diff --git a/.gitmodules b/.gitmodules
index cd11e3d..b71cd15 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -7,3 +7,6 @@
 [submodule "apps/device-agent"]
 	path = apps/device-agent
 	url = https://git.datadunia.com/nexusguard/nexus-device-agent.git
+[submodule "apps/device-agent-embedded"]
+	path = apps/device-agent-embedded
+	url = https://git.datadunia.com/nexusguard/nexus-agent-embedded.git
diff --git a/README.md b/README.md
index 3911520..6b00a8b 100644
--- a/README.md
+++ b/README.md
@@ -3,10 +3,11 @@
 NexusGuard is an Enterprise Zero-Trust SD-WAN solution built with Go, Vue 3, and WireGuard. It enables stealth VPN tunneling, centralized IPAM, and real-time network isolation via `nftables`.
 
 ## 🏗️ System Architecture
-This suite contains three main components:
+This suite contains four main components:
 1. **[Server Core](http://git.datadunia.com/nexusguard/nexus-server-core)**: The central API and VPN Hub managing database state, token distribution, and Linux firewall isolation.
 2. **[Dashboard UI](http://git.datadunia.com/nexusguard/nexus-dashboard-ui)**: The Admin Web GUI for managing Nodes, Users, Devices, and Firewall rules. Features a futuristic glassmorphism design system using Vue 3, Vite, TailwindCSS v4, and HeadlessUI.
-3. **[Device Agent](http://git.datadunia.com/nexusguard/nexus-device-agent)**: A stealth background daemon for Linux client machines that establishes memory-injected WireGuard tunnels.
+3. **[Device Agent](http://git.datadunia.com/nexusguard/nexus-device-agent)**: A stealth background daemon for Linux/Windows/macOS client machines that establishes memory-injected WireGuard tunnels.
+4. **[Device Agent Embedded](http://git.datadunia.com/nexusguard/nexus-agent-embedded)**: ESP32-based WireGuard agent for IoT/edge devices. Runs on FreeRTOS + ESP-IDF with lwIP stack.
 
 ---
 
diff --git a/apps/device-agent-embedded b/apps/device-agent-embedded
new file mode 160000
index 0000000..9f9448a
--- /dev/null
+++ b/apps/device-agent-embedded
@@ -0,0 +1 @@
+Subproject commit 9f9448aebbb1a28c691efc3531cef106c3e45eb2
diff --git a/update.sh b/update.sh
index de5f1d9..a9f9130 100755
--- a/update.sh
+++ b/update.sh
@@ -45,7 +45,10 @@ git pull origin main || { GIT_PULL_FAILED=true; echo "[!] Git pull for main repo
 
 echo "[+] Syncing and updating submodules..."
 SUBMODULE_FAILED=false
-git submodule update --init --recursive --remote || { SUBMODULE_FAILED=true; echo "[!] Git submodule update skipped or failed."; }
+# Exclude device-agent and device-agent-embedded (built separately, not Docker)
+git submodule update --init --recursive --remote \
+    --exclude apps/device-agent \
+    --exclude apps/device-agent-embedded || { SUBMODULE_FAILED=true; echo "[!] Git submodule update skipped or failed."; }
 
 # 2b. Build VitePress docs (non-blocking)
 echo "[+] Building VitePress documentation..."