diff --git a/feeds/ucentral/ucentral-client/files/etc/init.d/ucentral b/feeds/ucentral/ucentral-client/files/etc/init.d/ucentral
index 93e0da093..be69e1b59 100755
--- a/feeds/ucentral/ucentral-client/files/etc/init.d/ucentral
+++ b/feeds/ucentral/ucentral-client/files/etc/init.d/ucentral
@@ -27,8 +27,6 @@ start_service() {
 	cp /etc/config-shadow/ucentral /etc/config/
 	config_load 'ucentral'
 	config_get serial 'config' 'serial'
-	config_get server 'config' 'server'
-	config_get port 'config' 'port'
 	config_get debug 'config' 'debug' 0
 	config_get insecure 'config' 'insecure' 0
 
@@ -37,6 +35,10 @@ start_service() {
 		[ "${selfsigned}" == "true" ] && insecure=1
 	fi
 
+	server=$(cat /etc/ucentral/gateway.json | jsonfilter -e '@["server"]')
+	port=$(cat /etc/ucentral/gateway.json | jsonfilter -e '@["port"]')
+	[ -n "$server" -a -n "$port" ] || return 0
+
 	boot_cause=$(cat /tmp/pstore | jsonfilter -e '@["pstore"][-1]'.boot_cause)
 	[ -z $boot_cause ] && boot_cause=coldboot
 	procd_open_instance
diff --git a/feeds/ucentral/ucentral-client/patches/0001-use-new-operational-cert-and-ca.patch b/feeds/ucentral/ucentral-client/patches/0001-use-new-operational-cert-and-ca.patch
new file mode 100644
index 000000000..cb20e245d
--- /dev/null
+++ b/feeds/ucentral/ucentral-client/patches/0001-use-new-operational-cert-and-ca.patch
@@ -0,0 +1,30 @@
+From 4d01f3ee74cd08cb894f372c8cc185d299f977a7 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Fri, 13 Jun 2025 06:28:23 +0200
+Subject: [PATCH] use new operational cert and ca
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/main.c b/main.c
+index 19a61e8..0adc07e 100644
+--- a/main.c
++++ b/main.c
+@@ -414,10 +414,10 @@ int main(int argc, char **argv)
+ 	memset(&info, 0, sizeof info);
+ 	info.port = CONTEXT_PORT_NO_LISTEN;
+ 	info.options = LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT;
+-	info.client_ssl_cert_filepath = UCENTRAL_CONFIG"cert.pem";
++	info.client_ssl_cert_filepath = UCENTRAL_CONFIG"operational.pem";
+ 	if (!stat(UCENTRAL_CONFIG"key.pem", &st))
+ 		info.client_ssl_private_key_filepath = UCENTRAL_CONFIG"key.pem";
+-	info.ssl_ca_filepath = UCENTRAL_CONFIG"cas.pem";
++	info.ssl_ca_filepath = UCENTRAL_CONFIG"operational.ca";
+ 	info.protocols = protocols;
+ 	info.fd_limit_per_thread = 1 + 1 + 1;
+         info.connect_timeout_secs = 30;
+-- 
+2.34.1
+
diff --git a/feeds/ucentral/ucentral-client/patches/0003-send-on-offline-events-to-cloud-discovery-service.patch b/feeds/ucentral/ucentral-client/patches/0003-send-on-offline-events-to-cloud-discovery-service.patch
new file mode 100644
index 000000000..0c13b665c
--- /dev/null
+++ b/feeds/ucentral/ucentral-client/patches/0003-send-on-offline-events-to-cloud-discovery-service.patch
@@ -0,0 +1,28 @@
+From 8c45f965c30d1cf11e3a5a625a5e2baf3178697f Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Tue, 12 Nov 2024 10:35:52 +0100
+Subject: [PATCH] send on/offline events to cloud discovery service
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ ubus.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/main.c
++++ b/main.c
+@@ -111,6 +111,7 @@ sul_connect_attempt(struct lws_sorted_us
+ {
+ 	struct per_vhost_data__minimal *vhd;
+ 
++	system("ubus call cloud offline");
+ 	vhd = lws_container_of(sul, struct per_vhost_data__minimal, sul);
+ 
+ 	vhd->i.context = vhd->context;
+@@ -215,6 +216,7 @@ callback_broker(struct lws *wsi, enum lw
+ 		return 0;
+ 
+ 	case LWS_CALLBACK_CLIENT_ESTABLISHED:
++		system("ubus call cloud online");
+ 		ULOG_INFO("connection established\n");
+ 		if (!client.selfsigned) {
+ 			if (!lws_tls_peer_cert_info(wsi, LWS_TLS_CERT_INFO_VALIDITY_TO, &ci, 0))
diff --git a/profiles/ucentral-ap.yml b/profiles/ucentral-ap.yml
index 322743726..54f28638a 100644
--- a/profiles/ucentral-ap.yml
+++ b/profiles/ucentral-ap.yml
@@ -20,7 +20,7 @@ packages:
   - curl
   - dnsmasq-full
   - dynamic-vlan
-  - firstcontact
+  - cloud_discovery
   - gre
   - ethtool
   - ieee8021x