diff --git a/internal/router/device.go b/internal/router/device.go
index c8ed8c1..d1e3d98 100644
--- a/internal/router/device.go
+++ b/internal/router/device.go
@@ -8,18 +8,18 @@ func registerDeviceRoutes(cfg *Config) {
 
 	// Protected routes
 	protected := e.Group("/api", jwtMiddleware)
+	devices := protected.Group("/devices")
 
 	// Public device registration routes (no auth required)
 	e.POST("/api/devices/register", cfg.DeviceHandler.InitiateRegistration)
 	e.POST("/api/devices/register/status", cfg.DeviceHandler.CheckRegistrationStatus)
-	e.GET("/api/devices/approve/:token", cfg.DeviceHandler.ApproveDevice)
-	e.POST("/api/devices/reject/:token", cfg.DeviceHandler.RejectDevice)
 
 	// Device management routes (protected)
-	devices := protected.Group("/devices")
 	devices.GET("", cfg.DeviceHandler.ListDevices)
 	devices.GET("/:id", cfg.DeviceHandler.GetDevice)
 	devices.PUT("/:id", cfg.DeviceHandler.UpdateDevice)
 	devices.DELETE("/:id", cfg.DeviceHandler.DeleteDevice)
 	devices.GET("/pending", cfg.DeviceHandler.ListPendingRegistrations)
+	devices.GET("/approve/:registration_id", cfg.DeviceHandler.ApproveDevice)
+	devices.POST("/reject/:registration_id", cfg.DeviceHandler.RejectDevice)
 }
diff --git a/internal/router/opds.go b/internal/router/opds.go
index 4c5615c..9b53f65 100644
--- a/internal/router/opds.go
+++ b/internal/router/opds.go
@@ -5,11 +5,11 @@ func registerOPDSRoutes(cfg *Config) {
 
 	// OPDS routes (public - device authentication optional)
 	// Note: OPDSHandler implements its own device authentication
-	e.GET("/opds/:id", cfg.OPDSHandler.GetDeviceCatalog)
-	e.GET("/opds/:id/search", cfg.OPDSHandler.SearchDeviceCatalog)
-	e.GET("/opds/:id/download", cfg.OPDSHandler.DownloadBook)
-	e.GET("/opds/:id/cover", cfg.OPDSHandler.GetCoverImage)
-	e.GET("/opds/:id/navigation", cfg.OPDSHandler.GetDeviceNavigation)
-	e.GET("/opds/:id/formats", cfg.OPDSHandler.ListFormats)
-	e.POST("/opds/register", cfg.OPDSHandler.RegisterOPDS)
+	opds := e.Group("/opds/devices")
+	opds.GET("/:deviceId/catalog", cfg.OPDSHandler.GetDeviceCatalog)
+	opds.GET("/:deviceId/search", cfg.OPDSHandler.SearchDeviceCatalog)
+	opds.GET("/:deviceId/nav", cfg.OPDSHandler.GetDeviceNavigation)
+	opds.GET("/:deviceId/download/:bookId", cfg.OPDSHandler.DownloadBook)
+	opds.GET("/:deviceId/cover/:bookId", cfg.OPDSHandler.GetCoverImage)
+	opds.GET("/:deviceId/formats/:bookId", cfg.OPDSHandler.ListFormats)
 }
diff --git a/internal/router/queue.go b/internal/router/queue.go
index 18e9080..e21b24b 100644
--- a/internal/router/queue.go
+++ b/internal/router/queue.go
@@ -1,6 +1,8 @@
 package router
 
 import (
+	"bookhoard/internal/handlers"
+
 	"github.com/labstack/echo/v4"
 )
 
@@ -12,13 +14,15 @@ func registerQueueRoutes(cfg *Config) {
 
 	protected := e.Group("/api", jwtMiddleware)
 
-	// Sync queue management routes
+	// Sync queue management routes (protected - require user auth)
 	queue := protected.Group("/queue")
-	queue.GET("", func(c echo.Context) error {
-		data, err := cfg.QueueHandler.GetQueueData(c)
-		if err != nil {
-			return c.JSON(500, map[string]string{"error": "failed to get queue"})
-		}
-		return c.JSON(200, map[string]interface{}{"items": data})
-	})
+	queue.GET("/devices/:device_id/stats", cfg.QueueHandler.GetDeviceQueueStats)
+	queue.GET("/devices/:device_id/items", queueHandler.ListDeviceQueueItems)
+	queue.POST("/items/:item_id/retry", queueHandler.RetryQueueItem)
+	queue.DELETE("/items/:item_id", queueHandler.DeleteQueueItem)
+	queue.DELETE("/devices/:device_id/clear", queueHandler.ClearDeviceQueue)
+
+	// Admin-only queue routes
+	adminQueue := queue.Group("", handlers.AdminMiddleware)
+	adminQueue.GET("/items", cfg.QueueHandler.ListAllQueueItems)
 }