diff --git a/package/gargoyle/files/usr/lib/gargoyle/known_devices.sh b/package/gargoyle/files/usr/lib/gargoyle/known_devices.sh
index df905b71c..44216cb30 100644
--- a/package/gargoyle/files/usr/lib/gargoyle/known_devices.sh
+++ b/package/gargoyle/files/usr/lib/gargoyle/known_devices.sh
@@ -13,11 +13,32 @@
 #       option name    'Johns-Laptop'
 #       option mac     'AA:BB:CC:DD:EE:FF'
 #       option ip      '192.168.1.100'   # optional static IP
-#       option group   'family'          # optional group membership
+#       list group     'family'          # 0+ group memberships (a plain
+#       list group     'streaming'       # `option group` scalar -- the
+#                                         # pre-multi-group shape -- still
+#                                         # reads back fine: `uci show`
+#                                         # renders a single-value list
+#                                         # identically to a scalar option,
+#                                         # one line either way, so no
+#                                         # migration is needed for old
+#                                         # devices with exactly one group.
 #
-# Groups are identified purely by their name string — there is no separate
-# 'config group' section.  All unique group values across all host sections
-# are the set of defined groups.
+#   config group 'group_1'
+#       option name    'family'
+#
+# A group's name string is the identity that ties everything together
+# (host.group values, restriction/quota/QoS rules' GROUP:<name> targets, and
+# nftables set naming below) -- 'config group' sections do not change that,
+# they only let a group be DECLARED independent of any device carrying it.
+# The full set of defined groups is therefore the union of every unique
+# host.group value AND every declared group's option name (get_all_groups
+# below) -- a name present in both counts once. A group with no declaration
+# still works exactly as before: it exists only as long as >=1 host section
+# carries it, and vanishes the moment the last one stops (unchanged,
+# pre-existing behaviour). A group WITH a declaration persists at zero
+# devices instead -- see docs/standalone-device-groups-plan.md for why this
+# was added and why it's safe (manage_groups.sh already creates a group's
+# nftables set before any rule can reference it, regardless of device count).
 #
 # nftables set naming:
 #   Group names are sanitized to lowercase, with any character outside
@@ -49,42 +70,81 @@ get_device_field()
 	uci get "dhcp.$1.$2" 2>/dev/null
 }
 
-# get_device_group <section>
-# Returns the group name for a host section, or empty string if unset.
-get_device_group()
+# get_device_groups <section>
+# Prints every group name a host section belongs to (0, 1, or many --
+# one per line). Reads via `uci show` rather than `uci get`. Verified
+# against the real router (not assumed): a `list` option with multiple
+# values renders as ONE "key='A' 'B'" line, space-separated with each
+# value individually quoted -- NOT one line per value. Since group names
+# are charset-restricted to [a-zA-Z0-9_-] (no spaces, no quotes -- see the
+# dev_new_group validation in dhcp.js), stripping quotes and splitting on
+# the remaining spaces is a safe, portable parse (no GNU-sed-specific
+# escapes needed). A legacy single-value `option group 'family'` line
+# already has no interior spaces, so it passes through unsplit -- one
+# consistent pipeline for both shapes.
+get_device_groups()
+{
+	uci show dhcp 2>/dev/null | grep "^dhcp\.$1\.group=" | sed "s/^[^=]*=//; s/'//g" | tr ' ' '\n'
+}
+
+# get_all_declared_group_sections
+# Prints UCI section names for every 'group' section in /etc/config/dhcp.
+get_all_declared_group_sections()
 {
-	get_device_field "$1" "group"
+	uci show dhcp 2>/dev/null | grep '=group$' | sed 's/dhcp\.\(.*\)=group/\1/'
 }
 
-# set_device_group <section> <group_name>
-# Assigns a host section to a group.  Pass empty string to remove.
-set_device_group()
+# find_declared_group_section <group_name>
+# Prints the UCI section name of the 'group' section whose option name
+# exactly matches (case-sensitive, matching every other group-name
+# comparison in this codebase), or nothing + failure if none declares it.
+find_declared_group_section()
 {
-	local section="$1"
-	local group="$2"
-	if [ -z "$group" ]
-	then
-		uci del "dhcp.$section.group" 2>/dev/null
-	else
-		uci set "dhcp.$section.group=$group"
-	fi
+	local target="$1"
+	local gsections
+	gsections=$(get_all_declared_group_sections)
+	local gsection
+	for gsection in $gsections
+	do
+		if [ "$(get_device_field "$gsection" "name")" = "$target" ]
+		then
+			echo "$gsection"
+			return 0
+		fi
+	done
+	return 1
 }
 
 # get_all_groups
-# Prints each unique group name (one per line) found across all host sections.
+# Prints each unique group name (one per line): every host section's group
+# value, unioned with every declared group's name, so a zero-device
+# declared group still appears and a name present in both counts once.
 get_all_groups()
 {
-	local sections
-	sections=$(get_all_known_device_sections)
-	local section
-	for section in $sections
-	do
-		get_device_group "$section"
-	done | sort -u | grep -v '^$'
+	{
+		local sections
+		sections=$(get_all_known_device_sections)
+		local section
+		for section in $sections
+		do
+			get_device_groups "$section"
+		done
+
+		local gsections
+		gsections=$(get_all_declared_group_sections)
+		local gsection
+		for gsection in $gsections
+		do
+			get_device_field "$gsection" "name"
+		done
+	} | sort -u | grep -v '^$'
 }
 
 # get_sections_in_group <group_name>
-# Prints the UCI section names of every host that belongs to the given group.
+# Prints the UCI section names of every host that belongs to the given
+# group -- a host with several groups matches every one of them, not just
+# a single "the" group, so it's counted (and its IP seeded into the
+# nftables set) for each.
 get_sections_in_group()
 {
 	local target_group="$1"
@@ -93,9 +153,7 @@ get_sections_in_group()
 	local section
 	for section in $sections
 	do
-		local grp
-		grp=$(get_device_group "$section")
-		if [ "$grp" = "$target_group" ]
+		if get_device_groups "$section" | grep -qxF "$target_group"
 		then
 			echo "$section"
 		fi
diff --git a/package/gargoyle/files/usr/lib/gargoyle/post_lease.sh b/package/gargoyle/files/usr/lib/gargoyle/post_lease.sh
index 98cecee11..c9776cda9 100755
--- a/package/gargoyle/files/usr/lib/gargoyle/post_lease.sh
+++ b/package/gargoyle/files/usr/lib/gargoyle/post_lease.sh
@@ -32,21 +32,23 @@ ip="$3"
 [ "$ip" = "*" ] && exit 0
 [ "$event" != "add" ] && [ "$event" != "del" ] && [ "$event" != "old" ] && exit 0
 
-# Find which group this MAC belongs to by scanning UCI host sections
+# Find which section this MAC belongs to, then update EVERY group it's a
+# member of (a device can belong to more than one) -- each is an
+# independent nftables set, so its IP needs adding to/removing from all of
+# them, not just the first.
 for section in $(get_all_known_device_sections); do
 	stored_mac=$(get_device_field "$section" "mac" | tr 'a-z' 'A-Z')
 	[ "$stored_mac" != "$mac" ] && continue
 
-	group=$(get_device_group "$section")
-	[ -z "$group" ] && exit 0
+	for group in $(get_device_groups "$section"); do
+		setname=$(group_to_set_name "$group")
 
-	setname=$(group_to_set_name "$group")
-
-	if [ "$event" = "add" ] || [ "$event" = "old" ]; then
-		nft add element "$NFT_FAMILY" "$NFT_TABLE" "$setname" \{ "$ip" \} 2>/dev/null
-	else
-		nft delete element "$NFT_FAMILY" "$NFT_TABLE" "$setname" \{ "$ip" \} 2>/dev/null
-	fi
+		if [ "$event" = "add" ] || [ "$event" = "old" ]; then
+			nft add element "$NFT_FAMILY" "$NFT_TABLE" "$setname" \{ "$ip" \} 2>/dev/null
+		else
+			nft delete element "$NFT_FAMILY" "$NFT_TABLE" "$setname" \{ "$ip" \} 2>/dev/null
+		fi
+	done
 
 	exit 0
 done
diff --git a/package/gargoyle/files/www/dhcp.sh b/package/gargoyle/files/www/dhcp.sh
index 46ef52f48..6eb2f77b5 100755
--- a/package/gargoyle/files/www/dhcp.sh
+++ b/package/gargoyle/files/www/dhcp.sh
@@ -49,7 +49,8 @@
 	ip -6 neigh | grep -v "FAILED" | grep -v "^fe80:" | awk '{print "ip6neighData[\""$1"\"] = \""$5"\";"};'
 
 	echo "var knownDeviceGroups = [];"
-	uci show dhcp 2>/dev/null | grep '^dhcp\.[^.]*\.group=' | sed "s/^[^=]*=//; s/'//g" | sort -u | grep -v '^$' | while read grp ; do
+	. /usr/lib/gargoyle/known_devices.sh
+	get_all_groups | while read grp ; do
 		escaped=$(printf '%s' "$grp" | sed 's/\\/\\\\/g; s/"/\\"/g')
 		printf 'knownDeviceGroups.push("%s");\n' "$escaped"
 	done
@@ -252,6 +253,24 @@ ipHostHash["::1"] = "localhost6";
 	</div>
 </div>
 
+<div class="row">
+	<div class="col-lg-12">
+		<div class="panel panel-default">
+			<div class="panel-heading">
+				<h3 class="panel-title"><%~ dhcp.Grps %></h3>
+			</div>
+			<div class="panel-body">
+				<div class="row form-group">
+					<span class="col-xs-12"><button id="add_group_button" class="btn btn-default btn-add" onclick="addGroupModal()"><%~ dhcp.AdGrp %></button></span>
+				</div>
+				<div class="row form-group">
+					<div id="groups_table_container" class="table-responsive col-xs-12"></div>
+				</div>
+			</div>
+		</div>
+	</div>
+</div>
+
 <div id="firefox3_bug_correct" style="display:none">
 	<input type="text" value="firefox3_bug" />
 </div>
@@ -276,6 +295,24 @@ ipHostHash["::1"] = "localhost6";
 	</div>
 </div>
 
+<div class="modal fade" tabindex="-1" role="dialog" id="group_modal" aria-hidden="true" aria-labelledby="group_modal_title">
+	<div class="modal-dialog" role="document">
+		<div class="modal-content">
+			<div class="modal-header">
+				<h3 id="group_modal_title" class="panel-title"></h3>
+			</div>
+			<div class="modal-body">
+				<div class="row form-group">
+					<label class="col-xs-4" for="group_name" id="group_name_label"><%~ dhcp.GrpNm %>:</label>
+					<span class="col-xs-8"><input type="text" class="form-control" id="group_name" /></span>
+				</div>
+			</div>
+			<div class="modal-footer" id="group_modal_button_container">
+			</div>
+		</div>
+	</div>
+</div>
+
 <script>
 <!--
 	resetData();
diff --git a/package/gargoyle/files/www/js/dhcp.js b/package/gargoyle/files/www/js/dhcp.js
index 947ed79a0..a44386841 100644
--- a/package/gargoyle/files/www/js/dhcp.js
+++ b/package/gargoyle/files/www/js/dhcp.js
@@ -9,6 +9,61 @@
 var dhcpS=new Object(); //part of i18n
 var TSort_Data = new Array ('devices_table', 's', 's', 'p', 's', 's', 's', '');
 
+// Device Groups panel state. A group's existence is normally purely
+// implicit (a name string on >=1 host section, per known_devices.sh) --
+// declaredGroups tracks names given a standalone 'config group' section, so
+// they persist even at zero devices. See docs/standalone-device-groups-plan.md.
+var declaredGroups = [];
+var groupModalEditRow = null;
+var groupModalOriginalName = "";
+
+// A device can belong to more than one group (UCI `list group` -- see
+// known_devices.sh's data-model comment); the devices table's Group column
+// (row[5]) holds them as one comma+space-joined, alphabetically sorted
+// display string ("Guests, Kids"), "-" for none. These three helpers are
+// the only place that format is built or read, so it stays consistent
+// everywhere it's touched (table cell, save diff, Device Groups panel).
+function parseGroupList(str)
+{
+	if(str == null || str == "" || str == "-") { return []; }
+	return str.split(",").map(function(s){ return s.replace(/^\s+|\s+$/g, ""); }).filter(function(s){ return s != ""; });
+}
+
+function formatGroupList(arr)
+{
+	if(arr.length == 0) { return "-"; }
+	return arr.slice().sort().join(", ");
+}
+
+// Case/whitespace-insensitive match against the groups that already exist
+// (device-derived + declared, i.e. currentGroupNames()) -- returns the
+// EXISTING name's exact spelling if candidate is a near-duplicate of it
+// (e.g. "kids " -> "Kids"), otherwise the trimmed candidate as-is (a
+// genuinely new name). Silent auto-correct, not a validation error: typing
+// a spelling/case variant of a real group should join that group, not
+// create a confusingly-similar second one.
+function normalizeGroupName(candidate, existingNames)
+{
+	var trimmed = candidate.replace(/^\s+|\s+$/g, "");
+	var lower = trimmed.toLowerCase();
+	for(var ni = 0; ni < existingNames.length; ni++)
+	{
+		if(existingNames[ni].toLowerCase() == lower) { return existingNames[ni]; }
+	}
+	return trimmed;
+}
+
+// Normalized (array, sorted), shape-agnostic read of a section's existing
+// group membership from a UCIContainer -- mirrors resetData()'s own
+// string-or-array-or-empty handling, needed again here so saveChanges()
+// can tell a genuinely-unedited row from an edited one (see below).
+function readGroupsFromUci(container, section)
+{
+	var raw = container.get("dhcp", section, "group");
+	var arr = raw == "" ? [] : (Array.isArray(raw) ? raw.slice() : [raw]);
+	return arr.sort();
+}
+
 function saveChanges()
 {
 	errorList = proofreadAll();
@@ -244,8 +299,45 @@ function saveChanges()
 			var rDuid = row[4];
 			if(rDuid != "" && rDuid != "-") { uci.set("dhcp", cfgid, "duid", rDuid); } else { uci.remove("dhcp", cfgid, "duid"); }
 
-			var rGroup = row[5];
-			if(rGroup != "" && rGroup != "-") { uci.set("dhcp", cfgid, "group", rGroup); } else { uci.remove("dhcp", cfgid, "group"); }
+			// A device can belong to several groups (UCI `list group`).
+			// Only actually touch the key when membership genuinely
+			// differs from uciOriginal's -- an unconditional
+			// createListOption+set here would convert every legacy
+			// single-scalar-group device to list storage (a harmless but
+			// needless uci del + add_list) on every save, even ones this
+			// tab never edited, the same unnecessary-command-volume class
+			// the multi-tab fixes elsewhere on this page already guard
+			// against.
+			var newGroups = parseGroupList(row[5]).sort();
+			var oldGroups = readGroupsFromUci(uciOriginal, cfgid);
+			var groupsChanged = newGroups.length != oldGroups.length;
+			for(var gci = 0; !groupsChanged && gci < newGroups.length; gci++)
+			{
+				groupsChanged = newGroups[gci] != oldGroups[gci];
+			}
+			if(groupsChanged)
+			{
+				// Only genuinely multi-group devices need list storage;
+				// the common single-group case stays a plain scalar --
+				// same shape the pre-multi-group code always wrote, and
+				// what every existing single-group device already has on
+				// disk, so a save that keeps a device at exactly one
+				// group (even a changed one) never needlessly upgrades
+				// its storage shape.
+				if(newGroups.length > 1)
+				{
+					uci.createListOption("dhcp", cfgid, "group");
+					uci.set("dhcp", cfgid, "group", newGroups);
+				}
+				else if(newGroups.length == 1)
+				{
+					uci.set("dhcp", cfgid, "group", newGroups[0]);
+				}
+				else
+				{
+					uci.remove("dhcp", cfgid, "group");
+				}
+			}
 		}
 
 		// Any section this tab knew about that no row still maps to (by
@@ -262,6 +354,51 @@ function saveChanges()
 			}
 		}
 
+		// Declared (possibly zero-device) Device Groups: 'config group'
+		// sections, reconciled the same way the loop above reconciles
+		// 'config host' sections -- diff declaredGroups (this tab's current
+		// desired set) against whatever uciOriginal actually has, rather
+		// than blindly recreating everything every save.
+		var groupSectionCommands = [];
+		var existingGroupSections = uciOriginal.getAllSectionsOfType("dhcp", "group");
+		var existingGroupNameToSection = {};
+		var egsIdx;
+		for(egsIdx = 0; egsIdx < existingGroupSections.length; egsIdx++)
+		{
+			existingGroupNameToSection[uciOriginal.get("dhcp", existingGroupSections[egsIdx], "name")] = existingGroupSections[egsIdx];
+		}
+
+		var dgIdx;
+		var nextGroupIndex = 1;
+		for(dgIdx = 0; dgIdx < declaredGroups.length; dgIdx++)
+		{
+			var wantedName = declaredGroups[dgIdx];
+			if(existingGroupNameToSection[wantedName] == null)
+			{
+				var newGroupId = "group_" + nextGroupIndex;
+				while(uci.get("dhcp", newGroupId, "") != "")
+				{
+					nextGroupIndex++;
+					newGroupId = "group_" + nextGroupIndex;
+				}
+				uci.set("dhcp", newGroupId, "", "group");
+				uci.set("dhcp", newGroupId, "name", wantedName);
+				groupSectionCommands.push("uci set dhcp." + newGroupId + "=group");
+			}
+		}
+
+		for(egsIdx = 0; egsIdx < existingGroupSections.length; egsIdx++)
+		{
+			var esGroupSection = existingGroupSections[egsIdx];
+			var esGroupName = uciOriginal.get("dhcp", esGroupSection, "name");
+			if(declaredGroups.indexOf(esGroupName) < 0)
+			{
+				uciOriginal.removeSection("dhcp", esGroupSection);
+				uci.removeSection("dhcp", esGroupSection);
+				groupSectionCommands.push("uci del dhcp." + esGroupSection);
+			}
+		}
+
 		// We don't use /etc/ethers anymore
 		createEtherCommands = [ "touch /etc/ethers", "rm /etc/ethers" ];
 		var dnsmasqsec = uci.getAllSectionsOfType("dhcp","dnsmasq");
@@ -296,7 +433,7 @@ function saveChanges()
 		//need to restart firewall here because for add/remove of static ips, we need to restart bandwidth monitor, as well as for firewall commands above if we have any
 		var restartDhcpCommand = "\n/etc/init.d/dnsmasq restart ; \n/etc/init.d/odhcpd restart ; \nsh /usr/lib/gargoyle/restart_firewall.sh ; \n/usr/lib/gargoyle/manage_groups.sh\n" ;
 
-		commands = staticHostCommands.join("\n") + "\n" + uci.getScriptCommands(uciOriginal) + "\n" + createEtherCommands.join("\n") + "\n" + createHostCommands.join("\n") + "\n" + firewallCommands.join("\n") + "\n" + restartDhcpCommand ;
+		commands = staticHostCommands.join("\n") + "\n" + groupSectionCommands.join("\n") + "\n" + uci.getScriptCommands(uciOriginal) + "\n" + createEtherCommands.join("\n") + "\n" + createHostCommands.join("\n") + "\n" + firewallCommands.join("\n") + "\n" + restartDhcpCommand ;
 
 		var param = getParameterDefinition("commands", commands) + "&" + getParameterDefinition("hash", document.cookie.replace(/^.*hash=/,"").replace(/[\t ;]+.*$/, ""));
 
@@ -350,8 +487,13 @@ function resetData()
 		}
 		var duid = uciOriginal.get("dhcp",hostSection,"duid");
 		duid = duid == "" ? "-" : duid;
-		var group = uciOriginal.get("dhcp",hostSection,"group");
-		group = group == "" ? "-" : group;
+		// group may be a plain string (legacy single `option group`), an
+		// array (already-multi `list group`), or '' (none) -- normalize to
+		// an array before formatting, same shape uciOriginal itself uses
+		// for any other list-typed option (see dhcp_option handling above).
+		var rawGroup = uciOriginal.get("dhcp",hostSection,"group");
+		var groupArr = rawGroup == "" ? [] : (Array.isArray(rawGroup) ? rawGroup : [rawGroup]);
+		var group = formatGroupList(groupArr);
 
 		//Name, MAC, IPv4, IPv6 suffix, DUID, Group, Edit btn
 		devTableData.push([
@@ -462,11 +604,22 @@ function resetData()
 
 	//setup connected-hosts dropdown
 	resetDeviceMacList();
+
+	var groupSections = uciOriginal.getAllSectionsOfType("dhcp", "group");
+	declaredGroups = [];
+	var gsi;
+	for(gsi = 0; gsi < groupSections.length; gsi++)
+	{
+		var gname = uciOriginal.get("dhcp", groupSections[gsi], "name");
+		if(gname != "") { declaredGroups.push(gname); }
+	}
+	resetGroupsTable();
 }
 
 function removeDeviceCallback(table, row)
 {
 	resetDeviceMacList();
+	resetGroupsTable();
 }
 
 // Populate the "select from currently connected hosts" dropdown, excluding
@@ -502,6 +655,216 @@ function resetDeviceMacList()
 	setElementEnabled(document.getElementById("dev_from_connected"), hmEnabled, "none");
 }
 
+// ---- Device Groups panel ----
+//
+// A group is normally purely implicit (known_devices.sh: a name string
+// repeated on >=1 host section's "group" field, nothing else) -- this panel
+// lets one be declared standalone too (declaredGroups, reconciled against
+// 'config group' sections in saveChanges()), so Add/Edit/Delete here work
+// even at zero devices. See docs/standalone-device-groups-plan.md.
+
+function forEachDeviceRow(callback)
+{
+	var devTable = document.getElementById('devices_table_container').firstChild;
+	if(devTable == null) { return; }
+	var rows = devTable.tBodies[0].rows;
+	var ri;
+	for(ri = 0; ri < rows.length; ri++)
+	{
+		callback(rows[ri]);
+	}
+}
+
+// Every group name currently on a devices-table row (a row may list
+// several -- see parseGroupList), unioned with every declared group --
+// the same union get_all_groups() computes server-side, kept in sync
+// client-side as the devices table itself is edited. A device in N groups
+// increments N counts, one per group, not one for the whole cell.
+function currentGroupCounts()
+{
+	var counts = {};
+	forEachDeviceRow(function(row)
+	{
+		var groups = parseGroupList(row.childNodes[5].firstChild.data);
+		var gi;
+		for(gi = 0; gi < groups.length; gi++)
+		{
+			counts[groups[gi]] = (counts[groups[gi]] || 0) + 1;
+		}
+	});
+	var gi;
+	for(gi = 0; gi < declaredGroups.length; gi++)
+	{
+		if(counts[declaredGroups[gi]] === undefined) { counts[declaredGroups[gi]] = 0; }
+	}
+	return counts;
+}
+
+function currentGroupNames()
+{
+	var counts = currentGroupCounts();
+	var names = [];
+	for(var name in counts)
+	{
+		if(counts.hasOwnProperty(name)) { names.push(name); }
+	}
+	return names.sort();
+}
+
+function addToDeclaredGroups(name)
+{
+	if(declaredGroups.indexOf(name) < 0) { declaredGroups.push(name); }
+}
+
+function removeFromDeclaredGroups(name)
+{
+	var idx = declaredGroups.indexOf(name);
+	if(idx >= 0) { declaredGroups.splice(idx, 1); }
+}
+
+// Renames a group everywhere it's referenced: replaces just the matching
+// TOKEN within each devices-table row's (possibly multi-value) cell,
+// leaving any other groups that same device belongs to untouched, plus
+// the declared list -- touching a group through this panel makes it
+// persist going forward, same as Add.
+function renameGroupEverywhere(oldName, newName)
+{
+	forEachDeviceRow(function(row)
+	{
+		var groups = parseGroupList(row.childNodes[5].firstChild.data);
+		var idx = groups.indexOf(oldName);
+		if(idx >= 0)
+		{
+			groups[idx] = newName;
+			row.childNodes[5].firstChild.data = formatGroupList(groups);
+		}
+	});
+	removeFromDeclaredGroups(oldName);
+	addToDeclaredGroups(newName);
+}
+
+// Removes just this one group from every device that carries it (a device
+// in several groups keeps its others); never removes a device row itself.
+function clearGroupFromDevicesTable(name)
+{
+	forEachDeviceRow(function(row)
+	{
+		var groups = parseGroupList(row.childNodes[5].firstChild.data);
+		var idx = groups.indexOf(name);
+		if(idx >= 0)
+		{
+			groups.splice(idx, 1);
+			row.childNodes[5].firstChild.data = formatGroupList(groups);
+		}
+	});
+}
+
+function createGroupEditButton()
+{
+	var editButton = createInput("button");
+	editButton.textContent = UI.Edit;
+	editButton.className = "btn btn-default btn-edit";
+	editButton.onclick = function()
+	{
+		var row = this.parentNode.parentNode;
+		openGroupModal(dhcpS.EGrp, row.childNodes[0].firstChild.data, row);
+	};
+	return editButton;
+}
+
+function createGroupDeleteButton()
+{
+	var deleteButton = createInput("button");
+	deleteButton.textContent = UI.Remove;
+	deleteButton.className = "btn btn-default btn-remove";
+	deleteButton.onclick = function()
+	{
+		var row = this.parentNode.parentNode;
+		var name = row.childNodes[0].firstChild.data;
+		var count = currentGroupCounts()[name] || 0;
+		var msg = dhcpS.RmGrpConfirmPfx + ' "' + name + '" ' + dhcpS.RmGrpConfirmMid + ' ' + count + ' ' + dhcpS.RmGrpConfirmSfx;
+		if(!confirm(msg)) { return; }
+		clearGroupFromDevicesTable(name);
+		removeFromDeclaredGroups(name);
+		resetGroupsTable();
+	};
+	return deleteButton;
+}
+
+function resetGroupsTable()
+{
+	var names = currentGroupNames();
+	var counts = currentGroupCounts();
+	var groupsTableData = [];
+	var ni;
+	for(ni = 0; ni < names.length; ni++)
+	{
+		groupsTableData.push([
+			names[ni],
+			"" + counts[names[ni]],
+			createGroupEditButton(),
+			createGroupDeleteButton()
+		]);
+	}
+	var columnNames = [dhcpS.GrpNm, dhcpS.Devs, '', ''];
+	var groupsTable = createTable(columnNames, groupsTableData, "groups_table", false, false);
+	var tableContainer = document.getElementById('groups_table_container');
+	if(tableContainer.firstChild != null)
+	{
+		tableContainer.removeChild(tableContainer.firstChild);
+	}
+	tableContainer.appendChild(groupsTable);
+}
+
+function openGroupModal(title, currentName, editRow)
+{
+	groupModalEditRow = editRow;
+	groupModalOriginalName = currentName;
+	var modalButtons = [
+		{"title" : editRow == null ? UI.Add : UI.CApplyChanges, "classes" : "btn btn-primary", "function" : saveGroupModal},
+		"defaultDismiss"
+	];
+	modalPrepare('group_modal', title, [{"id" : "group_name", "value" : currentName}], modalButtons);
+	openModalWindow('group_modal');
+}
+
+function addGroupModal()
+{
+	openGroupModal(dhcpS.AdGrp, "", null);
+}
+
+function saveGroupModal()
+{
+	var name = document.getElementById("group_name").value;
+	if(name == "")
+	{
+		alert(dhcpS.GrpEmptyErr);
+		return;
+	}
+	if(name.match(/^[a-zA-Z0-9_-]+$/) == null)
+	{
+		alert(dhcpS.grpErr);
+		return;
+	}
+	if(name != groupModalOriginalName && currentGroupNames().indexOf(name) >= 0)
+	{
+		alert(dhcpS.dGrpErr);
+		return;
+	}
+
+	if(groupModalEditRow == null)
+	{
+		addToDeclaredGroups(name);
+	}
+	else if(name != groupModalOriginalName)
+	{
+		renameGroupEverywhere(groupModalOriginalName, name);
+	}
+
+	closeModalWindow('group_modal');
+	resetGroupsTable();
+}
+
 function setEnabled(enabled)
 {
 	var ids=['dhcp_start', 'dhcp_end', 'dhcp_use_alt_gateway', 'alt_gateway', 'dhcp_lease', 'block_mismatches', 'dhcpv6', 'ra', 'add_device_button'];
@@ -661,38 +1024,52 @@ function updateAltGwWarning()
 	w.style.display = (cb != null && cb.checked) ? "" : "none";
 }
 
-function populateGroupDatalist()
+// Builds the Add/Edit Device modal's group picker: one checkbox per
+// existing group (currentGroupNames() -- device-derived + declared, same
+// union the Device Groups panel itself uses) so a device can be put in
+// several at once, plus the "add new" text field's datalist for typing a
+// genuinely new name. selectedGroups (array) controls which boxes start
+// checked -- the device's current membership when editing, none when adding.
+function populateGroupChecklist(selectedGroups)
 {
+	var checklist = document.getElementById("dev_groups_checklist");
 	var datalist = document.getElementById("dev_group_list");
-	if(!datalist) { return; }
+	if(!checklist || !datalist) { return; }
+	while(checklist.firstChild) { checklist.removeChild(checklist.firstChild); }
 	while(datalist.firstChild) { datalist.removeChild(datalist.firstChild); }
 
-	var seen = {};
-	var gi;
-	for(gi = 0; gi < knownDeviceGroups.length; gi++)
-	{
-		seen[knownDeviceGroups[gi]] = 1;
-	}
-	var devTable = document.getElementById("devices_table_container").firstChild;
-	if(devTable)
-	{
-		var devData = getTableDataArray(devTable, true, false);
-		var ri;
-		for(ri = 0; ri < devData.length; ri++)
-		{
-			var grp = devData[ri][5];
-			if(grp && grp != "-") { seen[grp] = 1; }
-		}
-	}
-	var grpName;
-	for(grpName in seen)
+	var names = currentGroupNames();
+	var ni;
+	for(ni = 0; ni < names.length; ni++)
 	{
+		var name = names[ni];
+		var wrap = document.createElement("div");
+		var cb = createInput("checkbox");
+		cb.id = "dev_group_cb_" + ni;
+		cb.value = name;
+		cb.checked = selectedGroups.indexOf(name) >= 0;
+		var lbl = document.createElement("label");
+		lbl.setAttribute("for", cb.id);
+		lbl.textContent = " " + name;
+		wrap.appendChild(cb);
+		wrap.appendChild(lbl);
+		checklist.appendChild(wrap);
+
 		var opt = document.createElement("option");
-		opt.value = grpName;
+		opt.value = name;
 		datalist.appendChild(opt);
 	}
 }
 
+// Reads the currently-checked boxes from the modal built above.
+function checkedGroupCheckboxes()
+{
+	var checklist = document.getElementById("dev_groups_checklist");
+	if(!checklist) { return []; }
+	var boxes = Array.prototype.slice.call(checklist.querySelectorAll("input[type=checkbox]"));
+	return boxes.filter(function(cb){ return cb.checked; }).map(function(cb){ return cb.value; });
+}
+
 function proofreadDevice(excludeRow)
 {
 	var validateOptionalIp = function(val)
@@ -719,19 +1096,28 @@ function proofreadDevice(excludeRow)
 	var returnCodes = [0,0,0,0,0];
 	var errors = proofreadFields(addIds, labelIds, functions, returnCodes, addIds, document);
 
-	// Group is optional, but if set it must be a safe name: letters, digits,
-	// hyphen, underscore only. Spaces / special chars break the GROUP:<name>
-	// references used by firewall/quota/restriction rules and the nftables set.
-	var devGroupEl = document.getElementById("dev_group");
+	// The "add new group" field is optional, but if set it must be a safe
+	// name: letters, digits, hyphen, underscore only. Spaces / special
+	// chars break the GROUP:<name> references used by firewall/quota/
+	// restriction rules and the nftables set. (No "already exists" check
+	// here -- a name that case/whitespace-matches an existing group is
+	// silently folded into that group at commit time, not rejected; see
+	// normalizeGroupName.)
+	var devNewGroupEl = document.getElementById("dev_new_group");
 	var validateGroupName = function(val)
 	{
-		if(val == "" || val == "-") { return 0; }            // optional
-		return val.match(/^[a-zA-Z0-9_-]+$/) == null ? 1 : 0;
+		// Trim before checking charset: a name is normalized (trimmed,
+		// possibly case-folded onto an existing group) at commit time
+		// anyway, so incidental surrounding whitespace shouldn't itself
+		// be an error condition.
+		var trimmed = val.replace(/^\s+|\s+$/g, "");
+		if(trimmed == "" || trimmed == "-") { return 0; }     // optional
+		return trimmed.match(/^[a-zA-Z0-9_-]+$/) == null ? 1 : 0;
 	};
-	if(devGroupEl)
+	if(devNewGroupEl)
 	{
-		proofreadText(devGroupEl, validateGroupName, 0);
-		if(validateGroupName(devGroupEl.value) != 0)
+		proofreadText(devNewGroupEl, validateGroupName, 0);
+		if(validateGroupName(devNewGroupEl.value) != 0)
 		{
 			errors.push(dhcpS.grpErr);
 		}
@@ -817,7 +1203,7 @@ function addDevice()
 		var dIp    = document.getElementById('dev_ip').value;
 		var dHid   = document.getElementById('dev_hostid').value;
 		var dDuid  = document.getElementById('dev_duid').value;
-		var dGroup = document.getElementById('dev_group').value;
+		var dGroups = collectSelectedGroups();
 
 		var values = [
 			dName  == "" ? "-" : dName,
@@ -825,16 +1211,32 @@ function addDevice()
 			dIp    == "" ? "-" : dIp,
 			dHid   == "" ? "-" : dHid,
 			dDuid  == "" ? "-" : dDuid,
-			dGroup == "" ? "-" : dGroup,
+			formatGroupList(dGroups),
 			createEditButton()
 		];
 		var devTable = document.getElementById('devices_table_container').firstChild;
 		addTableRow(devTable, values, true, false, removeDeviceCallback);
 		resetDeviceMacList();
+		resetGroupsTable();
 		closeModalWindow('device_modal');
 	}
 }
 
+// Checked existing-group boxes, unioned with the "add new" field's value
+// (case/whitespace-normalized onto an existing name if it matches one --
+// see normalizeGroupName -- so it never creates a near-duplicate).
+function collectSelectedGroups()
+{
+	var groups = checkedGroupCheckboxes();
+	var newGroupRaw = document.getElementById('dev_new_group').value.replace(/^\s+|\s+$/g, "");
+	if(newGroupRaw != "")
+	{
+		var normalized = normalizeGroupName(newGroupRaw, currentGroupNames());
+		if(groups.indexOf(normalized) < 0) { groups.push(normalized); }
+	}
+	return groups;
+}
+
 function editDevice(editRow)
 {
 	var errors = proofreadDevice(editRow);
@@ -849,23 +1251,24 @@ function editDevice(editRow)
 		var dIp    = document.getElementById('dev_ip').value;
 		var dHid   = document.getElementById('dev_hostid').value;
 		var dDuid  = document.getElementById('dev_duid').value;
-		var dGroup = document.getElementById('dev_group').value;
+		var dGroups = collectSelectedGroups();
 
 		editRow.childNodes[0].firstChild.data = dName  == "" ? "-" : dName;
 		editRow.childNodes[1].firstChild.data = dMac;
 		editRow.childNodes[2].firstChild.data = dIp    == "" ? "-" : dIp;
 		editRow.childNodes[3].firstChild.data = dHid   == "" ? "-" : dHid;
 		editRow.childNodes[4].firstChild.data = dDuid  == "" ? "-" : dDuid;
-		editRow.childNodes[5].firstChild.data = dGroup == "" ? "-" : dGroup;
+		editRow.childNodes[5].firstChild.data = formatGroupList(dGroups);
 
 		closeModalWindow('device_modal');
 		resetDeviceMacList();
+		resetGroupsTable();
 	}
 }
 
 function addDeviceModal()
 {
-	populateGroupDatalist();
+	populateGroupChecklist([]);
 	var modalButtons = [
 		{"title" : UI.Add, "classes" : "btn btn-primary", "function" : addDevice},
 		"defaultDismiss"
@@ -890,7 +1293,7 @@ function addDeviceModal()
 		{"id" : "dev_ip",     "value" : ip},
 		{"id" : "dev_hostid", "value" : ""},
 		{"id" : "dev_duid",   "value" : ""},
-		{"id" : "dev_group",  "value" : ""}
+		{"id" : "dev_new_group", "value" : ""}
 	];
 	modalPrepare('device_modal', dhcpS.AdDev, modalElements, modalButtons);
 	setDeviceAdvancedVisible(false);
@@ -900,18 +1303,19 @@ function addDeviceModal()
 function editDeviceModal()
 {
 	var editRow = this.parentNode.parentNode;
-	populateGroupDatalist();
-	var modalButtons = [
-		{"title" : UI.CApplyChanges, "classes" : "btn btn-primary", "function" : function() { editDevice(editRow); }},
-		"defaultDiscard"
-	];
 
 	var dName  = editRow.childNodes[0].firstChild.data;
 	var dMac   = editRow.childNodes[1].firstChild.data;
 	var dIp    = editRow.childNodes[2].firstChild.data;
 	var dHid   = editRow.childNodes[3].firstChild.data;
 	var dDuid  = editRow.childNodes[4].firstChild.data;
-	var dGroup = editRow.childNodes[5].firstChild.data;
+	var dGroups = parseGroupList(editRow.childNodes[5].firstChild.data);
+
+	populateGroupChecklist(dGroups);
+	var modalButtons = [
+		{"title" : UI.CApplyChanges, "classes" : "btn btn-primary", "function" : function() { editDevice(editRow); }},
+		"defaultDiscard"
+	];
 
 	var modalElements = [
 		{"id" : "dev_name",   "value" : dName  == "-" ? "" : dName},
@@ -919,7 +1323,10 @@ function editDeviceModal()
 		{"id" : "dev_ip",     "value" : dIp    == "-" ? "" : dIp},
 		{"id" : "dev_hostid", "value" : dHid   == "-" ? "" : dHid},
 		{"id" : "dev_duid",   "value" : dDuid  == "-" ? "" : dDuid},
-		{"id" : "dev_group",  "value" : dGroup == "-" ? "" : dGroup}
+		// Existing membership is represented by the checked boxes above --
+		// the "add new" field always starts empty on open, same as it does
+		// when adding a device.
+		{"id" : "dev_new_group", "value" : ""}
 	];
 	modalPrepare('device_modal', dhcpS.EDev, modalElements, modalButtons);
 	// auto-expand the advanced section only if this device already uses IPv6 fields
diff --git a/package/gargoyle/files/www/quotas.sh b/package/gargoyle/files/www/quotas.sh
index ae15457a4..e479c0d0c 100755
--- a/package/gargoyle/files/www/quotas.sh
+++ b/package/gargoyle/files/www/quotas.sh
@@ -24,7 +24,8 @@
 	echo "var tcInstalled=\""$(gpkg list-installed -r "^tc-(tiny|full)" 2>&1)"\";"
 
 	echo "var knownDeviceGroups = [];"
-	uci show dhcp 2>/dev/null | grep '^dhcp\.[^.]*\.group=' | sed "s/^[^=]*=//; s/'//g" | sort -u | grep -v '^$' | while read grp ; do
+	. /usr/lib/gargoyle/known_devices.sh
+	get_all_groups | while read grp ; do
 		escaped=$(printf '%s' "$grp" | sed 's/\\/\\\\/g; s/"/\\"/g')
 		printf 'knownDeviceGroups.push("%s");\n' "$escaped"
 	done
diff --git a/package/gargoyle/files/www/restriction.sh b/package/gargoyle/files/www/restriction.sh
index 1527998c3..8bee4a396 100755
--- a/package/gargoyle/files/www/restriction.sh
+++ b/package/gargoyle/files/www/restriction.sh
@@ -14,7 +14,8 @@
 <!--
 <%
 	echo "var knownDeviceGroups = [];"
-	uci show dhcp 2>/dev/null | grep '^dhcp\.[^.]*\.group=' | sed "s/^[^=]*=//; s/'//g" | sort -u | grep -v '^$' | while read grp ; do
+	. /usr/lib/gargoyle/known_devices.sh
+	get_all_groups | while read grp ; do
 		escaped=$(printf '%s' "$grp" | sed 's/\\/\\\\/g; s/"/\\"/g')
 		printf 'knownDeviceGroups.push("%s");\n' "$escaped"
 	done
diff --git a/package/gargoyle/files/www/templates/device_template b/package/gargoyle/files/www/templates/device_template
index 907faa0f5..7db46b612 100644
--- a/package/gargoyle/files/www/templates/device_template
+++ b/package/gargoyle/files/www/templates/device_template
@@ -11,9 +11,11 @@
 				<span class="col-xs-7"><input type="text" id="dev_ip" oninput="proofreadIp(this)" maxlength="15" class="form-control" /></span>
 			</div>
 			<div class="row form-group">
-				<label class="col-xs-5" id="dev_group_label" for="dev_group"><%~ dhcp.GrpNm %> <em>(<%~ dhcp.opt %>)</em></label>
+				<label class="col-xs-5" id="dev_groups_label"><%~ dhcp.GrpNm %> <em>(<%~ dhcp.opt %>)</em></label>
 				<span class="col-xs-7">
-					<input type="text" id="dev_group" list="dev_group_list" class="form-control" autocomplete="off" placeholder="e.g. family, iot, work, kids" />
+					<div id="dev_groups_checklist"></div>
+					<label id="dev_new_group_label" for="dev_new_group"><%~ dhcp.AddNewGrp %></label>
+					<input type="text" id="dev_new_group" list="dev_group_list" class="form-control" autocomplete="off" placeholder="e.g. family, iot, work, kids" />
 					<datalist id="dev_group_list"></datalist>
 				</span>
 			</div>
diff --git a/package/plugin-gargoyle-i18n-English-EN/files/www/i18n/English-EN/dhcp.js b/package/plugin-gargoyle-i18n-English-EN/files/www/i18n/English-EN/dhcp.js
index f0acf45d9..2c10891b8 100644
--- a/package/plugin-gargoyle-i18n-English-EN/files/www/i18n/English-EN/dhcp.js
+++ b/package/plugin-gargoyle-i18n-English-EN/files/www/i18n/English-EN/dhcp.js
@@ -41,6 +41,16 @@ dhcpS.ShowAdv="Show advanced (IPv6 reservation)";
 dhcpS.HideAdv="Hide advanced (IPv6 reservation)";
 
 dhcpS.grpErr="Group name may only contain letters, numbers, hyphen and underscore (no spaces).";
+dhcpS.AddNewGrp="Or add a new group:";
+
+dhcpS.Grps="Device Groups";
+dhcpS.AdGrp="Add Group";
+dhcpS.EGrp="Edit Group";
+dhcpS.GrpEmptyErr="Enter a group name.";
+dhcpS.dGrpErr="A group with that name already exists.";
+dhcpS.RmGrpConfirmPfx="Remove group";
+dhcpS.RmGrpConfirmMid="? This clears it from";
+dhcpS.RmGrpConfirmSfx="device(s) below. The devices themselves will not be deleted.";
 
 dhcpS.UseAltGW="Use alternative default Gateway address";
 dhcpS.AltGW="Gateway IP address";
diff --git a/package/plugin-gargoyle-qos/files/www/qos_download.sh b/package/plugin-gargoyle-qos/files/www/qos_download.sh
index e1bbaaf63..c281d1f56 100755
--- a/package/plugin-gargoyle-qos/files/www/qos_download.sh
+++ b/package/plugin-gargoyle-qos/files/www/qos_download.sh
@@ -24,7 +24,8 @@
 	fi
 
 	echo "var knownDeviceGroups = [];"
-	uci show dhcp 2>/dev/null | grep '^dhcp\.[^.]*\.group=' | sed "s/^[^=]*=//; s/'//g" | sort -u | grep -v '^$' | while read grp ; do
+	. /usr/lib/gargoyle/known_devices.sh
+	get_all_groups | while read grp ; do
 		escaped=$(printf '%s' "$grp" | sed 's/\\/\\\\/g; s/"/\\"/g')
 		printf 'knownDeviceGroups.push("%s");\n' "$escaped"
 	done
diff --git a/package/plugin-gargoyle-qos/files/www/qos_upload.sh b/package/plugin-gargoyle-qos/files/www/qos_upload.sh
index 36b2e8b7a..10d7ac3d1 100755
--- a/package/plugin-gargoyle-qos/files/www/qos_upload.sh
+++ b/package/plugin-gargoyle-qos/files/www/qos_upload.sh
@@ -23,7 +23,8 @@
 	fi
 
 	echo "var knownDeviceGroups = [];"
-	uci show dhcp 2>/dev/null | grep '^dhcp\.[^.]*\.group=' | sed "s/^[^=]*=//; s/'//g" | sort -u | grep -v '^$' | while read grp ; do
+	. /usr/lib/gargoyle/known_devices.sh
+	get_all_groups | while read grp ; do
 		escaped=$(printf '%s' "$grp" | sed 's/\\/\\\\/g; s/"/\\"/g')
 		printf 'knownDeviceGroups.push("%s");\n' "$escaped"
 	done