diff --git a/app/src/main/java/io/xpipe/app/hub/comp/StoreCategoryConfigComp.java b/app/src/main/java/io/xpipe/app/hub/comp/StoreCategoryConfigComp.java
index e36c64cb7..9ea2ef4fb 100644
--- a/app/src/main/java/io/xpipe/app/hub/comp/StoreCategoryConfigComp.java
+++ b/app/src/main/java/io/xpipe/app/hub/comp/StoreCategoryConfigComp.java
@@ -64,13 +64,20 @@ public class StoreCategoryConfigComp extends SimpleRegionBuilder {
         var confirm = new SimpleObjectProperty<>(c.getConfirmAllModifications());
         var sync = new SimpleObjectProperty<>(c.getSync());
         var freeze = new SimpleObjectProperty<>(c.getFreezeConfigurations());
-        var ref = new SimpleObjectProperty<>(
+        var identityRef = new SimpleObjectProperty<>(
                 c.getDefaultIdentityStore() != null
                         ? DataStorage.get()
                                 .getStoreEntryIfPresent(c.getDefaultIdentityStore())
                                 .map(DataStoreEntry::ref)
                                 .orElse(null)
                         : null);
+        var gatewayRef = new SimpleObjectProperty<>(
+                c.getDefaultGatewayStore() != null
+                        ? DataStorage.get()
+                          .getStoreEntryIfPresent(c.getDefaultGatewayStore())
+                          .map(DataStoreEntry::ref)
+                          .orElse(null)
+                        : null);
         var connectionsCategory = wrapper.getRoot().equals(StoreViewState.get().getAllConnectionsCategory());
 
         var options = new OptionsBuilder();
@@ -100,11 +107,21 @@ public class StoreCategoryConfigComp extends SimpleRegionBuilder {
                 .addComp(
                         new StoreChoiceComp<>(
                                 null,
-                                ref,
+                                identityRef,
                                 DataStore.class,
                                 null,
                                 StoreViewState.get().getAllIdentitiesCategory()),
-                        ref)
+                        identityRef)
+                .hide(!connectionsCategory)
+                .nameAndDescription("categoryDefaultGateway")
+                .addComp(
+                        new StoreChoiceComp<>(
+                                null,
+                                gatewayRef,
+                                DataStore.class,
+                                null,
+                                StoreViewState.get().getAllConnectionsCategory()),
+                        gatewayRef)
                 .hide(!connectionsCategory)
                 .bind(
                         () -> {
@@ -114,7 +131,8 @@ public class StoreCategoryConfigComp extends SimpleRegionBuilder {
                                     confirm.get(),
                                     sync.get(),
                                     freeze.get(),
-                                    ref.get() != null ? ref.get().get().getUuid() : null);
+                                    identityRef.get() != null ? identityRef.get().get().getUuid() : null,
+                                    gatewayRef.get() != null ? gatewayRef.get().get().getUuid() : null);
                         },
                         config);
         var r = options.build();
diff --git a/app/src/main/java/io/xpipe/app/storage/DataStoreCategoryConfig.java b/app/src/main/java/io/xpipe/app/storage/DataStoreCategoryConfig.java
index 69ad340a5..9b6460f1c 100644
--- a/app/src/main/java/io/xpipe/app/storage/DataStoreCategoryConfig.java
+++ b/app/src/main/java/io/xpipe/app/storage/DataStoreCategoryConfig.java
@@ -23,9 +23,10 @@ public class DataStoreCategoryConfig {
 
     Boolean freezeConfigurations;
     UUID defaultIdentityStore;
+    UUID defaultGatewayStore;
 
     public static DataStoreCategoryConfig empty() {
-        return new DataStoreCategoryConfig(null, null, null, null, null, null);
+        return new DataStoreCategoryConfig(null, null, null, null, null, null, null);
     }
 
     public static DataStoreCategoryConfig merge(List<DataStoreCategoryConfig> configs) {
@@ -35,6 +36,7 @@ public class DataStoreCategoryConfig {
         Boolean sync = null;
         Boolean readOnly = null;
         UUID defaultIdentityStore = null;
+        UUID defaultGatewayStore = null;
         for (int i = configs.size() - 1; i >= 0; i--) {
             var config = configs.get(i);
             if (color == null) {
@@ -49,6 +51,9 @@ public class DataStoreCategoryConfig {
             if (defaultIdentityStore == null) {
                 defaultIdentityStore = config.defaultIdentityStore;
             }
+            if (defaultGatewayStore == null) {
+                defaultGatewayStore = config.defaultGatewayStore;
+            }
             if (sync == null) {
                 sync = config.sync;
             }
@@ -57,6 +62,6 @@ public class DataStoreCategoryConfig {
             }
         }
         return new DataStoreCategoryConfig(
-                color, dontAllowScripts, warnOnAllModifications, sync, readOnly, defaultIdentityStore);
+                color, dontAllowScripts, warnOnAllModifications, sync, readOnly, defaultIdentityStore, defaultGatewayStore);
     }
 }
diff --git a/dist/changelog/23.0.md b/dist/changelog/23.0.md
index 7282139e3..29f12984c 100644
--- a/dist/changelog/23.0.md
+++ b/dist/changelog/23.0.md
@@ -4,7 +4,13 @@ There is now a new system for RDP (on Windows) and VNC connections. They are now
 
 ![RDP](https://xpipe.io/assets/images/BlogPage/rdp.png)
 
-This implementation does its best at working around the limitations of mstsc to provide a smooth experience. It comes with a size locking system to allow you to open RDP sessions with the preferred size everytime. VNC sessions will open in the same tabbed window and now support dynamic resizes, meaning that it will now automatically adapt to the window size.
+This implementation does its best at working around the limitations of mstsc to provide a smooth experience. It comes with a tabbing and size locking system to allow you to open RDP sessions with the preferred size every time. VNC sessions will open in the same tabbed window and now support dynamic resizes, meaning that it will now automatically adapt to the window size.
+
+## Security keys
+
+The import for hardware security keys and smart cards for SSH has been improved. You can now select a PKCS#11 implementation out of multiple supported ones like OpenSC. Furthermore, the key selector from agents has been ported to also support security keys:
+
+![Security keys](https://xpipe.io/assets/images/BlogPage/security-keys.png)
 
 
 ## Proxies
@@ -21,6 +27,8 @@ If you are running XPipe in an enterprise environment behind a proxy, you can al
 
 ## Other
 
+- Add option to set default gateway for a category
 - SFTP connections will now automatically adjust the file system root if only a subdirectory is accessible
 - Fix application restart not working properly in bourne shell
 - Fix terminal dock tracking not working correctly if another terminal window was already open before
+- Fix manual sync for local dir always pulling on startup
diff --git a/lang/strings/translations_en.properties b/lang/strings/translations_en.properties
index 1da4020cd..da14b412b 100644
--- a/lang/strings/translations_en.properties
+++ b/lang/strings/translations_en.properties
@@ -1486,6 +1486,8 @@ categoryConfirmAllModifications=Confirm all modifications
 categoryConfirmAllModificationsDescription=Confirm any kind of modification for a connection or a file system first. This can prevent accidental operations on important systems.
 categoryDefaultIdentity=Default identity
 categoryDefaultIdentityDescription=If you frequently use a certain identity on many of the systems in this category, then setting a default identity will allow you to preselect it when creating new connections.
+categoryDefaultGateway=Default gateway
+categoryDefaultGatewayDescription=Use a specified gateway system for all connections in this category as a default if no other gateway is specified for a connection.
 categoryConfigTitle=$NAME$ configuration
 #context: verb
 configure=Configure