diff --git a/cmd/server/main.go b/cmd/server/main.go
index 3bfa36c..2382919 100644
--- a/cmd/server/main.go
+++ b/cmd/server/main.go
@@ -90,6 +90,7 @@ func main() {
 
 	authHandler := handlers.NewAuthHandler(queries, cfg.JWTSecret, loginAttemptTracker)
 	systemSettingsHandler := handlers.NewSystemSettingsHandler(queries)
+	sidecarHandler := handlers.NewSidecarHandler(queries, cfg)
 	libraryHandler := handlers.NewLibraryHandler(queries)
 	deviceHandler := handlers.NewDeviceHandler(queries, cfg.JWTSecret, cfg)
 	deviceAuthMiddleware := middleware.NewDeviceAuthMiddleware(queries)
@@ -182,6 +183,7 @@ func main() {
 		OPDSHandler:           opdsHandler,
 		Worker:                worker,
 		SystemSettingsHandler: systemSettingsHandler,
+		SidecarHandler:        sidecarHandler,
 		ConnManager:           connManager,
 		QueueProcessor:        queueProcessor,
 		DeviceAuthMiddleware:  deviceAuthMiddleware,
diff --git a/internal/router/device.go b/internal/router/device.go
index e24aa7e..503dc83 100644
--- a/internal/router/device.go
+++ b/internal/router/device.go
@@ -26,4 +26,8 @@ func registerDeviceRoutes(cfg *Config) {
 	devices.GET("/pending", cfg.DeviceHandler.ListPendingRegistrations)
 	devices.GET("/approve/:registration_id", cfg.DeviceHandler.ApproveDevice)
 	devices.POST("/reject/:registration_id", cfg.DeviceHandler.RejectDevice)
+
+	// Device sidecar configuration routes
+	devices.GET("/:id/sidecar", cfg.SidecarHandler.GetSidecarConfig)
+	devices.GET("/:id/sidecar/download", cfg.SidecarHandler.DownloadSidecarConfig)
 }
diff --git a/internal/router/router.go b/internal/router/router.go
index 779b6d0..c729a59 100644
--- a/internal/router/router.go
+++ b/internal/router/router.go
@@ -62,6 +62,7 @@ type Config struct {
 	LoginTracker          *ratelimit.LoginAttemptTracker
 	ScannerHandler        *handlers.Handler
 	JobsHandler           *handlers.JobsHandler
+	SidecarHandler        *handlers.SidecarHandler
 }
 
 // createJWTMiddleware creates a JWT middleware with proper user context setup
@@ -203,6 +204,7 @@ func RegisterRoutes(cfg *Config) *handlers.Handler {
 	registerAuthRoutes(cfg, rateLimitMiddleware)
 	registerLibraryRoutes(cfg)
 	registerDeviceRoutes(cfg)
+	registerSystemRoutes(cfg)
 	registerSyncRoutes(cfg)
 	registerCollectionsRoutes(cfg)
 	registerDashboardRoutes(cfg)
diff --git a/internal/router/system.go b/internal/router/system.go
new file mode 100644
index 0000000..4c76f8a
--- /dev/null
+++ b/internal/router/system.go
@@ -0,0 +1,20 @@
+package router
+
+import (
+	"bookhoard/internal/handlers"
+)
+
+func registerSystemRoutes(cfg *Config) {
+	e := cfg.Echo
+
+	// JWT middleware
+	jwtMiddleware := createJWTMiddleware(cfg)
+
+	// Protected routes (admin-only)
+	protected := e.Group("/api", jwtMiddleware)
+	system := protected.Group("/system", handlers.AdminMiddleware)
+
+	// System configuration routes (admin-only)
+	system.GET("/config", cfg.SidecarHandler.GetSystemConfiguration)
+	system.PUT("/config", cfg.SidecarHandler.UpdateSystemConfiguration)
+}