diff --git a/apps/web/src/components/settings/DeviceHostsSettings.tsx b/apps/web/src/components/settings/DeviceHostsSettings.tsx
index c55cbe93f4..3dacd3f24a 100644
--- a/apps/web/src/components/settings/DeviceHostsSettings.tsx
+++ b/apps/web/src/components/settings/DeviceHostsSettings.tsx
@@ -22,6 +22,8 @@ import { MoreVertical, PlusIcon } from "lucide-react";
 import { Menu, MenuTrigger, MenuPopup, MenuItem } from "../ui/menu";
 import { SettingsRow } from "./settingsLayout";
 import { useSettingsScope } from "./SettingsScopeContext";
+import { planDeviceHostUpdates } from "./deviceHostsSettings.logic";
+import { toastManager } from "../ui/toast";
 import { useHostConnectionChecks } from "./useHostConnectionChecks";
 import { deviceHostChecksKey, parseDeviceHostDraft } from "./deviceHostConnectionChecks";
 
@@ -30,11 +32,12 @@ export function DeviceHostsSettings(props: {
   environmentId: EnvironmentId | null;
   hosts: ReadonlyArray<SshDeviceHostConfig>;
 }) {
-  const update = useAtomCommand(serverEnvironment.updateSettings);
+  const { scope, environments, connectedEnvironments } = useSettingsScope();
+  const projectScope = scope.kind === "project" || scope.kind === "checkout";
+  const update = useAtomCommand(serverEnvironment.updateSettings, { reportFailure: false });
   const test = useAtomCommand(deviceEnvironment.testHost, { reportFailure: false });
   const retry = useAtomCommand(deviceEnvironment.list);
   const { state } = useDeviceState(props.environmentId);
-  const { environments } = useSettingsScope();
   const targets = environments.map((environment) => ({
     environmentId: environment.environmentId,
     label: environment.label,
@@ -43,6 +46,8 @@ export function DeviceHostsSettings(props: {
   const { checks: environmentChecks, testConnection: testAcrossEnvironments } =
     useHostConnectionChecks(targets);
   const [editing, setEditing] = useState<SshDeviceHostConfig | null>(null);
+  const [originalHost, setOriginalHost] = useState<SshDeviceHostConfig | null>(null);
+  const [identityFileEdited, setIdentityFileEdited] = useState(false);
   const parsedEditing = editing ? parseDeviceHostDraft(editing) : Option.none();
   const validEditing = Option.isSome(parsedEditing) && editing?.label.trim() !== "";
   const [busy, setBusy] = useState(false);
@@ -60,47 +65,91 @@ export function DeviceHostsSettings(props: {
   >({});
   const setCheck = (id: string, value: (typeof checks)[string]) =>
     setChecks((current) => ({ ...current, [id]: value }));
-  const save = async (hosts: ReadonlyArray<SshDeviceHostConfig>) => {
-    if (!props.environmentId) return;
+  const checkKey = (environmentId: EnvironmentId, hostId: string) =>
+    JSON.stringify([environmentId, hostId]);
+  const save = async (
+    host: SshDeviceHostConfig,
+    original: SshDeviceHostConfig | null,
+    remove = false,
+  ) => {
+    if (!props.environmentId || projectScope) return;
     setBusy(true);
     try {
-      const saved = await update({
-        environmentId: props.environmentId,
-        input: { patch: { deviceHosts: hosts } },
-      });
-      if (saved._tag === "Success") {
+      const plan = planDeviceHostUpdates(
+        environments.map((environment) => ({
+          environmentId: environment.environmentId,
+          label: environment.label,
+          connected: environment.connection.phase === "connected",
+          hosts: environment.serverConfig?.settings.deviceHosts ?? null,
+        })),
+        host,
+        original,
+        remove,
+        identityFileEdited,
+      );
+      const results = await Promise.allSettled(
+        plan.writes.map((target) =>
+          update({
+            environmentId: target.environmentId,
+            input: { patch: { deviceHosts: target.hosts } },
+          }),
+        ),
+      );
+      const failed = [
+        ...plan.failed,
+        ...plan.writes.flatMap((target, index) => {
+          const result = results[index];
+          return result?.status !== "fulfilled" || result.value._tag === "Failure"
+            ? [target.label]
+            : [];
+        }),
+      ];
+      if (failed.length === 0) {
         setEditing(null);
+        setOriginalHost(null);
+        setIdentityFileEdited(false);
+      } else {
+        toastManager.add({
+          type: "error",
+          title: "Device hosts not saved on all environments",
+          description: `Could not update ${failed.join(", ")}.`,
+        });
       }
     } finally {
       setBusy(false);
     }
   };
-  const testConnection = async (host: SshDeviceHostConfig) => {
-    if (!props.environmentId || checks[host.id]?.pending) return;
-    setCheck(host.id, { pending: true });
+  const testConnection = async (host: SshDeviceHostConfig, environmentId: EnvironmentId) => {
+    const key = checkKey(environmentId, host.id);
+    if (checks[key]?.pending) return;
+    setCheck(key, { pending: true });
     try {
-      const summary = await test({ environmentId: props.environmentId, input: host });
+      const summary = await test({ environmentId, input: host });
       setCheck(
-        host.id,
+        key,
         summary._tag === "Failure"
           ? { error: Cause.pretty(summary.cause) }
           : { platforms: summary.value.platforms },
       );
     } catch (error) {
-      setCheck(host.id, { error: error instanceof Error ? error.message : String(error) });
+      setCheck(key, { error: error instanceof Error ? error.message : String(error) });
     }
   };
   return (
     <SettingsRow
       id="device-hosts"
       title="Device hosts"
-      description="Add remote machines with simulator or emulator runtimes installed, and this environment will connect over SSH and set up device tools automatically."
+      serverScoped
+      settingKeys={["deviceHosts"]}
+      description="Add remote machines with simulator or emulator runtimes installed. Changes apply to the selected environments."
       control={
         <Button
           size="sm"
           variant="outline"
-          disabled={busy || !props.environmentId || editing !== null}
+          disabled={projectScope || busy || !props.environmentId || editing !== null}
           onClick={() => {
+            setOriginalHost(null);
+            setIdentityFileEdited(false);
             setEditing({ id: randomUUID(), label: "", target: "" });
           }}
         >
@@ -111,13 +160,23 @@ export function DeviceHostsSettings(props: {
       <div className="pt-3 pb-2">
         {!props.environmentId ? (
           <p className="text-sm text-muted-foreground">
-            Select one connected environment to manage its device hosts.
+            Connect a selected environment to manage device hosts.
           </p>
         ) : (
           <>
+            {connectedEnvironments.length > 1 ? (
+              <p className="pt-2 text-xs text-muted-foreground">
+                {
+                  connectedEnvironments.find(
+                    (environment) => environment.environmentId === props.environmentId,
+                  )?.label
+                }{" "}
+                · local device status
+              </p>
+            ) : null}
             {props.hosts.map((host) => {
               const status = state.hostStatuses[host.id];
-              const check = checks[host.id];
+              const check = checks[checkKey(props.environmentId!, host.id)];
               const platforms =
                 check?.platforms ??
                 state.hosts.find((value) => value.id === host.id)?.platforms ??
@@ -173,8 +232,7 @@ export function DeviceHostsSettings(props: {
                     <DeviceToolVersions
                       error={state.hosts.find((value) => value.id === host.id)?.toolInspectionError}
                       tools={
-                        state.hosts.find((value) => value.id === host.id)?.tools ??
-                        checks[host.id]?.tools
+                        state.hosts.find((value) => value.id === host.id)?.tools ?? check?.tools
                       }
                     />
                     {error ? (
@@ -201,7 +259,7 @@ export function DeviceHostsSettings(props: {
                         <Button
                           size="icon-sm"
                           variant="ghost-muted"
-                          disabled={busy}
+                          disabled={busy || projectScope}
                           aria-label={host.label + " options"}
                         />
                       }
@@ -211,17 +269,14 @@ export function DeviceHostsSettings(props: {
                     <MenuPopup align="end">
                       <MenuItem
                         onClick={() => {
+                          setOriginalHost(host);
+                          setIdentityFileEdited(false);
                           setEditing(host);
                         }}
                       >
                         Edit
                       </MenuItem>
-                      <MenuItem
-                        variant="destructive"
-                        onClick={() =>
-                          void save(props.hosts.filter((value) => value.id !== host.id))
-                        }
-                      >
+                      <MenuItem variant="destructive" onClick={() => void save(host, host, true)}>
                         Remove
                       </MenuItem>
                     </MenuPopup>
@@ -249,7 +304,7 @@ export function DeviceHostsSettings(props: {
                       size="sm"
                       variant="outline"
                       disabled={busy || progress !== null}
-                      onClick={() => void testConnection(host)}
+                      onClick={() => void testConnection(host, props.environmentId!)}
                     >
                       Test connection
                     </Button>
@@ -257,16 +312,71 @@ export function DeviceHostsSettings(props: {
                 </div>
               );
             })}
+            {connectedEnvironments
+              .filter((environment) => environment.environmentId !== props.environmentId)
+              .map((environment) => (
+                <div key={environment.environmentId} className="border-t border-border/50 pt-3">
+                  <p className="pb-1 text-xs font-medium text-muted-foreground">
+                    {environment.label}
+                  </p>
+                  {(environment.serverConfig?.settings.deviceHosts ?? []).map((host) => {
+                    const check = checks[checkKey(environment.environmentId, host.id)];
+                    return (
+                      <div key={host.id} className="py-2">
+                        <div className="flex items-center gap-2">
+                          <div className="min-w-0 flex-1">
+                            <p className="truncate text-sm font-medium">{host.label}</p>
+                            <p className="truncate text-xs text-muted-foreground">{host.target}</p>
+                          </div>
+                          <Button
+                            size="sm"
+                            variant="outline"
+                            disabled={busy || check?.pending}
+                            onClick={() => void testConnection(host, environment.environmentId)}
+                          >
+                            {check?.pending ? "Checking…" : "Test"}
+                          </Button>
+                          <Button
+                            size="sm"
+                            variant="outline"
+                            disabled={busy || projectScope}
+                            onClick={() => {
+                              setOriginalHost(host);
+                              setIdentityFileEdited(false);
+                              setEditing(host);
+                            }}
+                          >
+                            Edit
+                          </Button>
+                          <Button
+                            size="sm"
+                            variant="ghost"
+                            disabled={busy || projectScope}
+                            onClick={() => void save(host, host, true)}
+                          >
+                            Remove
+                          </Button>
+                        </div>
+                        {check?.platforms ? (
+                          <DeviceHostAvailability platforms={check.platforms} />
+                        ) : null}
+                        {check?.error ? (
+                          <p role="alert" className="text-xs text-destructive">
+                            {check.error}
+                          </p>
+                        ) : null}
+                      </div>
+                    );
+                  })}
+                </div>
+              ))}
             {editing ? (
               <form
                 className="space-y-3 border-t border-border/50 py-3"
                 onSubmit={(event) => {
                   event.preventDefault();
                   if (validEditing && Option.isSome(parsedEditing)) {
-                    void save([
-                      ...props.hosts.filter((host) => host.id !== editing.id),
-                      parsedEditing.value,
-                    ]);
+                    void save(parsedEditing.value, originalHost);
                   }
                 }}
               >
@@ -275,7 +385,7 @@ export function DeviceHostsSettings(props: {
                   <Input
                     required
                     value={editing.label}
-                    disabled={busy}
+                    disabled={busy || projectScope}
                     onChange={(event) => setEditing({ ...editing, label: event.target.value })}
                     placeholder="Mac mini"
                   />
@@ -285,17 +395,21 @@ export function DeviceHostsSettings(props: {
                   <Input
                     required
                     value={editing.target}
-                    disabled={busy}
+                    disabled={busy || projectScope}
                     onChange={(event) => setEditing({ ...editing, target: event.target.value })}
                     placeholder="user@host or SSH alias"
                   />
                 </label>
                 <label className="block space-y-1 text-sm">
                   <span>Identity file, optional</span>
+                  <span className="block text-xs text-muted-foreground">
+                    Each environment keeps its own path unless you change this field.
+                  </span>
                   <Input
                     value={editing.identityFile ?? ""}
-                    disabled={busy}
+                    disabled={busy || projectScope}
                     onChange={(event) => {
+                      setIdentityFileEdited(true);
                       const { identityFile: _, ...rest } = editing;
                       setEditing(
                         event.target.value ? { ...rest, identityFile: event.target.value } : rest,
@@ -311,7 +425,7 @@ export function DeviceHostsSettings(props: {
                     min={1}
                     max={65535}
                     value={editing.port ?? ""}
-                    disabled={busy}
+                    disabled={busy || projectScope}
                     onChange={(event) => {
                       const { port: _, ...rest } = editing;
                       setEditing(
@@ -322,14 +436,14 @@ export function DeviceHostsSettings(props: {
                   />
                 </label>
                 <div className="flex flex-wrap gap-2">
-                  <Button size="sm" type="submit" disabled={busy || !validEditing}>
+                  <Button size="sm" type="submit" disabled={projectScope || busy || !validEditing}>
                     Save host
                   </Button>
                   <Button
                     size="sm"
                     type="button"
                     variant="outline"
-                    disabled={busy || !validEditing}
+                    disabled={projectScope || busy || !validEditing}
                     onClick={() => {
                       if (Option.isSome(parsedEditing))
                         void testAcrossEnvironments(parsedEditing.value);
diff --git a/apps/web/src/components/settings/IntegrationsSettings.test.tsx b/apps/web/src/components/settings/IntegrationsSettings.test.tsx
index 17d18f1ad0..6757479385 100644
--- a/apps/web/src/components/settings/IntegrationsSettings.test.tsx
+++ b/apps/web/src/components/settings/IntegrationsSettings.test.tsx
@@ -15,21 +15,74 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test"
 
 const { listBrowserImportSources, selectedDeviceEnvironment } = vi.hoisted(() => ({
   listBrowserImportSources: vi.fn().mockResolvedValue([]),
-  selectedDeviceEnvironment: { id: null as string | null, aggregate: false, projectScope: false },
+  selectedDeviceEnvironment: {
+    id: null as string | null,
+    aggregate: false,
+    projectScope: false,
+    versioned: false,
+  },
 }));
 
 vi.mock("../preview/previewBridge", () => ({
   previewBridge: { listBrowserImportSources },
 }));
 vi.mock("../../env", () => ({ isElectron: true }));
+vi.mock("../../state/device", async (importOriginal) => {
+  const original = await importOriginal<typeof import("../../state/device")>();
+  return {
+    ...original,
+    useDeviceState: (environmentId: Parameters<typeof original.useDeviceState>[0]) =>
+      selectedDeviceEnvironment.versioned
+        ? {
+            loaded: true,
+            state: {
+              hosts: [
+                {
+                  id: "local",
+                  kind: "local",
+                  label: "This machine",
+                  hubInstalled: true,
+                  agentDeviceInstalled: true,
+                  platforms: [],
+                  tools: {
+                    hub: { requiredVersion: "2", installedVersions: ["1"], runningVersion: "1" },
+                    agent: {
+                      requiredVersion: "2",
+                      installedVersions: ["1"],
+                      runningVersion: "1",
+                    },
+                  },
+                },
+              ],
+              hostStatus: "ready",
+              hostStatuses: {},
+              devices: [],
+              sessions: [],
+              onboardingCompleted: true,
+              agentAccessEnabled: true,
+              hubBasePath: "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/api/device-hub",
+              revision: 1,
+              supportsToolUpdate: true,
+              supportsToolInspection: true,
+            } satisfies DeviceServiceState,
+          }
+        : original.useDeviceState(environmentId),
+  };
+});
+vi.mock("../device/DeviceToolVersions", () => ({
+  DeviceToolVersions: ({ action, kind }: { action: ReactNode; kind: string }) => (
+    <div data-tool-version-kind={kind}>{action}</div>
+  ),
+}));
 vi.mock("../../state/environments", () => ({
   useEnvironments: () => ({ environments: [], isReady: true }),
   usePrimaryEnvironment: () => null,
 }));
 vi.mock("../../hooks/useSettings", () => ({
   PRIMARY_SETTINGS_UNAVAILABLE_MESSAGE: "Connect to an environment",
-  useClientSettings: (selector: (settings: typeof DEFAULT_CLIENT_SETTINGS) => unknown) =>
-    selector(DEFAULT_CLIENT_SETTINGS),
+  mergeEnvironmentSettings: (server: object, client: object) => ({ ...server, ...client }),
+  useClientSettings: (selector?: (settings: typeof DEFAULT_CLIENT_SETTINGS) => unknown) =>
+    selector ? selector(DEFAULT_CLIENT_SETTINGS) : DEFAULT_CLIENT_SETTINGS,
   useClientSettingsHydrated: () => true,
   usePrimarySettingsAvailable: () => true,
   usePrimarySettings: () => DEFAULT_UNIFIED_SETTINGS,
@@ -44,6 +97,7 @@ vi.mock("./settingsLayout", async (importOriginal) => ({
 vi.mock("./ProjectDefaultsSettings", () => ({ ProjectDefaultsSettings: () => null }));
 vi.mock("./SettingsScopeContext", () => ({
   useSettingsScope: () => ({
+    search: {},
     scope: {
       kind: selectedDeviceEnvironment.projectScope ? "project" : "all",
       environmentIds: selectedDeviceEnvironment.aggregate ? ["remote", "other"] : [],
@@ -56,7 +110,20 @@ vi.mock("./SettingsScopeContext", () => ({
           serverConfig: { settings: DEFAULT_UNIFIED_SETTINGS },
         }
       : null,
-    connectedEnvironments: selectedDeviceEnvironment.aggregate ? [{}, {}] : [],
+    connectedEnvironments: selectedDeviceEnvironment.aggregate
+      ? [
+          {
+            environmentId: "remote",
+            label: "Selected remote",
+            serverConfig: { settings: DEFAULT_UNIFIED_SETTINGS },
+          },
+          {
+            environmentId: "other",
+            label: "Other",
+            serverConfig: { settings: DEFAULT_UNIFIED_SETTINGS },
+          },
+        ]
+      : [],
     environments: selectedDeviceEnvironment.aggregate
       ? [
           { environmentId: "remote", label: "Selected remote", connection: { phase: "connected" } },
@@ -79,6 +146,7 @@ beforeEach(() => {
   selectedDeviceEnvironment.id = null;
   selectedDeviceEnvironment.aggregate = false;
   selectedDeviceEnvironment.projectScope = false;
+  selectedDeviceEnvironment.versioned = false;
 });
 
 afterEach(async () => {
@@ -121,7 +189,7 @@ describe("Integrations browser discovery", () => {
     expect(sections.indexOf("devices")).toBeGreaterThan(sections.indexOf("browser"));
   });
 
-  it("names the header's representative device environment without a second selector", async () => {
+  it("shows the selected device settings without a second selector", async () => {
     selectedDeviceEnvironment.id = "selected-remote";
     selectedDeviceEnvironment.aggregate = true;
     await openSettings();
@@ -130,13 +198,13 @@ describe("Integrations browser discovery", () => {
     )[0]!;
     expect(
       section.findAll((node) => node.type === "h2").map((node) => node.children.join("")),
-    ).toContain("Devices · Selected remote");
+    ).toContain("Devices");
     expect(
       section.findAll((node) => node.props["aria-label"] === "Device environment"),
     ).toHaveLength(0);
   });
 
-  it("keeps environment device helpers but removes their permission switch at a project scope", async () => {
+  it("keeps environment device helpers and the project-scoped permission switch", async () => {
     selectedDeviceEnvironment.projectScope = true;
     await openSettings();
     const section = renderer!.root.findAll(
@@ -144,11 +212,37 @@ describe("Integrations browser discovery", () => {
     )[0]!;
     expect(
       section.findAll((node) => node.props["aria-label"] === "Agent device access"),
-    ).toHaveLength(0);
+    ).not.toHaveLength(0);
     expect(
       section.findAll((node) => node.props["aria-label"] === "Device hub").length,
     ).toBeGreaterThan(0);
   });
+
+  it("offers manual tool updates only at environment scope while retaining project inspection", async () => {
+    selectedDeviceEnvironment.id = "selected-remote";
+    selectedDeviceEnvironment.aggregate = true;
+    selectedDeviceEnvironment.versioned = true;
+    selectedDeviceEnvironment.projectScope = true;
+    await openSettings();
+    const project = renderer!.root.findAll(
+      (node) => node.type === "section" && node.props.id === "devices",
+    )[0]!;
+    expect(
+      project.findAll((node) => node.props["aria-label"] === "Agent device access"),
+    ).not.toHaveLength(0);
+    expect(project.findAll((node) => node.children.includes("Check versions"))).not.toHaveLength(0);
+    expect(project.findAll((node) => node.children.includes("Update to v2"))).toHaveLength(0);
+
+    await act(() => renderer?.unmount());
+    selectedDeviceEnvironment.projectScope = false;
+    await openSettings();
+    const environment = renderer!.root.findAll(
+      (node) => node.type === "section" && node.props.id === "devices",
+    )[0]!;
+    expect(environment.findAll((node) => node.children.includes("Update to v2"))).not.toHaveLength(
+      0,
+    );
+  });
 });
 
 const deviceState = (overrides: Partial<DeviceServiceState> = {}): DeviceServiceState => ({
diff --git a/apps/web/src/components/settings/IntegrationsSettings.tsx b/apps/web/src/components/settings/IntegrationsSettings.tsx
index 836cbb4f4b..8e8187c531 100644
--- a/apps/web/src/components/settings/IntegrationsSettings.tsx
+++ b/apps/web/src/components/settings/IntegrationsSettings.tsx
@@ -2,6 +2,9 @@ import { DeviceHostUpdates } from "../device/DeviceHostUpdates";
 import { DeviceToolVersions } from "../device/DeviceToolVersions";
 import { ComputerIntegrationSettings } from "./ComputerIntegrationSettings";
 import { DeviceHostsSettings } from "./DeviceHostsSettings";
+import { useScopedSettings, useUpdateScopedSettings } from "./useScopedSettings";
+import { ScopedSwitch } from "./ScopedSwitch";
+import { configureSelectedDeviceEnvironments } from "./deviceIntegrationSettings.logic";
 /**
  * Integrations settings - preferences for surfaces Pylon embeds rather than
  * owns. Browser is the first section: the defaults a preview tab opens at,
@@ -606,25 +609,21 @@ function BrowserLinkTargetSetting({ disabled }: { readonly disabled: boolean })
   );
 }
 
-/** Device helpers and hosts belong to the environment selected by the settings header. */
+/** Device status is shown for the representative; settings follow the selected scope. */
 function DeviceIntegrationSettings() {
-  const { scope, environment: selected, connectedEnvironments } = useSettingsScope();
+  const { search, environment: selected } = useSettingsScope();
+  const settings = useScopedSettings();
   const connected = selected?.connection.phase === "connected" && selected.serverConfig !== null;
   const environmentId = connected ? selected.environmentId : null;
-  const aggregate = scope.environmentIds.length !== 1 && connectedEnvironments.length > 1;
 
   return (
-    <SettingsSection
-      id="devices"
-      title={aggregate && selected ? `Devices · ${selected.label}` : "Devices"}
-    >
+    <SettingsSection id="devices" title="Devices">
       <DeviceIntegrationControls
-        key={selected?.environmentId ?? "none"}
+        key={`${environmentId}:${JSON.stringify(search)}`}
         environmentId={environmentId}
         hosts={selected?.serverConfig?.settings.deviceHosts ?? []}
-        enabled={selected?.serverConfig?.settings.enableDeviceSupport ?? false}
-        agentAccessEnabled={selected?.serverConfig?.settings.enableAgentDeviceAccess ?? false}
-        showAgentAccess={scope.kind !== "project" && scope.kind !== "checkout"}
+        enabled={settings.enableDeviceSupport}
+        agentAccessEnabled={settings.enableAgentDeviceAccess}
       />
     </SettingsSection>
   );
@@ -635,16 +634,20 @@ function DeviceIntegrationControls({
   hosts,
   enabled,
   agentAccessEnabled,
-  showAgentAccess,
 }: {
   environmentId: EnvironmentId | null;
   hosts: ReadonlyArray<SshDeviceHostConfig>;
   enabled: boolean;
   agentAccessEnabled: boolean;
-  showAgentAccess: boolean;
 }) {
   const { state, loaded } = useDeviceState(environmentId);
-  const configure = useAtomCommand(deviceEnvironment.configure);
+  const { scope, environments, connectedEnvironments } = useSettingsScope();
+  const updateSettings = useUpdateScopedSettings();
+  const projectScope = scope.kind === "project" || scope.kind === "checkout";
+  const anyHubEnabled = connectedEnvironments.some(
+    (environment) => environment.serverConfig?.settings.enableDeviceSupport,
+  );
+  const configure = useAtomCommand(deviceEnvironment.configure, { reportFailure: false });
   const list = useAtomCommand(deviceEnvironment.list, { reportFailure: false });
   const [pending, setPending] = useState<
     "hub" | "check" | "agent" | "update-hub" | "update-agent" | null
@@ -664,9 +667,23 @@ function DeviceIntegrationControls({
     if (!environmentId) return;
     setPending(kind);
     try {
-      const result = await configure({ environmentId, input });
-      if (result._tag === "Success" && input.enabled === true && !state.onboardingCompleted) {
-        await configure({ environmentId, input: { onboardingCompleted: true } });
+      const failed = await configureSelectedDeviceEnvironments(
+        environments.map((environment) => ({
+          environmentId: environment.environmentId,
+          label: environment.label,
+          connected: environment.connection.phase === "connected",
+          loaded: environment.serverConfig !== null,
+        })),
+        input,
+        async (environmentId, selectedInput) =>
+          (await configure({ environmentId, input: selectedInput }))._tag === "Success",
+      );
+      if (failed.length > 0) {
+        toastManager.add({
+          type: "error",
+          title: "Device settings not saved on all environments",
+          description: `Could not update ${failed.join(", ")}.`,
+        });
       }
     } finally {
       setPending(null);
@@ -683,7 +700,7 @@ function DeviceIntegrationControls({
     return (
       <div className="space-y-2">
         <div className="flex flex-wrap gap-2">
-          {state.supportsToolUpdate && needsUpdate ? (
+          {!projectScope && state.supportsToolUpdate && needsUpdate ? (
             <Button
               size="sm"
               disabled={!environmentId || pending !== null || busy}
@@ -736,6 +753,8 @@ function DeviceIntegrationControls({
     <>
       <SettingsRow
         {...searchableSetting("device-hub")}
+        serverScoped
+        settingKeys={["enableDeviceSupport"]}
         description={deviceHubDescription}
         control={
           <>
@@ -745,9 +764,10 @@ function DeviceIntegrationControls({
               tools={state.hosts.find((host) => host.kind === "local")?.tools}
             />
             {pending === "hub" ? <DeviceHubSetupStatus state={state} pending compact /> : null}
-            <Switch
+            <ScopedSwitch
+              settingKeys={["enableDeviceSupport"]}
               checked={enabled}
-              disabled={!loaded || !environmentId || busy || pending !== null}
+              disabled={projectScope || !loaded || !environmentId || busy || pending !== null}
               aria-label="Device hub"
               onCheckedChange={(checked) =>
                 void update("hub", {
@@ -763,6 +783,11 @@ function DeviceIntegrationControls({
         {platformsRevealed ? (
           <SettingsRow
             {...searchableSetting("device-platform-support")}
+            description={
+              connectedEnvironments.length > 1
+                ? `Status for ${connectedEnvironments.find((environment) => environment.environmentId === environmentId)?.label}. Select an environment to inspect its simulator support.`
+                : undefined
+            }
             status={
               <div className="flex flex-wrap gap-x-5 gap-y-2">
                 <PlatformStatus compact platform="iOS" status={platformSetupStatus(state, "ios")} />
@@ -790,32 +815,37 @@ function DeviceIntegrationControls({
           />
         ) : null}
       </AnimatedHeight>
-      {showAgentAccess ? (
-        <SettingsRow
-          {...searchableSetting("agent-device-access")}
-          description={agentDeviceDescription}
-          control={
-            <>
-              <DeviceToolVersions
-                action={versionActions("agent")}
-                kind="agent"
-                tools={state.hosts.find((host) => host.kind === "local")?.tools}
-              />
-              {pending === "agent" ? (
-                <AgentDeviceSetupStatus state={state} pending compact />
-              ) : null}
-              <Switch
-                checked={agentAccessEnabled}
-                disabled={!loaded || !environmentId || !enabled || busy || pending !== null}
-                aria-label="Agent device access"
-                onCheckedChange={(checked) =>
-                  void update("agent", { agentAccessEnabled: Boolean(checked) })
-                }
-              />
-            </>
-          }
-        />
-      ) : null}
+      <SettingsRow
+        {...searchableSetting("agent-device-access")}
+        serverScoped
+        settingKeys={["enableAgentDeviceAccess"]}
+        description={agentDeviceDescription}
+        control={
+          <>
+            <DeviceToolVersions
+              action={versionActions("agent")}
+              kind="agent"
+              tools={state.hosts.find((host) => host.kind === "local")?.tools}
+            />
+            {pending === "agent" ? <AgentDeviceSetupStatus state={state} pending compact /> : null}
+            <ScopedSwitch
+              settingKeys={["enableAgentDeviceAccess"]}
+              checked={agentAccessEnabled}
+              disabled={
+                connectedEnvironments.length === 0 ||
+                (!projectScope && (!loaded || !anyHubEnabled || busy)) ||
+                pending !== null
+              }
+              aria-label="Agent device access"
+              onCheckedChange={(checked) =>
+                projectScope
+                  ? updateSettings({ enableAgentDeviceAccess: Boolean(checked) })
+                  : void update("agent", { agentAccessEnabled: Boolean(checked) })
+              }
+            />
+          </>
+        }
+      />
       {environmentId ? (
         <DeviceHostUpdates
           state={{ ...state, hosts: state.hosts.filter((host) => host.kind === "local") }}
diff --git a/apps/web/src/components/settings/deviceHostsSettings.logic.test.ts b/apps/web/src/components/settings/deviceHostsSettings.logic.test.ts
new file mode 100644
index 0000000000..eec2052a48
--- /dev/null
+++ b/apps/web/src/components/settings/deviceHostsSettings.logic.test.ts
@@ -0,0 +1,106 @@
+import { describe, expect, it } from "vite-plus/test";
+import { EnvironmentId } from "@t3tools/contracts";
+
+import { planDeviceHostUpdates, updateDeviceHosts } from "./deviceHostsSettings.logic";
+
+describe("device hosts in selected environments", () => {
+  const host = { id: "primary", label: "Mac", target: "dev@mac" };
+  const sibling = { id: "sibling", label: "Android", target: "dev@android" };
+
+  it("adds to independent lists without replacing unrelated hosts and is retry-safe", () => {
+    const lists = [[], [sibling], [host, sibling]].map((hosts) =>
+      updateDeviceHosts(hosts, host, null, false, true),
+    );
+    expect(lists).toEqual([[host], [sibling, host], [host, sibling]]);
+    expect(lists.map((hosts) => updateDeviceHosts(hosts, host, null, false, true))).toEqual(lists);
+  });
+
+  it("edits and removes a uniquely matching destination with a different environment ID", () => {
+    const remote = { ...host, id: "remote", identityFile: "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/remote/key" };
+    const edited = { ...host, label: "Renamed", target: "dev@new-mac" };
+    expect(updateDeviceHosts([sibling, remote], edited, host, false, false)).toEqual([
+      sibling,
+      { ...edited, id: "remote", identityFile: "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/remote/key" },
+    ]);
+    expect(
+      updateDeviceHosts(
+        [{ ...edited, id: "remote", identityFile: "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/remote/key" }],
+        edited,
+        host,
+        false,
+        false,
+      ),
+    ).toEqual([{ ...edited, id: "remote", identityFile: "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/remote/key" }]);
+    expect(updateDeviceHosts([sibling, remote], host, host, true, true)).toEqual([sibling]);
+  });
+
+  it("preserves target-local identity paths unless the editor explicitly changes them", () => {
+    const representative = { ...host, identityFile: "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/primary/key" };
+    const remote = { ...host, id: "remote", identityFile: "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/remote/key" };
+    expect(updateDeviceHosts([], representative, null, false, false)).toEqual([host]);
+    expect(updateDeviceHosts([remote], representative, host, false, false)).toEqual([remote]);
+    expect(updateDeviceHosts([host], representative, host, false, false)).toEqual([host]);
+    expect(updateDeviceHosts([remote], representative, host, false, true)).toEqual([
+      { ...representative, id: "remote" },
+    ]);
+  });
+
+  it("fails closed on ambiguous destinations or a conflicting ID", () => {
+    const ambiguous = [host, { ...host, id: "other" }];
+    expect(() => updateDeviceHosts(ambiguous, host, host, true, true)).toThrow("Multiple");
+    const unrelated = { ...sibling, id: host.id };
+    expect(() => updateDeviceHosts([unrelated], host, null, false, true)).toThrow("ID");
+    const edited = { ...host, label: "Renamed", target: "dev@new-mac", identityFile: "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/new/key" };
+    const conflict = { ...edited, id: "remote", identityFile: "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/someone-else/key" };
+    expect(() => updateDeviceHosts([conflict], edited, host, false, true)).toThrow("destination");
+    expect(() =>
+      updateDeviceHosts([host, sibling], { ...host, target: sibling.target }, host, false, false),
+    ).toThrow("destination");
+  });
+
+  it("plans local, remote, and mixed selections without replacing local paths or hiding offline targets", () => {
+    const primary = EnvironmentId.make("local");
+    const remote = EnvironmentId.make("remote");
+    const offline = EnvironmentId.make("offline");
+    const original = { ...host, identityFile: "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/local/key" };
+    const changed = { ...original, label: "New label" };
+    const plan = planDeviceHostUpdates(
+      [
+        { environmentId: primary, label: "Local", connected: true, hosts: [original] },
+        {
+          environmentId: remote,
+          label: "Remote",
+          connected: true,
+          hosts: [{ ...host, id: "remote-host", identityFile: "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/remote/key" }, sibling],
+        },
+        { environmentId: offline, label: "Offline", connected: false, hosts: null },
+      ],
+      changed,
+      original,
+      false,
+      false,
+    );
+    expect(plan.failed).toEqual(["Offline"]);
+    expect(plan.writes).toEqual([
+      { environmentId: primary, label: "Local", hosts: [changed] },
+      {
+        environmentId: remote,
+        label: "Remote",
+        hosts: [{ ...changed, id: "remote-host", identityFile: "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/remote/key" }, sibling],
+      },
+    ]);
+  });
+
+  it("does not write a target where the host is already absent on removal", () => {
+    const primary = EnvironmentId.make("local");
+    expect(
+      planDeviceHostUpdates(
+        [{ environmentId: primary, label: "Local", connected: true, hosts: [sibling] }],
+        host,
+        host,
+        true,
+        false,
+      ),
+    ).toEqual({ writes: [], failed: [] });
+  });
+});
diff --git a/apps/web/src/components/settings/deviceHostsSettings.logic.ts b/apps/web/src/components/settings/deviceHostsSettings.logic.ts
new file mode 100644
index 0000000000..6c4fb15dbf
--- /dev/null
+++ b/apps/web/src/components/settings/deviceHostsSettings.logic.ts
@@ -0,0 +1,99 @@
+import type { EnvironmentId, SshDeviceHostConfig } from "@t3tools/contracts";
+
+/** A host ID may differ between environments; a destination is the shared identity. */
+function sameDestination(a: SshDeviceHostConfig, b: SshDeviceHostConfig): boolean {
+  return a.target === b.target && a.port === b.port;
+}
+
+export function updateDeviceHosts(
+  hosts: ReadonlyArray<SshDeviceHostConfig>,
+  host: SshDeviceHostConfig,
+  original: SshDeviceHostConfig | null,
+  remove: boolean,
+  identityFileChanged: boolean,
+): ReadonlyArray<SshDeviceHostConfig> {
+  const { identityFile: _representativeIdentityFile, ...portableHost } = host;
+  const destination = original ?? host;
+  const byId = hosts.find((candidate) => candidate.id === destination.id);
+  const matches = hosts.filter((candidate) => sameDestination(candidate, destination));
+  if (matches.length > 1) {
+    throw new Error(
+      "Multiple device hosts use this destination; select one environment to edit it.",
+    );
+  }
+  const existing = byId && sameDestination(byId, destination) ? byId : matches[0];
+  if (remove) return existing ? hosts.filter((candidate) => candidate.id !== existing.id) : hosts;
+  if (existing === undefined) {
+    const newMatches = hosts.filter((candidate) => sameDestination(candidate, host));
+    if (newMatches.length > 1) {
+      throw new Error(
+        "Multiple device hosts use this destination; select one environment to edit it.",
+      );
+    }
+    // A prior target may already have saved while another failed. Only accept the same requested
+    // host on retry; a different host at its destination must not be silently overwritten.
+    if (
+      newMatches.length === 1 &&
+      newMatches[0]?.label === host.label &&
+      newMatches[0]?.target === host.target &&
+      newMatches[0]?.port === host.port &&
+      (!identityFileChanged || newMatches[0]?.identityFile === host.identityFile) &&
+      (byId === undefined || byId === newMatches[0])
+    )
+      return hosts;
+    if (byId !== undefined || newMatches.length > 0) {
+      throw new Error("A different device host already uses this ID or destination.");
+    }
+    const added = identityFileChanged ? host : portableHost;
+    return [...hosts, added];
+  }
+  if (hosts.some((candidate) => candidate.id !== existing.id && sameDestination(candidate, host))) {
+    throw new Error("A different device host already uses this destination.");
+  }
+  const identityFile = identityFileChanged ? host.identityFile : existing.identityFile;
+  const replacement: SshDeviceHostConfig = {
+    ...portableHost,
+    id: existing.id,
+    ...(identityFile === undefined ? {} : { identityFile }),
+  };
+  return hosts.map((candidate) => (candidate.id === existing.id ? replacement : candidate));
+}
+
+/** Plan each selected environment independently; never copy a representative settings list. */
+export function planDeviceHostUpdates(
+  targets: ReadonlyArray<{
+    environmentId: EnvironmentId;
+    label: string;
+    connected: boolean;
+    hosts: ReadonlyArray<SshDeviceHostConfig> | null;
+  }>,
+  host: SshDeviceHostConfig,
+  original: SshDeviceHostConfig | null,
+  remove: boolean,
+  identityFileEdited: boolean,
+) {
+  const writes: Array<{
+    environmentId: EnvironmentId;
+    label: string;
+    hosts: ReadonlyArray<SshDeviceHostConfig>;
+  }> = [];
+  const failed: string[] = [];
+  for (const target of targets) {
+    if (!target.connected || target.hosts === null) {
+      failed.push(target.label);
+      continue;
+    }
+    try {
+      const next = updateDeviceHosts(target.hosts, host, original, remove, identityFileEdited);
+      if (next === target.hosts) continue;
+      writes.push({
+        environmentId: target.environmentId,
+        label: target.label,
+        hosts: next,
+      });
+    } catch {
+      failed.push(target.label);
+    }
+  }
+  return { writes, failed };
+}
diff --git a/apps/web/src/components/settings/deviceIntegrationSettings.logic.test.ts b/apps/web/src/components/settings/deviceIntegrationSettings.logic.test.ts
new file mode 100644
index 0000000000..82b4e63fe7
--- /dev/null
+++ b/apps/web/src/components/settings/deviceIntegrationSettings.logic.test.ts
@@ -0,0 +1,39 @@
+import { EnvironmentId } from "@t3tools/contracts";
+import { describe, expect, it, vi } from "vite-plus/test";
+
+import { configureSelectedDeviceEnvironments } from "./deviceIntegrationSettings.logic";
+
+describe("selected environment device setup", () => {
+  it("configures local and remote independently and names offline and failed targets", async () => {
+    const local = EnvironmentId.make("local");
+    const remote = EnvironmentId.make("remote");
+    const offline = EnvironmentId.make("offline");
+    const configure = vi.fn(async (environmentId: EnvironmentId) => environmentId === local);
+    const failed = await configureSelectedDeviceEnvironments(
+      [
+        { environmentId: local, label: "Local", connected: true, loaded: true },
+        { environmentId: remote, label: "Remote", connected: true, loaded: true },
+        { environmentId: offline, label: "Offline", connected: false, loaded: true },
+      ],
+      { enabled: true },
+      configure,
+    );
+    expect(failed).toEqual(["Remote", "Offline"]);
+    expect(configure).toHaveBeenCalledTimes(2);
+    expect(configure).toHaveBeenCalledWith(local, { enabled: true, onboardingCompleted: true });
+    expect(configure).toHaveBeenCalledWith(remote, { enabled: true, onboardingCompleted: true });
+  });
+
+  it("does not claim success after a rejected configure command", async () => {
+    const local = EnvironmentId.make("local");
+    expect(
+      await configureSelectedDeviceEnvironments(
+        [{ environmentId: local, label: "Local", connected: true, loaded: true }],
+        { enabled: false, agentAccessEnabled: false },
+        async () => {
+          throw new Error("disconnected during request");
+        },
+      ),
+    ).toEqual(["Local"]);
+  });
+});
diff --git a/apps/web/src/components/settings/deviceIntegrationSettings.logic.ts b/apps/web/src/components/settings/deviceIntegrationSettings.logic.ts
new file mode 100644
index 0000000000..a54426e609
--- /dev/null
+++ b/apps/web/src/components/settings/deviceIntegrationSettings.logic.ts
@@ -0,0 +1,30 @@
+import type { EnvironmentId } from "@t3tools/contracts";
+
+/** Device setup is a command on each selected environment, not on the display representative. */
+export async function configureSelectedDeviceEnvironments(
+  environments: ReadonlyArray<{
+    environmentId: EnvironmentId;
+    label: string;
+    connected: boolean;
+    loaded: boolean;
+  }>,
+  input: { enabled?: boolean; agentAccessEnabled?: boolean },
+  configure: (
+    environmentId: EnvironmentId,
+    input: { enabled?: boolean; agentAccessEnabled?: boolean; onboardingCompleted?: boolean },
+  ) => Promise<boolean>,
+): Promise<ReadonlyArray<string>> {
+  const results = await Promise.allSettled(
+    environments.map(async (environment) => {
+      if (!environment.connected || !environment.loaded) return false;
+      return configure(environment.environmentId, {
+        ...input,
+        ...(input.enabled ? { onboardingCompleted: true } : {}),
+      });
+    }),
+  );
+  return environments.flatMap((environment, index) => {
+    const result = results[index];
+    return result?.status !== "fulfilled" || result.value !== true ? [environment.label] : [];
+  });
+}
diff --git a/apps/web/src/components/settings/scopedSettings.test.ts b/apps/web/src/components/settings/scopedSettings.test.ts
index 27a4328c11..467422423c 100644
--- a/apps/web/src/components/settings/scopedSettings.test.ts
+++ b/apps/web/src/components/settings/scopedSettings.test.ts
@@ -226,6 +226,19 @@ describe("scoped settings writes", () => {
     expect(persistServer).toHaveBeenCalledTimes(1);
   });
 
+  it("scopes agent device access to projects while keeping hub and hosts environment-wide", () => {
+    const access = planScopedSettingsPatch(project, [laptop, server], {
+      enableAgentDeviceAccess: true,
+    });
+    expect(access.serverWrites.map((write) => write.patch)).toEqual([
+      { projectSettingsOverrides: { [projectId]: { enableAgentDeviceAccess: true } } },
+      { projectSettingsOverrides: { [laptopProjectId]: { enableAgentDeviceAccess: true } } },
+    ]);
+    for (const patch of [{ enableDeviceSupport: true }, { deviceHosts: [] }]) {
+      expect(planScopedSettingsPatch(project, environments, patch).serverWrites).toEqual([]);
+    }
+  });
+
   it.each([
     "defaultModelSelection",
     "sourceControlWriterModelSelection",
diff --git a/docs/user/devices.md b/docs/user/devices.md
index 60409a1025..8793f6b364 100644
--- a/docs/user/devices.md
+++ b/docs/user/devices.md
@@ -63,8 +63,10 @@ once per server. Restart an existing agent session after granting access so it
 receives the device CLI environment.
 
 To keep agents away from simulators, turn off **Agent device access** in
-**Settings → Integrations → Devices**. This hides the device tools from agents
-started from then on; your own Device panel is unaffected.
+**Settings → Integrations → Devices**. This follows the environments or project
+selected in Settings and hides device tools from agents started from then on;
+your own Device panel is unaffected. The device hub itself remains an
+environment setting and can be changed across selected environments.
 
 ## Remote connections
 
@@ -75,16 +77,18 @@ still-image stream and Android cannot show video.
 
 ## SSH device hosts
 
-In Settings → Integrations → Devices, select one connected environment
-and add a host under **Device hosts**. Enter an SSH alias or `user@host`, with
-an optional identity file and port. These resolve on the environment server,
-so use the SSH configuration and keys available there. Password prompts are
-not supported.
+In Settings → Integrations → Devices, select the environments to configure and
+add a host under **Device hosts**. Adding, editing, or removing a host updates
+each selected environment's own host list; an unavailable environment is named
+if it could not be updated. Enter an SSH alias or `user@host`, with an optional
+identity file and port. An unchanged identity-file field keeps each server's
+own path, while editing that field applies the entered path to every selected
+server. Paths resolve on each environment server, so use SSH configuration and
+keys available there. Password prompts are not supported.
 
 **Test connection** checks SSH, Node, npm, and platform tools without installing
 anything. When adding or editing a host, the check reports a result for each environment
-selected in Settings; saving changes the host list on the environment shown in
-the Devices section. An SSH alias that resolves to the environment server's own
+selected in Settings. An SSH alias that resolves to the environment server's own
 machine is skipped, unless it uses a forwarded port or SSH proxy. The first
 device listing installs pinned device tools on the host.
 Node 22 or newer and npm must be available to non-interactive SSH commands.