@@ -67,6 +67,7 @@ use std::net::Ipv4Addr;
 use std::num::NonZeroU16;
 use std::path::PathBuf;
 use std::sync::Arc;
+use tedge_api::file_transfer_url::EntityStoreUrls;
 use tedge_api::file_transfer_url::FileTransferUrls;
 use tedge_api::file_transfer_url::Protocol;
 use tedge_api::mqtt_topics::EntityTopicId;
@@ -1917,13 +1918,23 @@ impl TEdgeConfigReaderHttp {
     /// Builds the URLs at which the File Transfer Service HTTP server exposes files,
     /// as seen by a client connecting to `http.client.host:http.client.port`.
     pub fn file_transfer_urls(&self) -> FileTransferUrls {
-        let authority: Arc<str> = format!("{}:{}", self.client.host, self.client.port).into();
+        let (authority, protocol) = self.client_authority();
+        FileTransferUrls::new(authority, protocol)
+    }
+
+    pub fn entity_store_urls(&self) -> EntityStoreUrls {
+        let (authority, protocol) = self.client_authority();
+        EntityStoreUrls::new(authority, protocol)
+    }
+
+    fn client_authority(&self) -> (Arc<str>, Protocol) {
+        let authority = format!("{}:{}", self.client.host, self.client.port).into();
         let protocol = if self.is_secure() {
             Protocol::Https
         } else {
             Protocol::Http
         };
-        FileTransferUrls::new(authority, protocol)
+        (authority, protocol)
     }
 }
 
 
@@ -10,6 +10,7 @@ use tedge_config::TEdgeConfig;
 use tedge_mapper::MapperName;
 use tedge_supervisor::RuntimeFactory;
 use tedge_supervisor::Supervisor;
+use tedge_supervisor::SupervisorMode;
 use tedge_supervisor::Unit;
 use tedge_supervisor::UnitKind;
 
@@ -86,7 +87,7 @@ pub async fn run(opt: RunAllOpt) -> anyhow::Result<()> {
             let mapper = mapper.clone();
             async move {
                 let config = TEdgeConfig::load(&config_dir).await?;
-                tedge_mapper::build(mapper, config).await
+                tedge_mapper::build(mapper, config, SupervisorMode::MultiUnit).await
             }
             .boxed()
         });
 
@@ -38,6 +38,7 @@ tedge_config_manager = { workspace = true }
 tedge_downloader_ext = { workspace = true }
 tedge_file_system_ext = { workspace = true }
 tedge_health_ext = { workspace = true }
+tedge_http_ext = { workspace = true }
 tedge_log_manager = { workspace = true }
 tedge_mqtt_ext = { workspace = true }
 tedge_script_ext = { workspace = true }
@@ -60,10 +61,12 @@ proptest = { workspace = true }
 rcgen = { workspace = true }
 ron = { workspace = true }
 tedge_actors = { workspace = true, features = ["test-helpers"] }
+tedge_http_ext = { workspace = true, features = ["test_helpers"] }
 tedge_mqtt_ext = { workspace = true, features = ["test-helpers"] }
 tedge_test_utils = { workspace = true }
 tempfile = { workspace = true }
 test-case = { workspace = true }
+tokio = { workspace = true, features = ["test-util"] }
 tower = { workspace = true }
 
 [lints]
 
@@ -5,6 +5,8 @@ use crate::entity_manager::server::EntityStoreServer;
 use crate::entity_manager::server::EntityStoreServerConfig;
 use crate::http_server::actor::HttpServerBuilder;
 use crate::http_server::actor::HttpServerConfig;
+use crate::operation_workflows::install_service_workflows;
+use crate::operation_workflows::EntityStoreClient;
 use crate::operation_workflows::OperationConfig;
 use crate::operation_workflows::WorkflowActorBuilder;
 use crate::restart_manager::builder::RestartManagerBuilder;
@@ -35,6 +37,7 @@ use tedge_actors::Sequential;
 use tedge_actors::ServerActorBuilder;
 use tedge_actors::ServerConfig;
 use tedge_api::entity_store::EntityRegistrationMessage;
+use tedge_api::file_transfer_url::EntityStoreUrls;
 use tedge_api::file_transfer_url::FileTransferUrls;
 use tedge_api::mqtt_topics::DeviceTopicId;
 use tedge_api::mqtt_topics::EntityTopicId;
@@ -43,6 +46,8 @@ use tedge_api::mqtt_topics::OperationType;
 use tedge_api::mqtt_topics::Service;
 use tedge_api::mqtt_topics::ServiceTopicId;
 use tedge_api::path::DataDir;
+use tedge_api::service_command::ActionCapabilities;
+use tedge_api::service_command::TEDGE_SERVICE_ACTIONS;
 use tedge_api::EntityStore;
 use tedge_config::tedge_toml::TEdgeConfigReaderService;
 use tedge_config_ext::ConfigPublisherBuilder;
@@ -52,6 +57,7 @@ use tedge_config_manager::ConfigManagerOptions;
 use tedge_downloader_ext::DownloaderActor;
 use tedge_file_system_ext::FsWatchActorBuilder;
 use tedge_health_ext::HealthMonitorBuilder;
+use tedge_http_ext::HttpActor;
 use tedge_log_manager::LogManagerBuilder;
 use tedge_log_manager::LogManagerConfig;
 use tedge_log_manager::LogManagerOptions;
@@ -85,6 +91,8 @@ pub(crate) struct AgentConfig {
     pub service_topic_id: ServiceTopicId,
     pub mqtt_topic_root: Arc<str>,
     pub file_transfer_urls: FileTransferUrls,
+    pub entity_store_urls: EntityStoreUrls,
+    pub http_client_tls_config: rustls::ClientConfig,
     pub service: TEdgeConfigReaderService,
     pub identity: Option<Identity>,
     pub cloud_root_certs: CloudHttpConfig,
@@ -139,6 +147,8 @@ impl AgentConfig {
             .with_session_name(mqtt_session_name);
 
         let file_transfer_urls = tedge_config.http.file_transfer_urls();
+        let entity_store_urls = tedge_config.http.entity_store_urls();
+        let http_client_tls_config = tedge_config.http.client_tls_config()?;
 
         // HTTP config
         let data_dir = tedge_config.data_root();
@@ -221,6 +231,8 @@ impl AgentConfig {
             mqtt_device_topic_id,
             service_topic_id,
             file_transfer_urls,
+            entity_store_urls,
+            http_client_tls_config,
             identity,
             cloud_root_certs,
             is_sudo_enabled,
@@ -281,6 +293,8 @@ impl Agent {
             ShellExecuteBuilder::try_new(&self.config.operations_dir).await?;
         }
 
+        install_service_workflows(&self.config.operations_dir).await?;
+
         // Inotify actor
         let mut fs_watch_actor_builder = FsWatchActorBuilder::new();
 
@@ -301,6 +315,67 @@ impl Agent {
         let mut uploader_actor_builder =
             UploaderActor::new(self.config.identity, self.config.cloud_root_certs).builder();
 
+        let device_topic_id = self.config.mqtt_device_topic_id.clone();
+        let mqtt_schema = MqttSchema::with_root(self.config.mqtt_topic_root.to_string());
+
+        // TODO: replace with a call to entity store when we stop assuming default MQTT schema
+        let is_main_device = device_topic_id == EntityTopicId::default_main_device();
+        let entity_store = if is_main_device {
+            info!("Running as a main device, starting File Transfer Service");
+
+            let state_dir = agent_state_dir(&self.config.state_dir, &self.config.config_dir);
+            let state_dir = state_dir.path();
+            let clean_start = self.config.entity_store_clean_start;
+            let telemetry_cache_size = 0; // Agent need not cache any data messages, the mapper would
+
+            let main_device = EntityRegistrationMessage::main_device(None);
+            let entity_store = EntityStore::with_main_device(
+                mqtt_schema.clone(),
+                main_device,
+                telemetry_cache_size,
+                state_dir,
+                clean_start,
+            )?;
+            let entity_store_server_config =
+                EntityStoreServerConfig::new(mqtt_schema.clone(), self.config.entity_auto_register);
+            let entity_store_server = EntityStoreServer::new(
+                entity_store_server_config,
+                entity_store,
+                &mut mqtt_actor_builder,
+            );
+            let mut entity_store_actor_builder =
+                ServerActorBuilder::new(entity_store_server, &ServerConfig::default(), Sequential);
+            mqtt_actor_builder.connect_mapped_sink(
+                entity_manager::server::subscriptions(&mqtt_schema),
+                &entity_store_actor_builder,
+                |message| {
+                    Some(RequestEnvelope {
+                        request: EntityStoreRequest::MqttMessage(message),
+                        reply_to: Box::new(NullSender),
+                    })
+                },
+            );
+
+            let entity_store = EntityStoreClient::local(&mut entity_store_actor_builder);
+
+            let file_transfer_server_builder = HttpServerBuilder::try_bind(
+                self.config.http_config,
+                &mut entity_store_actor_builder,
+            )
+            .await?;
+
+            runtime.spawn(file_transfer_server_builder).await?;
+            runtime.spawn(entity_store_actor_builder).await?;
+            entity_store
+        } else {
+            info!("Running as a child device: File Transfer Service disabled");
+            let mut http_actor = HttpActor::new(self.config.http_client_tls_config).builder();
+            let entity_store =
+                EntityStoreClient::remote(self.config.entity_store_urls, &mut http_actor);
+            runtime.spawn(http_actor).await?;
+            entity_store
+        };
+
         // Software update actor
         let mut software_update_builder = SoftwareManagerBuilder::new(self.config.sw_update_config);
 
@@ -312,19 +387,18 @@ impl Agent {
             &mut fs_watch_actor_builder,
             &mut downloader_actor_builder,
             &mut uploader_actor_builder,
+            entity_store,
         );
         workflow_actor_builder.register_builtin_operation(&mut restart_actor_builder);
         workflow_actor_builder.register_builtin_operation(&mut software_update_builder);
 
         // Health actor
         // TODO: take a user-configurable service topic id
-        let device_topic_id = self.config.mqtt_device_topic_id.clone();
         let service_topic_id = self.config.service_topic_id.clone();
         let service = Service {
             service_topic_id: service_topic_id.clone(),
             device_topic_id: DeviceTopicId::new(device_topic_id.clone()),
         };
-        let mqtt_schema = MqttSchema::with_root(self.config.mqtt_topic_root.to_string());
 
         let twin_manager_config = TwinManagerConfig::new(
             self.config.config_dir.root().to_path_buf(),
@@ -347,7 +421,8 @@ impl Agent {
             &mut mqtt_actor_builder,
             &mqtt_schema,
             &self.config.service,
-        );
+        )
+        .with_action_capabilities(ActionCapabilities::declaring(TEDGE_SERVICE_ACTIONS));
 
         // Instantiate config manager actor if either config_snapshot or config_update operation is enabled
         let config_actor_builder: Option<ConfigManagerBuilder> =
@@ -417,56 +492,6 @@ impl Agent {
             None
         };
 
-        // TODO: replace with a call to entity store when we stop assuming default MQTT schema
-        let is_main_device = device_topic_id == EntityTopicId::default_main_device();
-        if is_main_device {
-            info!("Running as a main device, starting File Transfer Service");
-
-            let state_dir = agent_state_dir(&self.config.state_dir, &self.config.config_dir);
-            let state_dir = state_dir.path();
-            let clean_start = self.config.entity_store_clean_start;
-            let telemetry_cache_size = 0; // Agent need not cache any data messages, the mapper would
-
-            let main_device = EntityRegistrationMessage::main_device(None);
-            let entity_store = EntityStore::with_main_device(
-                mqtt_schema.clone(),
-                main_device,
-                telemetry_cache_size,
-                state_dir,
-                clean_start,
-            )?;
-            let entity_store_server_config =
-                EntityStoreServerConfig::new(mqtt_schema.clone(), self.config.entity_auto_register);
-            let entity_store_server = EntityStoreServer::new(
-                entity_store_server_config,
-                entity_store,
-                &mut mqtt_actor_builder,
-            );
-            let mut entity_store_actor_builder =
-                ServerActorBuilder::new(entity_store_server, &ServerConfig::default(), Sequential);
-            mqtt_actor_builder.connect_mapped_sink(
-                entity_manager::server::subscriptions(&mqtt_schema),
-                &entity_store_actor_builder,
-                |message| {
-                    Some(RequestEnvelope {
-                        request: EntityStoreRequest::MqttMessage(message),
-                        reply_to: Box::new(NullSender),
-                    })
-                },
-            );
-
-            let file_transfer_server_builder = HttpServerBuilder::try_bind(
-                self.config.http_config,
-                &mut entity_store_actor_builder,
-            )
-            .await?;
-
-            runtime.spawn(file_transfer_server_builder).await?;
-            runtime.spawn(entity_store_actor_builder).await?;
-        } else {
-            info!("Running as a child device: File Transfer Service disabled");
-        }
-
         // Spawn all
         runtime.spawn(mqtt_actor_builder).await?;
         runtime.spawn(fs_watch_actor_builder).await?;