script) changed this item's file on this server, and Charon will not overwrite your edit. The message lists the edited items ("Edited items: ..."). A plain install or upgrade does nothing for an edited item, so reset it with `cscli <type> install <name> --force` (Docker users run it as `docker exec charon cscli ...`), for example `docker exec charon cscli parsers install crowdsecurity/apache2-logs --force`. If a collection reports an edited item inside it, run `cscli collections install <collection> --force`, which also restores that item. This replaces your edit with the original hub version, so your local change is lost. Then reload CrowdSec, pull the preset again and apply it.
 - **"The preset install took too long and was rolled back. Try again."**: the install did not finish within 120 seconds (typical installs take 1-5 seconds; the slowest common collection takes about a minute on a first download). Try again, or raise `HUB_APPLY_TIMEOUT_SECONDS` on a slow connection (the web interface stops waiting after 130 seconds, so values above about 125 only help when you run the install yourself with `cscli`). Very large collections (hundreds of items, such as `sigmahq/windows_proc_creation`) can take several minutes because items are downloaded one by one; install those directly with `docker exec charon cscli collections install <name>`.
-- **"CrowdSec could not reach the hub. Check the network connection and try again."** (HTTP 503, `hub_unreachable`): the server has no route to the CrowdSec hub, when pulling a preset that was never downloaded as well as when applying one. Nothing was installed and your settings are unchanged. Check the container's internet and DNS access, then try again.
+- **"CrowdSec could not reach the hub. Check the network connection and try again."** (HTTP 503, `hub_unreachable`): Charon could not reach the CrowdSec hub on either its main address or the GitHub mirror. This applies when pulling a preset that was never downloaded as well as when applying one. Nothing was installed and your settings are unchanged. Check the container's internet and DNS access, then try again.
 - **"This name exists in several hub sections. Choose which item to use."** (HTTP 409, `preset_type_ambiguous`): pick the item type in the list that appears, then pull again.
 - **"cscli unavailable or not responding"**: Charon could not run `cscli`. The Docker image includes it; restart the container and try again.
 - **"cscli unavailable or not responding" offline**: an already-downloaded preview can be applied if its items are already on the server; otherwise the apply fails and is rolled back. Pulling a preset that was never downloaded needs internet access.
diff --git a/frontend/src/api/presets.ts b/frontend/src/api/presets.ts
index 018708872..88adb013a 100644
--- a/frontend/src/api/presets.ts
+++ b/frontend/src/api/presets.ts
@@ -50,6 +50,13 @@ export interface CrowdsecPresetSummary {
   retrieved_at?: string
 }
 
+/** Response of the preset list. `hub_offline` is true when the list was served without the CrowdSec hub. */
+export interface CrowdsecPresetListResponse {
+  presets: CrowdsecPresetSummary[]
+  /** Optional so that an older server without the field still parses. */
+  hub_offline?: boolean
+}
+
 /** Response from pulling a CrowdSec preset. */
 export interface PullCrowdsecPresetResponse {
   status: string
@@ -100,11 +107,11 @@ export interface CachedCrowdsecPresetPreview {
 
 /**
  * Lists all available CrowdSec presets.
- * @returns Promise resolving to object containing presets array
+ * @returns Promise resolving to the presets array and the hub_offline flag
  * @throws {AxiosError} If the request fails
  */
-export async function listCrowdsecPresets() {
-  const resp = await client.get<{ presets: CrowdsecPresetSummary[] }>('/admin/crowdsec/presets')
+export async function listCrowdsecPresets(): Promise<CrowdsecPresetListResponse> {
+  const resp = await client.get<CrowdsecPresetListResponse>('/admin/crowdsec/presets')
   return resp.data
 }
 
diff --git a/frontend/src/locales/de/translation.json b/frontend/src/locales/de/translation.json
index 62a2e4907..f7dc7bf57 100644
--- a/frontend/src/locales/de/translation.json
+++ b/frontend/src/locales/de/translation.json
@@ -1659,6 +1659,8 @@
       "pullPreview": "Vorschau abrufen",
       "applyPreset": "Vorlage anwenden",
       "hubUnreachable": "CrowdSec Hub nicht erreichbar. Hub-Vorlagen funktionieren möglicherweise nicht.",
+      "hubOffline": "Integrierte und heruntergeladene Vorlagen werden angezeigt. Die Hub-Liste wurde nicht geladen.",
+      "unavailableOffline": "Benötigt den CrowdSec-Hub. Solange der Hub offline ist, nicht verfügbar.",
       "retry": "Wiederholen",
       "useCached": "Zwischengespeichert verwenden",
       "typeLabel": "Elementtyp",
diff --git a/frontend/src/locales/en/translation.json b/frontend/src/locales/en/translation.json
index 0205e10a8..db999beb6 100644
--- a/frontend/src/locales/en/translation.json
+++ b/frontend/src/locales/en/translation.json
@@ -1664,6 +1664,8 @@
       "pullPreview": "Pull Preview",
       "applyPreset": "Apply Preset",
       "hubUnreachable": "CrowdSec Hub unreachable. Hub presets may not work.",
+      "hubOffline": "Showing built-in and downloaded presets. The hub list was not loaded.",
+      "unavailableOffline": "Needs the CrowdSec hub. Not available while the hub is offline.",
       "retry": "Retry",
       "useCached": "Use Cached",
       "typeLabel": "Item type",
diff --git a/frontend/src/locales/es/translation.json b/frontend/src/locales/es/translation.json
index dea7e7761..816f06c44 100644
--- a/frontend/src/locales/es/translation.json
+++ b/frontend/src/locales/es/translation.json
@@ -1659,6 +1659,8 @@
       "pullPreview": "Obtener vista previa",
       "applyPreset": "Aplicar plantilla",
       "hubUnreachable": "Hub de CrowdSec inalcanzable. Las plantillas del hub pueden no funcionar.",
+      "hubOffline": "Se muestran las plantillas integradas y descargadas. No se cargó la lista del hub.",
+      "unavailableOffline": "Requiere el hub de CrowdSec. No disponible mientras el hub esté sin conexión.",
       "retry": "Reintentar",
       "useCached": "Usar en caché",
       "typeLabel": "Tipo de elemento",
diff --git a/frontend/src/locales/fr/translation.json b/frontend/src/locales/fr/translation.json
index 861a67fbb..f1fa46765 100644
--- a/frontend/src/locales/fr/translation.json
+++ b/frontend/src/locales/fr/translation.json
@@ -1659,6 +1659,8 @@
       "pullPreview": "Récupérer l'aperçu",
       "applyPreset": "Appliquer le préréglage",
       "hubUnreachable": "Hub CrowdSec inaccessible. Les préréglages du hub peuvent ne pas fonctionner.",
+      "hubOffline": "Préréglages intégrés et téléchargés affichés. La liste du hub n'a pas été chargée.",
+      "unavailableOffline": "Nécessite le hub CrowdSec. Indisponible tant que le hub est hors ligne.",
       "retry": "Réessayer",
       "useCached": "Utiliser le cache",
       "typeLabel": "Type d'élément",
diff --git a/frontend/src/locales/zh/translation.json b/frontend/src/locales/zh/translation.json
index 3e247fd54..17f576c2a 100644
--- a/frontend/src/locales/zh/translation.json
+++ b/frontend/src/locales/zh/translation.json
@@ -1659,6 +1659,8 @@
       "pullPreview": "获取预览",
       "applyPreset": "应用预设",
       "hubUnreachable": "无法访问 CrowdSec Hub。Hub 预设可能无法使用。",
+      "hubOffline": "正在显示内置和已下载的预设。未加载 Hub 列表。",
+      "unavailableOffline": "需要 CrowdSec Hub。Hub 离线时不可用。",
       "retry": "重试",
       "useCached": "使用缓存",
       "typeLabel": "项目类型",
diff --git a/frontend/src/pages/CrowdSecConfig.tsx b/frontend/src/pages/CrowdSecConfig.tsx
index 53d636f8c..df87e2c0c 100644
--- a/frontend/src/pages/CrowdSecConfig.tsx
+++ b/frontend/src/pages/CrowdSecConfig.tsx
@@ -46,6 +46,18 @@ function presetKey(preset: { type?: string; slug: string }): string {
   return preset.type ? `${preset.type}/${preset.slug}` : preset.slug
 }
 
+/**
+ * A hub-backed row that is not cached and cannot be fetched because the hub is offline.
+ * It stays listed (muted) but is never selected, so no pull is sent for it.
+ */
+function isPresetUnavailableOffline(preset: { requiresHub: boolean; available?: boolean; cached?: boolean }): boolean {
+  return preset.requiresHub && preset.available === false && !preset.cached
+}
+
+function isPresetSelectable(preset: { requiresHub: boolean; available?: boolean; cached?: boolean }): boolean {
+  return !isPresetUnavailableOffline(preset)
+}
+
 /** Prefer the server's `error` message for Axios failures, falling back to the given text. */
 function getServerErrorMessage(err: unknown, fallback: string): string {
   if (isAxiosError(err)) {
@@ -262,13 +274,20 @@ export default function CrowdSecConfig() {
     return result
   }, [presetCatalog, searchQuery, sortBy])
 
+  // Keep the current selection while it is still listed and usable; otherwise select the first usable row
+  // in catalog order, or nothing when no row can be used (the empty key never matches a row).
   useEffect(() => {
     if (!presetCatalog.length) return
-    if (!selectedPresetKey || !presetCatalog.some((preset) => presetKey(preset) === selectedPresetKey)) {
-      setSelectedPresetKey(presetKey(presetCatalog[0]))
-    }
+    const keepsSelection = presetCatalog.some((preset) => presetKey(preset) === selectedPresetKey && isPresetSelectable(preset))
+    if (keepsSelection) return
+    const firstSelectable = presetCatalog.find(isPresetSelectable)
+    setSelectedPresetKey(firstSelectable ? presetKey(firstSelectable) : '')
   }, [presetCatalog, selectedPresetKey])
 
+  const selectPreset = (preset: PresetCatalogEntry) => {
+    if (isPresetSelectable(preset)) setSelectedPresetKey(presetKey(preset))
+  }
+
   // Prefer the enrolled identity over the hostname default, unless the user already edited the field
   useEffect(() => {
     const enrolledAgent = consoleStatusQuery.data?.agent_name
@@ -1249,42 +1268,56 @@ export default function CrowdSecConfig() {
 
           <div className="border border-gray-700 rounded-lg max-h-60 overflow-y-auto bg-gray-900">
             {filteredPresets.length > 0 ? (
-              filteredPresets.map((preset) => (
-                <div
-                  key={presetKey(preset)}
-                  onClick={() => setSelectedPresetKey(presetKey(preset))}
-                  role="button"
-                  tabIndex={0}
-                  onKeyDown={(e) => {
-                    if (e.key === 'Enter' || e.key === ' ') {
-                      e.preventDefault()
-                      setSelectedPresetKey(presetKey(preset))
-                    }
-                  }}
-                  aria-pressed={selectedPresetKey === presetKey(preset)}
-                  className={`p-3 cursor-pointer hover:bg-gray-800 border-b border-gray-800 last:border-0 outline-none focus-visible:bg-gray-800 focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-blue-500 ${
-                    selectedPresetKey === presetKey(preset) ? 'bg-blue-900/20 border-l-2 border-l-blue-500' : 'border-l-2 border-l-transparent'
-                  }`}
-                >
-                  <div className="flex justify-between items-start mb-1">
-                    <span className="font-medium text-white">{preset.title}</span>
-                    {preset.source && (
-                      <span className={`text-xs px-2 py-0.5 rounded-full ${
-                        preset.source === 'charon-curated' ? 'bg-purple-900/50 text-purple-300' : 'bg-blue-900/50 text-blue-300'
-                      }`}>
-                        {preset.source === 'charon-curated' ? t('crowdsecConfig.presets.curated') : t('crowdsecConfig.presets.hub')}
-                      </span>
+              filteredPresets.map((preset) => {
+                const selected = selectedPresetKey === presetKey(preset)
+                const selectable = isPresetSelectable(preset)
+                return (
+                  <div
+                    key={presetKey(preset)}
+                    onClick={() => selectPreset(preset)}
+                    role="button"
+                    tabIndex={0}
+                    onKeyDown={(e) => {
+                      if (e.key === 'Enter' || e.key === ' ') {
+                        e.preventDefault()
+                        selectPreset(preset)
+                      }
+                    }}
+                    aria-pressed={selected}
+                    aria-disabled={selectable ? undefined : true}
+                    className={`p-3 border-b border-gray-800 last:border-0 outline-none focus-visible:bg-gray-800 focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-blue-500 ${
+                      selectable ? 'cursor-pointer hover:bg-gray-800' : 'cursor-not-allowed opacity-60'
+                    } ${
+                      selected ? 'bg-blue-900/20 border-l-2 border-l-blue-500' : 'border-l-2 border-l-transparent'
+                    }`}
+                  >
+                    <div className="flex justify-between items-start mb-1">
+                      <span className="font-medium text-white">{preset.title}</span>
+                      {preset.source && (
+                        <span className={`text-xs px-2 py-0.5 rounded-full ${
+                          preset.source === 'charon-curated' ? 'bg-purple-900/50 text-purple-300' : 'bg-blue-900/50 text-blue-300'
+                        }`}>
+                          {preset.source === 'charon-curated' ? t('crowdsecConfig.presets.curated') : t('crowdsecConfig.presets.hub')}
+                        </span>
+                      )}
+                    </div>
+                    {preset.type && <p className="text-xs text-gray-500" data-testid="preset-type">{preset.type}</p>}
+                    <p className="text-xs text-gray-400 line-clamp-1">{preset.description}</p>
+                    {!selectable && (
+                      <p className="text-xs text-gray-500" data-testid="preset-unavailable-offline">{t('crowdsecConfig.presets.unavailableOffline')}</p>
                     )}
                   </div>
-                  {preset.type && <p className="text-xs text-gray-500" data-testid="preset-type">{preset.type}</p>}
-                  <p className="text-xs text-gray-400 line-clamp-1">{preset.description}</p>
-                </div>
-              ))
+                )
+              })
             ) : (
               <div className="p-4 text-center text-gray-500 text-sm">{t('crowdsecConfig.presets.noPresets', { query: searchQuery })}</div>
             )}
           </div>
 
+          {presetsQuery.data?.hub_offline && (
+            <p className="text-xs text-gray-500" data-testid="preset-hub-offline">{t('crowdsecConfig.presets.hubOffline')}</p>
+          )}
+
           <div className="flex items-center gap-2 flex-wrap justify-end">
             <Button
               variant="secondary"
diff --git a/frontend/src/pages/__tests__/CrowdSecConfig.presetHubOffline.test.tsx b/frontend/src/pages/__tests__/CrowdSecConfig.presetHubOffline.test.tsx
new file mode 100644
index 000000000..97e02dd2e
--- /dev/null
+++ b/frontend/src/pages/__tests__/CrowdSecConfig.presetHubOffline.test.tsx
@@ -0,0 +1,310 @@
+import { screen, waitFor, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+import * as crowdsecApi from '../../api/crowdsec'
+import * as featureFlagsApi from '../../api/featureFlags'
+import * as presetsApi from '../../api/presets'
+import * as securityApi from '../../api/security'
+import * as settingsApi from '../../api/settings'
+import { renderWithQueryClient } from '../../test-utils/renderWithQueryClient'
+import CrowdSecConfig from '../CrowdSecConfig'
+
+vi.mock('../../api/security')
+vi.mock('../../api/crowdsec')
+vi.mock('../../api/presets')
+vi.mock('../../api/settings')
+vi.mock('../../api/featureFlags')
+vi.mock('../../hooks/useConsoleEnrollment', () => ({
+  useConsoleStatus: vi.fn(() => ({
+    data: {
+      status: 'not_enrolled',
+      tenant: 'default',
+      agent_name: 'charon-agent',
+      last_error: null,
+      last_attempt_at: null,
+      enrolled_at: null,
+      last_heartbeat_at: null,
+      key_present: false,
+      correlation_id: 'corr-1',
+    },
+    isLoading: false,
+    isRefetching: false,
+  })),
+  useEnrollConsole: vi.fn(() => ({
+    mutateAsync: vi.fn().mockResolvedValue({ status: 'enrolling', key_present: false }),
+    isPending: false,
+  })),
+  useClearConsoleEnrollment: vi.fn(() => ({
+    mutate: vi.fn(),
+    isPending: false,
+  })),
+}))
+vi.mock('../../components/CrowdSecBouncerKeyDisplay', () => ({
+  CrowdSecBouncerKeyDisplay: () => null,
+}))
+vi.mock('../../utils/crowdsecExport', () => ({
+  buildCrowdsecExportFilename: vi.fn(() => 'crowdsec-default.tar.gz'),
+  promptCrowdsecFilename: vi.fn(() => 'crowdsec.tar.gz'),
+  downloadCrowdsecExport: vi.fn(),
+}))
+vi.mock('../../utils/toast', () => ({
+  toast: {
+    success: vi.fn(),
+    error: vi.fn(),
+    info: vi.fn(),
+  },
+}))
+
+const baseStatus = {
+  cerberus: { enabled: true },
+  crowdsec: { enabled: true, mode: 'local' as const, api_url: '' },
+  waf: { enabled: true, mode: 'enabled' as const },
+  rate_limit: { enabled: true },
+  acl: { enabled: true },
+}
+
+/** Hub-backed row that is not cached and cannot be fetched while the hub is offline. */
+const OFFLINE_HUB_ROW: presetsApi.CrowdsecPresetSummary = {
+  slug: 'crowdsecurity/offline-hub-preset',
+  title: 'Offline Hub Preset',
+  summary: 'Hub only',
+  source: 'hub',
+  requires_hub: true,
+  available: false,
+  cached: false,
+}
+
+/** Second unavailable hub row, so tests can cover a list where nothing is selectable. */
+const SECOND_OFFLINE_HUB_ROW: presetsApi.CrowdsecPresetSummary = {
+  slug: 'crowdsecurity/second-offline-hub-preset',
+  title: 'Second Offline Hub Preset',
+  summary: 'Hub only too',
+  source: 'hub',
+  requires_hub: true,
+  available: false,
+  cached: false,
+}
+
+/** Built-in preset that needs no hub, so it stays selectable offline. */
+const CURATED_ROW: presetsApi.CrowdsecPresetSummary = {
+  slug: 'crowdsecurity/selectable-curated-preset',
+  title: 'Selectable Curated Preset',
+  summary: 'Built in',
+  source: 'charon-curated',
+  requires_hub: false,
+  available: true,
+  cached: false,
+}
+
+/** Hub-backed row that is online (listed as available) and not cached, so it is selectable. */
+const ONLINE_HUB_ROW: presetsApi.CrowdsecPresetSummary = {
+  slug: 'crowdsecurity/online-hub-preset',
+  title: 'Online Hub Preset',
+  summary: 'Hub, reachable',
+  source: 'hub',
+  requires_hub: true,
+  available: true,
+  cached: false,
+}
+
+/** Hub-backed row that is offline but already cached, so it still works. */
+const CACHED_OFFLINE_HUB_ROW: presetsApi.CrowdsecPresetSummary = {
+  slug: 'crowdsecurity/cached-offline-hub-preset',
+  title: 'Cached Offline Hub Preset',
+  summary: 'Cached hub',
+  source: 'hub',
+  requires_hub: true,
+  available: false,
+  cached: true,
+  cache_key: 'cache-cached',
+}
+
+const HUB_OFFLINE_NOTE = 'Showing built-in and downloaded presets. The hub list was not loaded.'
+const UNAVAILABLE_OFFLINE_NOTE = 'Needs the CrowdSec hub. Not available while the hub is offline.'
+
+const pulledFor = (slug: string): presetsApi.PullCrowdsecPresetResponse => ({
+  status: 'pulled',
+  slug,
+  preview: `name: ${slug}\n`,
+  cache_key: `cache-${slug}`,
+  source: 'hub',
+})
+
+/** The row whose accessible name starts with the title (anchored, so "Offline Hub Preset" does not match "Second Offline Hub Preset"). */
+const startsWithTitle = (title: string) => (accessibleName: string) => accessibleName.startsWith(title)
+const presetRow = (title: string) => screen.getByRole('button', { name: startsWithTitle(title) })
+const findPresetRow = (title: string) => screen.findByRole('button', { name: startsWithTitle(title) })
+
+/** Every slug the page asked to pull, in call order. */
+const pulledSlugs = (): string[] => vi.mocked(presetsApi.pullCrowdsecPreset).mock.calls.map(([slug]) => slug)
+
+const renderPage = async () => {
+  const view = renderWithQueryClient(<CrowdSecConfig />)
+  await screen.findByText('CrowdSec Configuration')
+  return view
+}
+
+describe('CrowdSecConfig presets served without the hub', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(securityApi.getSecurityStatus).mockResolvedValue(baseStatus)
+    vi.mocked(crowdsecApi.statusCrowdsec).mockResolvedValue({ running: true, pid: 123, lapi_ready: true })
+    vi.mocked(crowdsecApi.listCrowdsecFiles).mockResolvedValue({ files: ['acquis.yaml'] })
+    vi.mocked(crowdsecApi.readCrowdsecFile).mockResolvedValue({ content: 'file-content' })
+    vi.mocked(crowdsecApi.listCrowdsecDecisions).mockResolvedValue({ decisions: [] })
+    vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({ presets: [] })
+    vi.mocked(presetsApi.pullCrowdsecPreset).mockImplementation(async (slug) => pulledFor(slug))
+    vi.mocked(presetsApi.getCurrentApplyJob).mockResolvedValue(null)
+    vi.mocked(featureFlagsApi.getFeatureFlags).mockResolvedValue({ 'feature.crowdsec.console_enrollment': false })
+    vi.mocked(settingsApi.updateSetting).mockResolvedValue()
+  })
+
+  describe('hub offline note', () => {
+    it('shows the muted note with no button, banner or retry when hub_offline is true', async () => {
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({ presets: [CURATED_ROW], hub_offline: true })
+      await renderPage()
+
+      const note = await screen.findByTestId('preset-hub-offline')
+      expect(note).toHaveTextContent(HUB_OFFLINE_NOTE)
+      expect(within(note).queryByRole('button')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('preset-hub-unavailable')).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Retry' })).not.toBeInTheDocument()
+    })
+
+    it('shows no note when hub_offline is false', async () => {
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({ presets: [CURATED_ROW, OFFLINE_HUB_ROW], hub_offline: false })
+      await renderPage()
+
+      await waitFor(() => expect(presetRow(CURATED_ROW.title)).toBeInTheDocument())
+      expect(screen.queryByTestId('preset-hub-offline')).not.toBeInTheDocument()
+    })
+
+    it('shows no note when the server omits hub_offline (older backend)', async () => {
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({ presets: [CURATED_ROW] })
+      await renderPage()
+
+      await waitFor(() => expect(presetRow(CURATED_ROW.title)).toBeInTheDocument())
+      expect(screen.queryByTestId('preset-hub-offline')).not.toBeInTheDocument()
+    })
+  })
+
+  describe('unavailable hub rows', () => {
+    it('marks an unavailable hub row aria-disabled with its note and keeps it unpressed', async () => {
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({ presets: [OFFLINE_HUB_ROW, CURATED_ROW], hub_offline: true })
+      await renderPage()
+
+      const row = await findPresetRow(OFFLINE_HUB_ROW.title)
+      expect(row).toHaveAttribute('aria-disabled', 'true')
+      expect(row).toHaveAttribute('aria-pressed', 'false')
+      expect(within(row).getByTestId('preset-unavailable-offline')).toHaveTextContent(UNAVAILABLE_OFFLINE_NOTE)
+    })
+
+    it('does not mark a selectable row as disabled', async () => {
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({ presets: [CURATED_ROW], hub_offline: true })
+      await renderPage()
+
+      const row = await findPresetRow(CURATED_ROW.title)
+      await waitFor(() => expect(row).toHaveAttribute('aria-pressed', 'true'))
+      expect(row).not.toHaveAttribute('aria-disabled')
+      expect(row).not.toHaveTextContent(UNAVAILABLE_OFFLINE_NOTE)
+    })
+
+    it('does not select an unavailable row on click and sends no pull for it', async () => {
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({ presets: [OFFLINE_HUB_ROW, CURATED_ROW], hub_offline: true })
+      await renderPage()
+      await waitFor(() => expect(presetRow(CURATED_ROW.title)).toHaveAttribute('aria-pressed', 'true'))
+
+      await userEvent.click(presetRow(OFFLINE_HUB_ROW.title))
+
+      expect(presetRow(OFFLINE_HUB_ROW.title)).toHaveAttribute('aria-pressed', 'false')
+      expect(presetRow(CURATED_ROW.title)).toHaveAttribute('aria-pressed', 'true')
+      expect(pulledSlugs()).not.toContain(OFFLINE_HUB_ROW.slug)
+    })
+
+    it('does not select an unavailable row with the keyboard', async () => {
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({ presets: [OFFLINE_HUB_ROW, CURATED_ROW], hub_offline: true })
+      await renderPage()
+      await waitFor(() => expect(presetRow(CURATED_ROW.title)).toHaveAttribute('aria-pressed', 'true'))
+
+      presetRow(OFFLINE_HUB_ROW.title).focus()
+      await userEvent.keyboard('{Enter}')
+      await userEvent.keyboard(' ')
+
+      expect(presetRow(OFFLINE_HUB_ROW.title)).toHaveAttribute('aria-pressed', 'false')
+      expect(presetRow(CURATED_ROW.title)).toHaveAttribute('aria-pressed', 'true')
+      expect(pulledSlugs()).not.toContain(OFFLINE_HUB_ROW.slug)
+    })
+
+    it('keeps a cached hub row selectable while the hub is offline', async () => {
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({ presets: [CACHED_OFFLINE_HUB_ROW, OFFLINE_HUB_ROW], hub_offline: true })
+      await renderPage()
+
+      const cachedRow = await findPresetRow(CACHED_OFFLINE_HUB_ROW.title)
+      await waitFor(() => expect(cachedRow).toHaveAttribute('aria-pressed', 'true'))
+      expect(cachedRow).not.toHaveAttribute('aria-disabled')
+      expect(within(cachedRow).queryByTestId('preset-unavailable-offline')).not.toBeInTheDocument()
+    })
+
+    it('makes a hub row selectable again once the hub is back and the list refreshes', async () => {
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({ presets: [OFFLINE_HUB_ROW, CURATED_ROW], hub_offline: true })
+      const { queryClient } = await renderPage()
+      await waitFor(() => expect(presetRow(CURATED_ROW.title)).toHaveAttribute('aria-pressed', 'true'))
+
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({
+        presets: [{ ...OFFLINE_HUB_ROW, available: true }, CURATED_ROW],
+        hub_offline: false,
+      })
+      await queryClient.invalidateQueries({ queryKey: ['crowdsec-presets'] })
+
+      await waitFor(() => expect(presetRow(OFFLINE_HUB_ROW.title)).not.toHaveAttribute('aria-disabled'))
+      expect(screen.queryByTestId('preset-hub-offline')).not.toBeInTheDocument()
+      expect(presetRow(CURATED_ROW.title)).toHaveAttribute('aria-pressed', 'true')
+    })
+  })
+
+  describe('auto-select', () => {
+    it('skips an unavailable first row and selects the first selectable row', async () => {
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({ presets: [OFFLINE_HUB_ROW, CURATED_ROW], hub_offline: true })
+      await renderPage()
+
+      await waitFor(() => expect(presetRow(CURATED_ROW.title)).toHaveAttribute('aria-pressed', 'true'))
+      expect(presetRow(OFFLINE_HUB_ROW.title)).toHaveAttribute('aria-pressed', 'false')
+      await waitFor(() => expect(pulledSlugs()).toContain(CURATED_ROW.slug))
+      expect(pulledSlugs()).not.toContain(OFFLINE_HUB_ROW.slug)
+    })
+
+    it('selects nothing and sends no pull when every row is unavailable', async () => {
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({
+        presets: [OFFLINE_HUB_ROW, SECOND_OFFLINE_HUB_ROW],
+        hub_offline: true,
+      })
+      await renderPage()
+
+      for (const row of [OFFLINE_HUB_ROW, SECOND_OFFLINE_HUB_ROW]) {
+        await waitFor(() => expect(presetRow(row.title)).toHaveAttribute('aria-disabled', 'true'))
+        expect(presetRow(row.title)).toHaveAttribute('aria-pressed', 'false')
+      }
+      expect(screen.queryByRole('alert')).not.toBeInTheDocument()
+      expect(screen.queryByTestId('preset-hub-unavailable')).not.toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'Pull Preview' })).toBeDisabled()
+      expect(pulledSlugs()).toEqual([])
+    })
+
+    it('moves the selection to the first selectable row when the selected row becomes unavailable', async () => {
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({ presets: [ONLINE_HUB_ROW, CURATED_ROW], hub_offline: false })
+      const { queryClient } = await renderPage()
+      await waitFor(() => expect(presetRow(ONLINE_HUB_ROW.title)).toHaveAttribute('aria-pressed', 'true'))
+
+      vi.mocked(presetsApi.listCrowdsecPresets).mockResolvedValue({
+        presets: [{ ...ONLINE_HUB_ROW, available: false }, CURATED_ROW],
+        hub_offline: true,
+      })
+      await queryClient.invalidateQueries({ queryKey: ['crowdsec-presets'] })
+
+      await waitFor(() => expect(presetRow(CURATED_ROW.title)).toHaveAttribute('aria-pressed', 'true'))
+      expect(presetRow(ONLINE_HUB_ROW.title)).toHaveAttribute('aria-pressed', 'false')
+      expect(presetRow(ONLINE_HUB_ROW.title)).toHaveAttribute('aria-disabled', 'true')
+    })
+  })
+})
diff --git a/scripts/cscli_hub_mirror_test.sh b/scripts/cscli_hub_mirror_test.sh
new file mode 100755
index 000000000..095876fde
--- /dev/null
+++ b/scripts/cscli_hub_mirror_test.sh
@@ -0,0 +1,649 @@
+#!/bin/sh
+# shellcheck disable=SC1090  # the helper path is computed at run time, from this script's own location
+# Tests for .docker/cscli-hub-mirror.sh. No Docker and no network: a fake cscli on PATH records each call and
+# answers from FAKE_MODE. POSIX sh only, so the same file runs under dash, busybox sh and bash:
+#   sh scripts/cscli_hub_mirror_test.sh
+#   dash scripts/cscli_hub_mirror_test.sh
+#   busybox sh scripts/cscli_hub_mirror_test.sh
+# Exit status 0 when every check passes.
+
+REPO_DIR=$(cd "$(dirname "$0")/.." && pwd)
+HELPER="$REPO_DIR/.docker/cscli-hub-mirror.sh"
+ENTRYPOINT="$REPO_DIR/.docker/docker-entrypoint.sh"
+
+WORK=$(mktemp -d "${TMPDIR:-/tmp}/cscli-hub-mirror-test.XXXXXX") || exit 1
+trap 'rm -rf "$WORK"' EXIT INT TERM
+
+FAKEBIN="$WORK/bin"
+mkdir -p "$FAKEBIN"
+
+# The image's timeout is busybox's, which ends a command with that command's own status: a cscli that traps TERM and
+# exits 1 gives 1. GNU timeout reports 124 for the same shape, so the test shim asks GNU for its --preserve-status form,
+# which keeps the command's status the way busybox does. The helper still calls plain `timeout`.
+REAL_TIMEOUT=$(command -v timeout)
+cat >"$FAKEBIN/timeout" <<SHIM
+#!/bin/sh
+exec "$REAL_TIMEOUT" --preserve-status "\$@"
+SHIM
+chmod +x "$FAKEBIN/timeout"
+
+TEMPLATE='https://raw.githubusercontent.com/crowdsecurity/hub/%s/%s'
+TEMPLATE_LINE="  __hub_url_template__: \"$TEMPLATE\""
+
+# Fake cscli. `-c <config>` selects a config; the fake logs one line per call (cfg, whether the derived config
+# carries the template, whether its .local copy exists, and the arguments). FAKE_MODE decides the answers:
+#   live_ok      the live config succeeds
+#   live_net     the live config fails with a network error; the derived config succeeds
+#   live_bad     the live config fails with an item error; the derived config succeeds
+#   live_hang    the live config never answers; the derived config succeeds
+#   live_deadline the live config fails with a bare expired deadline; the derived config succeeds
+#   live_transport the live config fails with a client timeout; the derived config succeeds
+#   live_term    the live config traps TERM, runs past its budget, prints "terminated signal received" and exits 1
+#                (the shape the real cscli shows when `timeout` ends it); the derived config succeeds
+#   live_quiet   the live config traps TERM, runs past its budget and exits 1 with no text; the derived config succeeds
+#   derived_net  the derived config fails with a network error; the live config succeeds
+#   both_net     both fail with a network error
+cat >"$FAKEBIN/cscli" <<'FAKE'
+#!/bin/sh
+cfg=""
+if [ "$1" = "-c" ]; then
+    cfg=$2
+    shift 2
+fi
+tpl=0
+localfile=0
+if [ -n "$cfg" ]; then
+    if grep -Fqx '  __hub_url_template__: "https://raw.githubusercontent.com/crowdsecurity/hub/%s/%s"' "$cfg"; then
+        tpl=1
+    fi
+    if [ -e "$cfg.local" ]; then
+        localfile=1
+    fi
+fi
+echo "cfg=${cfg:-live} tpl=$tpl local=$localfile args=$*" >>"$FAKE_LOG"
+net="failed http request for https://cdn-hub.crowdsec.net/x: dial tcp 127.0.0.1:443: connection refused"
+bad="item not found: crowdsecurity/nope"
+deadline="context deadline exceeded"
+transport="Get \"https://cdn-hub.crowdsec.net/x\": net/http: request canceled (Client.Timeout exceeded while awaiting headers)"
+if [ -z "$cfg" ]; then
+    case "$FAKE_MODE" in
+        live_ok) echo ok; exit 0 ;;
+        live_net) echo "$net"; exit 1 ;;
+        live_bad) echo "$bad"; exit 1 ;;
+        live_hang) exec sleep 30 ;;
+        live_deadline) echo "$deadline"; exit 1 ;;
+        live_transport) echo "$transport"; exit 1 ;;
+        live_term) trap 'echo "terminated signal received"; exit 1' TERM; sleep 30 & wait $!; exit 1 ;;
+        live_quiet) trap 'exit 1' TERM; sleep 30 & wait $!; exit 1 ;;
+        derived_net) echo ok; exit 0 ;;
+        both_net) echo "$net"; exit 1 ;;
+    esac
+else
+    case "$FAKE_MODE" in
+        live_ok|live_net|live_bad|live_hang|live_deadline|live_transport|live_term|live_quiet) echo ok; exit 0 ;;
+        derived_net|both_net) echo "$net"; exit 1 ;;
+    esac
+fi
+FAKE
+chmod +x "$FAKEBIN/cscli"
+PATH="$FAKEBIN:$PATH"
+export PATH
+
+PASS=0
+FAILS=0
+pass() {
+    PASS=$((PASS + 1))
+    echo "ok - $1"
+}
+fail() {
+    FAILS=$((FAILS + 1))
+    echo "not ok - $1"
+}
+# check <name> <expected> <actual>
+check() {
+    if [ "$2" = "$3" ]; then
+        pass "$1"
+    else
+        fail "$1 (expected [$2], got [$3])"
+    fi
+}
+# check_file <name> <expected file> <actual file>
+check_file() {
+    if cmp -s "$2" "$3"; then
+        pass "$1"
+    else
+        fail "$1 (content differs: $(diff "$2" "$3" | head -n 12 | tr '\n' '|'))"
+    fi
+}
+
+# make_live <dir>: a live cscli config as the entrypoint leaves it (hub_branch pinned).
+make_live() {
+    mkdir -p "$1"
+    cat >"$1/config.yaml" <<'EOF'
+common:
+  log_level: info
+cscli:
+  hub_branch: master
+  output: human
+db_config:
+  type: sqlite
+EOF
+}
+
+# derived_in <dir>: derived files still present in a directory (one path per line).
+derived_in() {
+    for _f in "$1"/.charon-hub-mirror-*; do
+        if [ -e "$_f" ]; then
+            echo "$_f"
+        fi
+    done
+    return 0
+}
+
+# normcalls <file>: the call log with the derived path replaced by the word derived.
+normcalls() {
+    sed 's#cfg=[^ ]*\.yaml#cfg=derived#' "$1"
+}
+
+# prepared <live config> <name>: runs hub_mirror_prepare in a subshell, leaves the derived path in $WORK/<name>.path
+prepared() {
+    (
+        . "$HELPER"
+        hub_mirror_prepare "$1" && printf '%s\n' "${CHARON_CSCLI_MIRROR_CONFIG:-}"
+    ) >"$WORK/$2.path" 2>/dev/null
+    cat "$WORK/$2.path"
+}
+
+# ---------------------------------------------------------------------------
+echo "# template validation"
+(
+    . "$HELPER"
+    if hub_mirror_template_valid "$TEMPLATE"; then
+        echo "valid-default=yes"
+    fi
+    for t in 'http://x/%s/%s' 'https://x/%s' 'https://x/%s/%s/%s' 'https://x/%s/%d' 'https://x/%s/%s%' \
+        'https://x/%s%s%' 'https://x/%S/%s' 'https://x/%%s/%s' 'https://x/%s/%s
+' ; do
+        if hub_mirror_template_valid "$t"; then
+            echo "invalid-accepted"
+        fi
+    done
+) >"$WORK/validate.out" 2>&1
+check "default template is valid" "valid-default=yes" "$(grep '^valid-default' "$WORK/validate.out")"
+check "invalid templates are refused" "" "$(grep '^invalid-accepted' "$WORK/validate.out")"
+
+# ---------------------------------------------------------------------------
+echo "# derived config content"
+C1="$WORK/c1"
+make_live "$C1"
+D1=$(prepared "$C1/config.yaml" c1)
+check "prepare exports a readable derived path" "1" "$([ -r "$D1" ] && echo 1)"
+cat >"$WORK/c1.expected" <<EOF
+common:
+  log_level: info
+cscli:
+$TEMPLATE_LINE
+  hub_branch: master
+  output: human
+db_config:
+  type: sqlite
+EOF
+check_file "template is inserted under cscli, quoted, with the rest kept" "$WORK/c1.expected" "$D1"
+check "derived config is mode 0600" "600" "$(stat -c %a "$D1")"
+check "live config gets no template" "0" "$(grep -c '__hub_url_template__' "$C1/config.yaml")"
+
+(
+    . "$HELPER"
+    hub_mirror_prepare "$C1/config.yaml"
+    hub_mirror_remove
+    hub_mirror_prepare "$C1/config.yaml"
+    printf '%s\n' "${CHARON_CSCLI_MIRROR_CONFIG:-}"
+) >"$WORK/c1b.path" 2>/dev/null
+D1B=$(cat "$WORK/c1b.path")
+check_file "deriving again gives identical content (idempotent)" "$D1" "$D1B"
+check "one derived file after a repeat" "1" "$(derived_in "$C1" | wc -l | tr -d ' ')"
+
+C2="$WORK/c2"
+mkdir -p "$C2"
+printf 'common:\n  x: 1\n' >"$C2/config.yaml"
+D2=$(prepared "$C2/config.yaml" c2)
+printf 'common:\n  x: 1\n\ncscli:\n%s\n  hub_branch: master\n' "$TEMPLATE_LINE" >"$WORK/c2.expected"
+check_file "missing cscli section is appended with master pinned" "$WORK/c2.expected" "$D2"
+
+C3="$WORK/c3"
+mkdir -p "$C3"
+printf 'cscli:\n  hub_branch:\n  __hub_url_template__:\n  output: human\n' >"$C3/config.yaml"
+D3=$(prepared "$C3/config.yaml" c3)
+printf 'cscli:\n%s\n  hub_branch: master\n  output: human\n' "$TEMPLATE_LINE" >"$WORK/c3.expected"
+check_file "empty hub_branch and empty template key are replaced once" "$WORK/c3.expected" "$D3"
+
+C4="$WORK/c4"
+mkdir -p "$C4"
+printf 'cscli:\n    output: human\n' >"$C4/config.yaml"
+D4=$(prepared "$C4/config.yaml" c4)
+printf 'cscli:\n    __hub_url_template__: "%s"\n    hub_branch: master\n    output: human\n' "$TEMPLATE" >"$WORK/c4.expected"
+check_file "inserted keys follow a 4-space section" "$WORK/c4.expected" "$D4"
+
+C5="$WORK/c5"
+mkdir -p "$C5"
+printf 'cscli:\n  __hub_url_template__: ""\n  hub_branch: ""\n' >"$C5/config.yaml"
+D5=$(prepared "$C5/config.yaml" c5)
+printf 'cscli:\n%s\n  hub_branch: master\n' "$TEMPLATE_LINE" >"$WORK/c5.expected"
+check_file "quoted empty template and empty pin are unset values (as on the Go side)" "$WORK/c5.expected" "$D5"
+
+# ---------------------------------------------------------------------------
+echo "# refusals leave no file and export nothing"
+refuse_case() {
+    _dir="$WORK/$1"
+    mkdir -p "$_dir"
+    printf '%b' "$2" >"$_dir/config.yaml"
+    (
+        . "$HELPER"
+        if hub_mirror_prepare "$_dir/config.yaml"; then
+            echo "result=accepted"
+        else
+            echo "result=refused"
+        fi
+        echo "exported=${CHARON_CSCLI_MIRROR_CONFIG:-}"
+    ) >"$_dir/out" 2>&1
+    check "$3: refused" "result=refused" "$(grep '^result=' "$_dir/out")"
+    check "$3: nothing exported" "exported=" "$(grep '^exported=' "$_dir/out")"
+    check "$3: no derived file left" "" "$(derived_in "$_dir")"
+}
+refuse_case r1 'cscli:\n  __hub_url_template__: "https://example.com/%s/%s"\n' "operator template set"
+refuse_case r2 'cscli: {}\n' "inline cscli value"
+refuse_case r3 'cscli:\n  output: human\ncscli:\n  hub_branch: master\n' "two cscli sections"
+
+C6="$WORK/c6"
+make_live "$C6"
+printf 'hub_dir: /custom/hub\n' >"$C6/config.yaml.local"
+D6=$(prepared "$C6/config.yaml" c6)
+check_file "config.yaml.local is copied beside the derived config" "$C6/config.yaml.local" "$D6.local"
+check "copied local override is mode 0600" "600" "$(stat -c %a "$D6.local")"
+
+C7="$WORK/c7"
+make_live "$C7"
+mkdir "$C7/config.yaml.local"
+D7=$(prepared "$C7/config.yaml" c7)
+check "unreadable local override fails the prepare" "" "$D7"
+check "unreadable local override leaves no derived file" "" "$(derived_in "$C7")"
+
+D8=$(prepared "$WORK/nope/config.yaml" c8)
+check "missing live config is refused" "" "$D8"
+
+# A config.yaml.local that names a template would override the derived one, so the prepare fails closed.
+local_refuse_case() {
+    _dir="$WORK/$1"
+    make_live "$_dir"
+    printf 'cscli:\n  __hub_url_template__: "%s"\n' "$2" >"$_dir/config.yaml.local"
+    (
+        . "$HELPER"
+        if hub_mirror_prepare "$_dir/config.yaml"; then
+            echo "result=accepted"
+        else
+            echo "result=refused"
+        fi
+        echo "exported=${CHARON_CSCLI_MIRROR_CONFIG:-}"
+    ) >"$_dir/out" 2>&1
+    check "$3: refused" "result=refused" "$(grep '^result=' "$_dir/out")"
+    check "$3: nothing exported" "exported=" "$(grep '^exported=' "$_dir/out")"
+    check "$3: no derived file or copy left" "" "$(derived_in "$_dir")"
+}
+local_refuse_case l1 "https://example.com/%s/%s" "local operator template set"
+local_refuse_case l2 "https://raw.githubusercontent.com/crowdsecurity/hub/%s/%s" "local template set to the built-in value"
+
+C12="$WORK/c12"
+make_live "$C12"
+printf 'cscli:\n  __hub_url_template__: ""\n' >"$C12/config.yaml.local"
+D12=$(prepared "$C12/config.yaml" c12)
+check "local template left empty is accepted and copied" "$D12" "$([ -r "$D12" ] && echo "$D12")"
+check "local template left empty: the copy is beside the derived config" "1" "$([ -r "$D12.local" ] && echo 1)"
+
+# ---------------------------------------------------------------------------
+echo "# relative path, startup sweep and removal"
+C9="$WORK/c9"
+make_live "$C9"
+(
+    cd "$C9" || exit 1
+    . "$HELPER"
+    hub_mirror_prepare config.yaml
+    printf '%s\n' "${CHARON_CSCLI_MIRROR_CONFIG:-}"
+) >"$WORK/c9.path" 2>/dev/null
+REL=$(cat "$WORK/c9.path")
+check "relative live path puts the derived config beside it" "1" "$([ -r "$C9/${REL#./}" ] && echo 1)"
+
+printf 'old\n' >"$C9/.charon-hub-mirror-999.yaml"
+printf 'old\n' >"$C9/.charon-hub-mirror-999.yaml.local"
+printf 'keep\n' >"$C9/keep.yaml"
+(
+    . "$HELPER"
+    hub_mirror_prepare "$C9/config.yaml"
+) >/dev/null 2>&1
+check "startup sweep removes a crash leftover" "" "$(derived_in "$C9" | grep 'charon-hub-mirror-999' || true)"
+check "startup sweep keeps unrelated files" "1" "$([ -r "$C9/keep.yaml" ] && echo 1)"
+
+(
+    . "$HELPER"
+    hub_mirror_prepare "$C9/config.yaml"
+    hub_mirror_remove
+    printf 'after=%s\n' "${CHARON_CSCLI_MIRROR_CONFIG:-unset}"
+) >"$WORK/c9r.out" 2>&1
+check "remove forgets the derived path" "after=unset" "$(grep '^after=' "$WORK/c9r.out")"
+check "remove deletes the derived config and its copy" "" "$(derived_in "$C9")"
+
+(
+    . "$HELPER"
+    CHARON_CSCLI_MIRROR_CONFIG="$C9/config.yaml"
+    hub_mirror_remove
+)
+check "remove never deletes a file that is not a derived config" "1" "$([ -r "$C9/config.yaml" ] && echo 1)"
+
+# ---------------------------------------------------------------------------
+echo "# cscli_hub retry rules"
+C10="$WORK/c10"
+make_live "$C10"
+printf 'hub_dir: /custom/hub\n' >"$C10/config.yaml.local"
+
+# run_case <name> <mode> <mirror first: 1|0> <prepare: 1|0> <budget> <cscli arguments...>
+# Runs cscli_hub in its own shell. Results go to $WORK/<name>.res, the call log to $WORK/<name>.calls.
+run_case() {
+    _name=$1
+    _mode=$2
+    _first=$3
+    _prep=$4
+    _budget=$5
+    shift 5
+    FAKE_MODE=$_mode
+    FAKE_LOG="$WORK/$_name.calls"
+    export FAKE_MODE FAKE_LOG
+    : >"$FAKE_LOG"
+    (
+        . "$HELPER"
+        if [ "$_first" = 1 ]; then
+            CHARON_CSCLI_MIRROR_FIRST=1
+            export CHARON_CSCLI_MIRROR_FIRST
+        fi
+        if [ "$_prep" = 1 ]; then
+            hub_mirror_prepare "$C10/config.yaml" || echo "prepare-failed"
+        fi
+        _rc=0
+        cscli_hub "$_budget" "$@" >"$WORK/$_name.out" 2>&1 || _rc=$?
+        printf 'rc=%s\n' "$_rc"
+        printf 'flag=%s\n' "${CHARON_CSCLI_MIRROR_FIRST:-}"
+        hub_mirror_remove
+        printf 'left=%s\n' "$(derived_in "$C10" | wc -l | tr -d ' ')"
+    ) >"$WORK/$_name.res" 2>&1
+}
+res() {
+    grep "^$2=" "$WORK/$1.res" | head -n 1 | sed "s/^$2=//"
+}
+ncalls() {
+    wc -l <"$WORK/$1.calls" | tr -d ' '
+}
+call() {
+    normcalls "$WORK/$1.calls" | sed -n "$2p"
+}
+
+run_case live_ok live_ok 0 1 4 hub update
+check "live success: exit 0" "0" "$(res live_ok rc)"
+check "live success: one call, on the live config" "1" "$(ncalls live_ok)"
+check "live success: no mirror mode" "" "$(res live_ok flag)"
+
+run_case live_net live_net 0 1 4 hub update
+check "network failure: exit 0 after the retry" "0" "$(res live_net rc)"
+check "network failure: two calls" "2" "$(ncalls live_net)"
+check "network failure: the retry sees the template and the .local copy" \
+    "cfg=derived tpl=1 local=1 args=hub update" "$(call live_net 2)"
+check "network failure: mirror mode turned on" "1" "$(res live_net flag)"
+check "network failure: derived files removed after the run" "0" "$(res live_net left)"
+
+run_case live_bad live_bad 0 1 4 hub update
+check "item error: exit non-zero" "1" "$(res live_bad rc)"
+check "item error: not retried" "1" "$(ncalls live_bad)"
+check "item error: no mirror mode" "" "$(res live_bad flag)"
+
+run_case live_hang live_hang 0 1 4 hub update
+check "hub update timeout: retried and answered" "0" "$(res live_hang rc)"
+check "hub update timeout: two calls" "2" "$(ncalls live_hang)"
+check "hub update timeout: the retry is on the derived config" \
+    "cfg=derived tpl=1 local=1 args=hub update" "$(call live_hang 2)"
+
+run_case hang_item live_hang 0 1 4 collections install crowdsecurity/x
+check "item install timeout: not retried" "1" "$(ncalls hang_item)"
+check "item install timeout: fails" "1" "$([ "$(res hang_item rc)" != 0 ] && echo 1)"
+
+run_case item_net live_net 0 1 60 collections install crowdsecurity/x
+check "item install network failure: live install, derived hub update, derived install" "3" "$(ncalls item_net)"
+check "item install retry runs hub update under the derived config first" \
+    "cfg=derived tpl=1 local=1 args=hub update" "$(call item_net 2)"
+check "item install retry then runs the install under the derived config" \
+    "cfg=derived tpl=1 local=1 args=collections install crowdsecurity/x" "$(call item_net 3)"
+check "item install retry answered: mirror mode turned on" "1" "$(res item_net flag)"
+
+run_case upgrade_net live_net 0 1 4 hub upgrade
+check "hub upgrade network failure: hub update runs before the retry" "3" "$(ncalls upgrade_net)"
+check "hub upgrade retry: the pre-update is a hub update" \
+    "cfg=derived tpl=1 local=1 args=hub update" "$(call upgrade_net 2)"
+
+run_case both_net both_net 0 1 4 hub update
+check "both networks down: exit non-zero" "1" "$([ "$(res both_net rc)" != 0 ] && echo 1)"
+check "both networks down: no mirror mode" "" "$(res both_net flag)"
+
+run_case no_derived live_net 0 0 4 hub update
+check "no derived config: no retry" "1" "$(ncalls no_derived)"
+
+run_case not_network live_net 0 1 4 hub list
+check "non-network command: one attempt, no retry" "1" "$(ncalls not_network)"
+
+# A bare expired deadline retries only a hub update, as on the Go side; item installs and hub upgrades do not.
+run_case item_deadline live_deadline 0 1 60 collections install crowdsecurity/x
+check "item install bare deadline: not retried" "1" "$(ncalls item_deadline)"
+check "item install bare deadline: fails" "1" "$([ "$(res item_deadline rc)" != 0 ] && echo 1)"
+
+run_case upgrade_deadline live_deadline 0 1 60 collections upgrade crowdsecurity/x
+check "item upgrade bare deadline: not retried" "1" "$(ncalls upgrade_deadline)"
+
+run_case hubupgrade_deadline live_deadline 0 1 4 hub upgrade
+check "hub upgrade bare deadline: not retried" "1" "$(ncalls hubupgrade_deadline)"
+
+run_case hubupdate_deadline live_deadline 0 1 4 hub update
+check "hub update bare deadline: retried on the derived config" "2" "$(ncalls hubupdate_deadline)"
+check "hub update bare deadline: answered, exit 0" "0" "$(res hubupdate_deadline rc)"
+
+# A client timeout is a transport failure and retries an item install, as on the Go side.
+run_case item_transport live_transport 0 1 60 collections install crowdsecurity/x
+check "item install client timeout: retried through the mirror" "3" "$(ncalls item_transport)"
+check "item install client timeout: mirror mode turned on" "1" "$(res item_transport flag)"
+
+# A timeout that cscli reports with its own signal text (a trapped TERM and exit 1, no 124 or 143) is a timeout.
+# Hub update retries it on the mirror; item installs and hub upgrades do not.
+run_case term_update live_term 0 1 4 hub update
+check "trapped timeout: hub update exit 0 after the mirror retry" "0" "$(res term_update rc)"
+check "trapped timeout: hub update retried on the derived config" \
+    "cfg=derived tpl=1 local=1 args=hub update" "$(call term_update 2)"
+check "trapped timeout: two calls" "2" "$(ncalls term_update)"
+
+run_case term_item live_term 0 1 2 collections install crowdsecurity/x
+check "trapped timeout: item install not retried" "1" "$(ncalls term_item)"
+check "trapped timeout: item install fails" "1" "$([ "$(res term_item rc)" != 0 ] && echo 1)"
+
+run_case term_upgrade live_term 0 1 4 hub upgrade
+check "trapped timeout: hub upgrade not retried" "1" "$(ncalls term_upgrade)"
+
+# No signal text: a non-zero exit at the budget (less one second) is a timeout too, for hub update only.
+run_case quiet_update live_quiet 0 1 4 hub update
+check "budget expiry without text: hub update exit 0 after the mirror retry" "0" "$(res quiet_update rc)"
+check "budget expiry without text: two calls" "2" "$(ncalls quiet_update)"
+
+run_case quiet_item live_quiet 0 1 2 collections install crowdsecurity/x
+check "budget expiry without text: item install not retried" "1" "$(ncalls quiet_item)"
+
+# When config.yaml.local names a template, the prepare fails and cscli_hub does not retry.
+C13="$WORK/c13"
+make_live "$C13"
+printf 'cscli:\n  __hub_url_template__: "https://example.com/%%s/%%s"\n' >"$C13/config.yaml.local"
+(
+    . "$HELPER"
+    FAKE_MODE=live_net
+    FAKE_LOG="$WORK/local_refused.calls"
+    export FAKE_MODE FAKE_LOG
+    : >"$FAKE_LOG"
+    hub_mirror_prepare "$C13/config.yaml" || echo "prepare-failed"
+    cscli_hub 4 hub update >/dev/null 2>&1 || true
+) >"$WORK/local_refused.res" 2>&1
+check "local template set: prepare fails" "1" "$(grep -c '^prepare-failed$' "$WORK/local_refused.res")"
+check "local template set: no retry after the failed prepare" "1" "$(wc -l <"$WORK/local_refused.calls" | tr -d ' ')"
+check "local template set: no derived file left" "" "$(derived_in "$C13")"
+
+run_case mirror_first live_net 1 1 4 hub update
+check "mirror first: the first call is the derived config" \
+    "cfg=derived tpl=1 local=1 args=hub update" "$(call mirror_first 1)"
+check "mirror first: one call when the mirror answers" "1" "$(ncalls mirror_first)"
+check "mirror first: mode stays on" "1" "$(res mirror_first flag)"
+
+run_case rescued derived_net 1 1 60 collections install crowdsecurity/x
+check "mirror first, rescued by the live config: exit 0" "0" "$(res rescued rc)"
+check "mirror first, rescued: derived install, then live hub update and live install" "3" "$(ncalls rescued)"
+check "mirror first, rescued: the live hub update runs before the live install" \
+    "cfg=live tpl=0 local=0 args=hub update" "$(call rescued 2)"
+check "mirror first, rescued: mirror mode turned off" "" "$(res rescued flag)"
+
+run_case clean live_ok 0 1 4 hub update
+check "live success leaves no mirror mode behind" "" "$(res clean flag)"
+
+# ---------------------------------------------------------------------------
+echo "# install path (configs/crowdsec/install_hub_items.sh)"
+INSTALL_SRC="$REPO_DIR/configs/crowdsec/install_hub_items.sh"
+# The patterns below are literal source text to find, so the dollar signs must not expand.
+# shellcheck disable=SC2016
+check "install script bounds each install with cscli_hub 60" "1" \
+    "$(grep -c 'cscli_hub 60 "${type}" install "${name}"' "$INSTALL_SRC")"
+# shellcheck disable=SC2016
+check "install script keeps inspect plain (no mirror, no timeout)" "1" \
+    "$(grep -c 'cscli "\$1" inspect "\$2"' "$INSTALL_SRC")"
+
+# An install that hangs is cut at its budget and not retried (no network text in the output).
+run_case hang_install_budget live_hang 0 1 2 collections install crowdsecurity/x
+check "install hang: cut at its budget, one attempt" "1" "$(ncalls hang_install_budget)"
+
+# run_install <name> <mode> <mirror first 1|0> <prepare 1|0> <helper path>
+# Runs a copy of install_hub_items.sh with the helper path pointed at <helper path>.
+run_install() {
+    _name=$1
+    _mode=$2
+    _first=$3
+    _prep=$4
+    _helper=$5
+    FAKE_MODE=$_mode
+    FAKE_LOG="$WORK/$_name.calls"
+    export FAKE_MODE FAKE_LOG
+    : >"$FAKE_LOG"
+    sed "s#/usr/local/lib/charon/cscli-hub-mirror.sh#$_helper#" "$INSTALL_SRC" >"$WORK/$_name.sh"
+    (
+        if [ "$_first" = 1 ]; then
+            CHARON_CSCLI_MIRROR_FIRST=1
+            export CHARON_CSCLI_MIRROR_FIRST
+        fi
+        if [ "$_prep" = 1 ]; then
+            . "$HELPER"
+            hub_mirror_prepare "$C10/config.yaml" || echo "prepare-failed"
+        fi
+        _rc=0
+        sh "$WORK/$_name.sh" >"$WORK/$_name.out" 2>&1 || _rc=$?
+        printf 'rc=%s\n' "$_rc"
+        printf 'flag=%s\n' "${CHARON_CSCLI_MIRROR_FIRST:-}"
+        if command -v hub_mirror_remove >/dev/null 2>&1; then
+            hub_mirror_remove
+        fi
+    ) >"$WORK/$_name.res" 2>&1
+}
+
+run_install inst_ok live_ok 0 0 "$HELPER"
+check "install ok: exit 0" "rc=0" "$(grep '^rc=' "$WORK/inst_ok.res")"
+check "install ok: installs run on the live config only" "0" "$(grep -c 'cfg=[^ ]*\.yaml' "$WORK/inst_ok.calls")"
+
+run_install inst_net live_net 0 1 "$HELPER"
+check "install network failure: exit 0 (failures are not fatal)" "rc=0" "$(grep '^rc=' "$WORK/inst_net.res")"
+check "install network failure: exactly one live install attempt" "1" \
+    "$(grep -c 'cfg=live .*install' "$WORK/inst_net.calls")"
+check "install network failure: the retry runs hub update first" "1" \
+    "$(grep -c 'cfg=[^ ]*\.yaml .*args=hub update' "$WORK/inst_net.calls")"
+check "install network failure: mirror mode turned on for later installs" "1" \
+    "$(grep -c 'cfg=[^ ]*\.yaml .*args=.*install' "$WORK/inst_net.calls" | awk '{ print ($1 >= 2) ? 1 : 0 }')"
+
+run_install inst_flag live_net 1 1 "$HELPER"
+check "install with mirror-first flag: no live install attempt at all" "0" \
+    "$(grep -c 'cfg=live .*install' "$WORK/inst_flag.calls")"
+check "install with mirror-first flag: installs go to the derived config" "1" \
+    "$(grep -c 'cfg=[^ ]*\.yaml .*install' "$WORK/inst_flag.calls" | awk '{ print ($1 >= 1) ? 1 : 0 }')"
+check "install with mirror-first flag: exit 0" "rc=0" "$(grep '^rc=' "$WORK/inst_flag.res")"
+
+run_install inst_bad live_bad 0 1 "$HELPER"
+check "install item error: not retried on the mirror" "0" "$(grep -c 'cfg=[^ ]*\.yaml' "$WORK/inst_bad.calls")"
+check "install item error: reported and the script goes on" "1" \
+    "$(grep -c 'Failed to install' "$WORK/inst_bad.out" | awk '{ print ($1 >= 1) ? 1 : 0 }')"
+
+run_install inst_nohelper live_net 0 1 "$WORK/no-such-helper.sh"
+check "install without the helper: plain install, no mirror retry" "0" \
+    "$(grep -c 'cfg=[^ ]*\.yaml' "$WORK/inst_nohelper.calls")"
+check "install without the helper: still exit 0" "rc=0" "$(grep '^rc=' "$WORK/inst_nohelper.res")"
+
+run_install inst_nohelper_ok live_ok 0 0 "$WORK/no-such-helper.sh"
+check "install without the helper: installs run on the live config" "1" \
+    "$(grep -c 'cfg=live .*install' "$WORK/inst_nohelper_ok.calls" | awk '{ print ($1 >= 1) ? 1 : 0 }')"
+
+# ---------------------------------------------------------------------------
+echo "# set -e safety and the stop-aware runner"
+(
+    set -e
+    . "$HELPER"
+    FAKE_MODE=live_bad
+    FAKE_LOG="$WORK/sete.calls"
+    export FAKE_MODE FAKE_LOG
+    : >"$FAKE_LOG"
+    hub_mirror_prepare "$C10/config.yaml"
+    if ! cscli_hub 60 hub update >/dev/null 2>&1; then
+        echo "handled"
+    fi
+    echo "after"
+    hub_mirror_remove
+) >"$WORK/sete.out" 2>&1
+check "set -e: a failed cscli_hub inside if ! does not end the caller" "handled,after" \
+    "$(grep -E '^(handled|after)$' "$WORK/sete.out" | tr '\n' ',' | sed 's/,$//')"
+
+(
+    set -e
+    . "$HELPER"
+    . "$HELPER"
+    echo "sourced-twice"
+) >"$WORK/source2.out" 2>&1
+check "set -e: sourcing twice is harmless" "sourced-twice" "$(cat "$WORK/source2.out")"
+
+(
+    set -e
+    # shellcheck disable=SC2329  # invoked by cscli_hub, not by name
+    run_interruptible() {
+        echo "custom-runner"
+        "$@"
+    }
+    . "$HELPER"
+    FAKE_MODE=live_ok
+    FAKE_LOG="$WORK/custom.calls"
+    export FAKE_MODE FAKE_LOG
+    : >"$FAKE_LOG"
+    cscli_hub 4 hub update
+) >"$WORK/custom.out" 2>&1
+check "an existing run_interruptible is used, not replaced" "1" "$(grep -c '^custom-runner$' "$WORK/custom.out")"
+
+# ---------------------------------------------------------------------------
+echo "# syntax of the helper and the entrypoint"
+for s in sh dash; do
+    if command -v "$s" >/dev/null 2>&1; then
+        check "$s -n on the helper" "0" "$("$s" -n "$HELPER" >/dev/null 2>&1; echo $?)"
+        check "$s -n on the entrypoint" "0" "$("$s" -n "$ENTRYPOINT" >/dev/null 2>&1; echo $?)"
+    fi
+done
+
+echo
+echo "passed: $PASS, failed: $FAILS"
+[ "$FAILS" -eq 0 ]
diff --git a/tests/security/crowdsec-hub-offline.spec.ts b/tests/security/crowdsec-hub-offline.spec.ts
new file mode 100644
index 000000000..6ee355c20
--- /dev/null
+++ b/tests/security/crowdsec-hub-offline.spec.ts
@@ -0,0 +1,247 @@
+/**
+ * CrowdSec hub offline presets E2E Tests
+ *
+ * When the CrowdSec hub cannot be reached, the presets list is answered from the
+ * built-in and downloaded sources and says so:
+ * - `hub_offline: true` shows a passive, muted note (no banner, no button)
+ * - hub-backed rows that are not cached and report `available: false` are shown disabled
+ * - auto-select skips those rows and picks the first selectable one, or nothing
+ * - `hub_offline: false` shows no note
+ *
+ * The E2E container has no cscli or hub, so the preset list is route-mocked.
+ */
+
+import type { Page } from "@playwright/test";
+import { test, expect, loginUser } from "../fixtures/auth-fixtures";
+import { waitForLoadingComplete } from "../utils/wait-helpers";
+import { PRESETS_ROUTE, fulfillJson } from "../utils/crowdsec-stubs";
+
+const PRESETS_PATH = "/api/v1/admin/crowdsec/presets";
+const HUB_OFFLINE_NOTE =
+  "Showing built-in and downloaded presets. The hub list was not loaded.";
+
+interface PresetRowFixture {
+  slug: string;
+  title: string;
+  source: "hub" | "charon-curated";
+  requires_hub: boolean;
+  available: boolean;
+  cached: boolean;
+}
+
+/** Hub-backed row that is not cached and cannot be fetched while the hub is offline. */
+const OFFLINE_HUB_ROW: PresetRowFixture = {
+  slug: "crowdsecurity/e2e-offline-hub-preset",
+  title: "E2E Offline Hub Preset",
+  source: "hub",
+  requires_hub: true,
+  available: false,
+  cached: false,
+};
+
+/** Built-in preset that needs no hub, so it stays selectable offline. */
+const SELECTABLE_ROW: PresetRowFixture = {
+  slug: "crowdsecurity/e2e-selectable-preset",
+  title: "E2E Selectable Preset",
+  source: "charon-curated",
+  requires_hub: false,
+  available: true,
+  cached: false,
+};
+
+/** Second hub-backed row that is not cached and cannot be fetched while the hub is offline. */
+const SECOND_OFFLINE_HUB_ROW: PresetRowFixture = {
+  slug: "crowdsecurity/e2e-second-offline-hub-preset",
+  title: "E2E Second Offline Hub Preset",
+  source: "hub",
+  requires_hub: true,
+  available: false,
+  cached: false,
+};
+
+/**
+ * Stubs GET presets with the given rows and the `hub_offline` flag, and records the
+ * slugs of every pull request so tests can assert that no unavailable row was pulled.
+ */
+async function stubPresetList(
+  page: Page,
+  presets: PresetRowFixture[],
+  hubOffline: boolean,
+): Promise<{ pullSlugs: string[] }> {
+  const pullSlugs: string[] = [];
+  await page.route(PRESETS_ROUTE, async (route) => {
+    if (route.request().method() !== "GET") {
+      await route.fallback();
+      return;
+    }
+    await fulfillJson(route, { presets, hub_offline: hubOffline });
+  });
+  await page.route("**/api/v1/admin/crowdsec/presets/pull", async (route) => {
+    if (route.request().method() === "POST") {
+      const body = route.request().postDataJSON() as { slug?: string };
+      pullSlugs.push(body.slug ?? "");
+    }
+    await route.fallback();
+  });
+  return { pullSlugs };
+}
+
+/**
+ * Loads the CrowdSec page and waits for the presets response the test stubbed, so
+ * assertions run against the list the page actually received.
+ */
+async function loadPresetsPage(page: Page): Promise<void> {
+  const presetsResponse = page.waitForResponse(
+    (response) =>
+      new URL(response.url()).pathname === PRESETS_PATH &&
+      response.request().method() === "GET",
+  );
+  await page.goto("/security/crowdsec");
+  await presetsResponse;
+  await waitForLoadingComplete(page);
+}
+
+/** The preset row (role button) whose accessible name contains the title. */
+function presetRow(page: Page, title: string) {
+  return page.getByRole("button", { name: new RegExp(title, "i") });
+}
+
+test.describe("CrowdSec hub offline presets @security", () => {
+  test.beforeEach(async ({ page, adminUser }) => {
+    await loginUser(page, adminUser);
+    await waitForLoadingComplete(page);
+  });
+
+  test("should show the muted hub offline note with no banner or button when hub_offline is true", async ({
+    page,
+  }) => {
+    await stubPresetList(page, [SELECTABLE_ROW, OFFLINE_HUB_ROW], true);
+
+    await test.step("Load the presets list served without the hub", async () => {
+      await loadPresetsPage(page);
+    });
+
+    await test.step("Verify the offline note is shown with its text", async () => {
+      const note = page.getByTestId("preset-hub-offline");
+      await expect(note).toBeVisible();
+      await expect(note).toHaveText(HUB_OFFLINE_NOTE);
+    });
+
+    await test.step("Verify the note is passive: no button inside it and no hub unavailable banner", async () => {
+      await expect(
+        page.getByTestId("preset-hub-offline").getByRole("button"),
+      ).toHaveCount(0);
+      await expect(page.getByTestId("preset-hub-unavailable")).toHaveCount(0);
+      await expect(
+        page.getByRole("button", { name: "Retry", exact: true }),
+      ).toHaveCount(0);
+    });
+  });
+
+  test("should show unavailable hub rows disabled and auto-select the first selectable row", async ({
+    page,
+  }) => {
+    const { pullSlugs } = await stubPresetList(
+      page,
+      [OFFLINE_HUB_ROW, SELECTABLE_ROW],
+      true,
+    );
+
+    await test.step("Load the presets list with one unavailable hub row listed first", async () => {
+      await loadPresetsPage(page);
+    });
+
+    await test.step("Verify the unavailable row is shown disabled and not selected", async () => {
+      const offlineRow = presetRow(page, OFFLINE_HUB_ROW.title);
+      await expect(offlineRow).toBeVisible();
+      await expect(offlineRow).toHaveAttribute("aria-disabled", "true");
+      await expect(offlineRow).toHaveAttribute("aria-pressed", "false");
+    });
+
+    await test.step("Verify auto-select skipped the unavailable row and picked the first selectable row", async () => {
+      await expect(presetRow(page, SELECTABLE_ROW.title)).toHaveAttribute(
+        "aria-pressed",
+        "true",
+      );
+    });
+
+    await test.step("Verify clicking the disabled row does not select it", async () => {
+      // Force the click past Playwright's aria-disabled actionability check so the handler is exercised.
+      await presetRow(page, OFFLINE_HUB_ROW.title).click({ force: true });
+      await expect(presetRow(page, OFFLINE_HUB_ROW.title)).toHaveAttribute(
+        "aria-pressed",
+        "false",
+      );
+      await expect(presetRow(page, SELECTABLE_ROW.title)).toHaveAttribute(
+        "aria-pressed",
+        "true",
+      );
+      // Positive control: selecting a row auto-pulls its preview and Pull Preview pulls again, so
+      // the captured slugs are only asserted after the explicit pull's request and response.
+      const pullRequest = page.waitForRequest(
+        (request) =>
+          request.url().endsWith("/api/v1/admin/crowdsec/presets/pull") &&
+          request.method() === "POST",
+      );
+      const pullResponse = page.waitForResponse(
+        (response) =>
+          new URL(response.url()).pathname ===
+            "/api/v1/admin/crowdsec/presets/pull" &&
+          response.request().method() === "POST",
+      );
+      await page.getByRole("button", { name: "Pull Preview", exact: true }).click();
+      await pullRequest;
+      await pullResponse;
+      expect(new Set(pullSlugs)).toEqual(new Set([SELECTABLE_ROW.slug]));
+      expect(pullSlugs).not.toContain(OFFLINE_HUB_ROW.slug);
+    });
+  });
+
+  test("should select nothing and show no error when every row is unavailable offline", async ({
+    page,
+  }) => {
+    const { pullSlugs } = await stubPresetList(
+      page,
+      [OFFLINE_HUB_ROW, SECOND_OFFLINE_HUB_ROW],
+      true,
+    );
+
+    await test.step("Load the presets list where no row can be used", async () => {
+      await loadPresetsPage(page);
+    });
+
+    await test.step("Verify both rows are disabled and nothing is selected", async () => {
+      for (const row of [OFFLINE_HUB_ROW, SECOND_OFFLINE_HUB_ROW]) {
+        await expect(presetRow(page, row.title)).toHaveAttribute(
+          "aria-disabled",
+          "true",
+        );
+        await expect(presetRow(page, row.title)).toHaveAttribute(
+          "aria-pressed",
+          "false",
+        );
+      }
+    });
+
+    await test.step("Verify no error is shown and no pull was sent for either row", async () => {
+      await expect(page.getByRole("alert")).toHaveCount(0);
+      await expect(page.getByTestId("preset-hub-unavailable")).toHaveCount(0);
+      expect(pullSlugs).toEqual([]);
+    });
+  });
+
+  test("should show no hub offline note when hub_offline is false", async ({
+    page,
+  }) => {
+    await stubPresetList(page, [SELECTABLE_ROW, OFFLINE_HUB_ROW], false);
+
+    await test.step("Load the presets list served with the hub", async () => {
+      await loadPresetsPage(page);
+    });
+
+    await test.step("Verify the note is absent and the presets are listed", async () => {
+      await expect(presetRow(page, SELECTABLE_ROW.title)).toBeVisible();
+      await expect(page.getByTestId("preset-hub-offline")).toHaveCount(0);
+    });
+  });
+});