diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs
index 959996a8..f44439c3 100644
--- a/src-tauri/src/commands.rs
+++ b/src-tauri/src/commands.rs
@@ -441,6 +441,40 @@ pub fn find_connection_by_id<R: Runtime>(
     Ok(conn)
 }
 
+/// Merge a list of incoming groups into an existing list, preserving hierarchy
+/// and repairing any `parent_id` that points to a group id not present in the
+/// union (i.e. neither in the existing list nor in the incoming batch).
+///
+/// Behaviour:
+/// - Existing groups with the same id are overwritten by the incoming one
+///   (so renames / re-ordering / new parent_id from the JSON win).
+/// - Missing parents are demoted to root (`parent_id = None`) rather than
+///   being rejected, so a partially-malformed JSON still imports successfully
+///   and the user keeps most of their tree.
+/// - The merge is idempotent: running it twice on the same input is a no-op.
+pub(crate) fn merge_groups(existing: &mut Vec<ConnectionGroup>, incoming: Vec<ConnectionGroup>) {
+    for new_group in incoming {
+        if let Some(existing_group) = existing.iter_mut().find(|g| g.id == new_group.id) {
+            *existing_group = new_group;
+        } else {
+            existing.push(new_group);
+        }
+    }
+
+    // Build the set of every group id we now have (post-merge) so we can
+    // detect parent_ids that no longer point anywhere. Collected into an
+    // owned set to release the immutable borrow before we mutate existing.
+    let known_ids: std::collections::HashSet<String> =
+        existing.iter().map(|g| g.id.clone()).collect();
+    for g in existing.iter_mut() {
+        if let Some(parent) = g.parent_id.as_deref() {
+            if !known_ids.contains(parent) {
+                g.parent_id = None;
+            }
+        }
+    }
+}
+
 /// Write the connections file and invalidate the in-memory connection cache so
 /// the next `find_connection_by_id` call re-reads fresh data from disk.
 fn save_connections_and_invalidate<R: Runtime>(
@@ -2584,6 +2618,162 @@ mod tests {
             assert!(state.handles.lock().unwrap().get("conn-1").is_none());
         }
     }
+
+    // -------------------------------------------------------------------
+    // Cascade-delete helpers
+    // -------------------------------------------------------------------
+
+    fn group(id: &str, parent: Option<&str>) -> ConnectionGroup {
+        ConnectionGroup {
+            id: id.to_string(),
+            name: id.to_string(),
+            collapsed: false,
+            sort_order: 0,
+            parent_id: parent.map(|p| p.to_string()),
+        }
+    }
+
+    fn conn(id: &str, group_id: Option<&str>) -> SavedConnection {
+        let mut c = saved_conn(id, None, false);
+        c.group_id = group_id.map(|g| g.to_string());
+        c
+    }
+
+    #[test]
+    fn collect_group_subtree_returns_root_only_for_leaf() {
+        let groups = vec![group("a", None), group("b", None)];
+        let subtree = crate::models::collect_group_subtree(&groups, "a");
+        assert_eq!(subtree, std::collections::HashSet::from(["a".to_string()]));
+    }
+
+    #[test]
+    fn collect_group_subtree_walks_full_descendant_chain() {
+        // Tree:
+        //   root
+        //   ├── child1
+        //   │   └── grand1
+        //   │       └── great1
+        //   └── child2
+        //   other (unrelated)
+        let groups = vec![
+            group("root", None),
+            group("child1", Some("root")),
+            group("grand1", Some("child1")),
+            group("great1", Some("grand1")),
+            group("child2", Some("root")),
+            group("other", None),
+        ];
+        let subtree = crate::models::collect_group_subtree(&groups, "root");
+        assert_eq!(
+            subtree,
+            std::collections::HashSet::from([
+                "root".to_string(),
+                "child1".to_string(),
+                "grand1".to_string(),
+                "great1".to_string(),
+                "child2".to_string(),
+            ])
+        );
+        assert!(!subtree.contains("other"));
+    }
+
+    #[test]
+    fn collect_group_subtree_for_subgroup_does_not_include_siblings() {
+        // Tree:
+        //   root
+        //   ├── keep
+        //   └── drop
+        let groups = vec![
+            group("root", None),
+            group("keep", Some("root")),
+            group("drop", Some("root")),
+        ];
+        let subtree = crate::models::collect_group_subtree(&groups, "drop");
+        assert_eq!(subtree, std::collections::HashSet::from(["drop".to_string()]));
+        assert!(!subtree.contains("root"));
+        assert!(!subtree.contains("keep"));
+    }
+
+    #[test]
+    fn collect_group_subtree_for_unknown_id_is_singleton() {
+        let groups = vec![group("a", None)];
+        let subtree = crate::models::collect_group_subtree(&groups, "missing");
+        assert_eq!(subtree, std::collections::HashSet::from(["missing".to_string()]));
+    }
+
+    #[test]
+    fn cascade_delete_removes_parent_descendants_and_connections() {
+        // Mirrors what the command does after the helper returns: groups
+        // and connections not in the subtree must survive untouched.
+        let groups = vec![
+            group("root", None),
+            group("child", Some("root")),
+            group("grand", Some("child")),
+            group("sibling", None),
+        ];
+        let connections = vec![
+            conn("c1", Some("root")),
+            conn("c2", Some("child")),
+            conn("c3", Some("grand")),
+            conn("c4", Some("sibling")),
+            conn("c5", None),
+        ];
+        let to_delete = crate::models::collect_group_subtree(&groups, "root");
+
+        let groups_after: Vec<_> = groups
+            .iter()
+            .filter(|g| !to_delete.contains(&g.id))
+            .cloned()
+            .collect();
+        let conns_after: Vec<_> = connections
+            .iter()
+            .filter(|c| !c.group_id.as_ref().is_some_and(|g| to_delete.contains(g)))
+            .cloned()
+            .collect();
+
+        assert_eq!(groups_after, vec![group("sibling", None)]);
+        assert_eq!(
+            conns_after.iter().map(|c| c.id.clone()).collect::<Vec<_>>(),
+            vec!["c4".to_string(), "c5".to_string()],
+        );
+    }
+
+    #[test]
+    fn cascade_delete_subgroup_leaves_parent_and_other_subgroups_alone() {
+        let groups = vec![
+            group("root", None),
+            group("keep", Some("root")),
+            group("drop", Some("root")),
+            group("grand", Some("drop")),
+        ];
+        let connections = vec![
+            conn("c1", Some("root")),
+            conn("c2", Some("drop")),
+            conn("c3", Some("grand")),
+            conn("c4", Some("keep")),
+        ];
+        let to_delete = crate::models::collect_group_subtree(&groups, "drop");
+
+        let groups_after: Vec<_> = groups
+            .iter()
+            .filter(|g| !to_delete.contains(&g.id))
+            .cloned()
+            .collect();
+        let conns_after: Vec<_> = connections
+            .iter()
+            .filter(|c| !c.group_id.as_ref().is_some_and(|g| to_delete.contains(g)))
+            .cloned()
+            .collect();
+
+        assert_eq!(
+            groups_after,
+            vec![group("root", None), group("keep", Some("root"))],
+        );
+        assert_eq!(
+            conns_after.iter().map(|c| c.id.clone()).collect::<Vec<_>>(),
+            vec!["c1".to_string(), "c4".to_string()],
+        );
+    }
 }
 
 #[tauri::command]
@@ -4217,18 +4407,31 @@ pub async fn get_connections_with_groups<R: Runtime>(
 pub async fn create_connection_group<R: Runtime>(
     app: AppHandle<R>,
     name: String,
+    parent_id: Option<String>,
 ) -> Result<ConnectionGroup, String> {
     let path = get_config_path(&app)?;
     let mut file = persistence::load_connections_file(&path).unwrap_or_default();
 
-    // Calculate next sort_order
-    let max_order = file.groups.iter().map(|g| g.sort_order).max().unwrap_or(-1);
+    if let Some(pid) = &parent_id {
+        if !file.groups.iter().any(|g| &g.id == pid) {
+            return Err(format!("Parent group with ID {} not found", pid));
+        }
+    }
+
+    let max_order = file
+        .groups
+        .iter()
+        .filter(|g| g.parent_id == parent_id)
+        .map(|g| g.sort_order)
+        .max()
+        .unwrap_or(-1);
 
     let group = ConnectionGroup {
         id: Uuid::new_v4().to_string(),
         name,
         collapsed: false,
         sort_order: max_order + 1,
+        parent_id,
     };
 
     file.groups.push(group.clone());
@@ -4237,6 +4440,89 @@ pub async fn create_connection_group<R: Runtime>(
     Ok(group)
 }
 
+/// Splits a `/`-separated group path into trimmed, non-empty segments.
+/// Returns an error if the result is empty.
+pub(crate) fn parse_group_path(path: &str) -> Result<Vec<String>, String> {
+    let segments: Vec<String> = path
+        .split('/')
+        .map(|s| s.trim().to_string())
+        .filter(|s| !s.is_empty())
+        .collect();
+    if segments.is_empty() {
+        return Err("Group path cannot be empty".to_string());
+    }
+    Ok(segments)
+}
+
+/// Finds an existing group by case-insensitive name match within a parent's
+/// children, or `None` if no such group exists.
+pub(crate) fn find_child_group<'a>(
+    groups: &'a [ConnectionGroup],
+    name: &str,
+    parent_id: &Option<String>,
+) -> Option<&'a ConnectionGroup> {
+    let name_lower = name.to_lowercase();
+    groups
+        .iter()
+        .find(|g| g.name.to_lowercase() == name_lower && g.parent_id == *parent_id)
+}
+
+/// Creates a nested group hierarchy from a `/`-separated path.
+///
+/// Each segment of `path` becomes one group. Existing segments are reused
+/// (looked up case-insensitively among the children of the current parent);
+/// missing segments are created in order. The final segment is returned.
+/// The hierarchy is created atomically: either every missing segment is
+/// persisted or none are.
+#[tauri::command]
+pub async fn create_group_path<R: Runtime>(
+    app: AppHandle<R>,
+    path: String,
+    parent_id: Option<String>,
+) -> Result<ConnectionGroup, String> {
+    let path_cfg = get_config_path(&app)?;
+    let mut file = persistence::load_connections_file(&path_cfg).unwrap_or_default();
+
+    if let Some(pid) = &parent_id {
+        if !file.groups.iter().any(|g| &g.id == pid) {
+            return Err(format!("Parent group with ID {} not found", pid));
+        }
+    }
+
+    let segments = parse_group_path(&path)?;
+    let mut current_parent = parent_id;
+    let mut last_created: Option<ConnectionGroup> = None;
+
+    for seg in segments {
+        if let Some(g) = find_child_group(&file.groups, &seg, &current_parent).cloned() {
+            current_parent = Some(g.id.clone());
+            last_created = Some(g);
+            continue;
+        }
+        let max_order = file
+            .groups
+            .iter()
+            .filter(|g| g.parent_id == current_parent)
+            .map(|g| g.sort_order)
+            .max()
+            .unwrap_or(-1);
+        let new_group = ConnectionGroup {
+            id: Uuid::new_v4().to_string(),
+            name: seg,
+            collapsed: false,
+            sort_order: max_order + 1,
+            parent_id: current_parent.clone(),
+        };
+        current_parent = Some(new_group.id.clone());
+        last_created = Some(new_group.clone());
+        file.groups.push(new_group);
+    }
+
+    save_connections_and_invalidate(&app, &path_cfg, &file)?;
+
+    last_created.ok_or_else(|| "Group path resolved to an empty hierarchy".to_string())
+}
+
 #[tauri::command]
 pub async fn update_connection_group<R: Runtime>(
     app: AppHandle<R>,
@@ -4269,6 +4555,83 @@ pub async fn update_connection_group<R: Runtime>(
 
     Ok(updated)
 }
+/// Re-parent a group. Pass `Some(id)` to make it a child of that group,
+/// or `None` to make it a top-level root. Cycles are rejected.
+#[tauri::command]
+pub async fn move_group_to_parent<R: Runtime>(
+    app: AppHandle<R>,
+    id: String,
+    parent_id: Option<String>,
+) -> Result<ConnectionGroup, String> {
+    let path = get_config_path(&app)?;
+    let mut file = persistence::load_connections_file(&path)?;
+
+    if !file.groups.iter().any(|g| g.id == id) {
+        return Err(format!("Group with ID {} not found", id));
+    }
+
+    if let Some(pid) = &parent_id {
+        if pid == &id {
+            return Err("A group cannot be its own parent".to_string());
+        }
+        if !file.groups.iter().any(|g| &g.id == pid) {
+            return Err(format!("Parent group with ID {} not found", pid));
+        }
+    }
+
+    reject_if_would_create_cycle(&file.groups, &id, parent_id.as_deref())?;
+
+    let group = file
+        .groups
+        .iter_mut()
+        .find(|g| g.id == id)
+        .expect("group existence checked above");
+    group.parent_id = parent_id;
+    let updated = group.clone();
+
+    save_connections_and_invalidate(&app, &path, &file)?;
+    Ok(updated)
+}
+
+/// Reject re-parenting that would create a cycle: `target` must not be a
+/// descendant of `group_id`. Walks up from `target` looking for `group_id`.
+/// Bounded by `groups.len()` to fail-safe against pre-existing data cycles.
+pub(crate) fn reject_if_would_create_cycle(
+    groups: &[ConnectionGroup],
+    group_id: &str,
+    new_parent_id: Option<&str>,
+) -> Result<(), String> {
+    let Some(target) = new_parent_id else {
+        return Ok(());
+    };
+    let mut current = Some(target.to_string());
+    let mut visited = std::collections::HashSet::new();
+    let max_steps = groups.len() + 1;
+    for _ in 0..max_steps {
+        match current {
+            Some(node) if node == group_id => {
+                return Err(
+                    "Cannot move a group into one of its own descendants (would create a cycle)"
+                        .to_string(),
+                );
+            }
+            Some(node) => {
+                if !visited.insert(node.clone()) {
+                    return Err(
+                        "Connection-group tree contains a pre-existing cycle; refusing to modify it"
+                            .to_string(),
+                    );
+                }
+                current = groups
+                    .iter()
+                    .find(|g| g.id == node)
+                    .and_then(|g| g.parent_id.clone());
+            }
+            None => return Ok(()),
+        }
+    }
+    Err("Connection-group tree is deeper than the number of groups; refusing to modify it".to_string())
+}
 
 #[tauri::command]
 pub async fn delete_connection_group<R: Runtime>(
@@ -4278,15 +4641,22 @@ pub async fn delete_connection_group<R: Runtime>(
     let path = get_config_path(&app)?;
     let mut file = persistence::load_connections_file(&path)?;
 
-    // Remove connections from the group (set group_id to None)
-    for conn in &mut file.connections {
-        if conn.group_id.as_ref() == Some(&id) {
-            conn.group_id = None;
-        }
+    // Ensure the group exists before we walk the tree.
+    if !file.groups.iter().any(|g| g.id == id) {
+        return Err(format!("Group with ID {} not found", id));
     }
 
-    // Remove the group
-    file.groups.retain(|g| g.id != id);
+    // Cascade delete: collect the target group and all of its descendants
+    // (transitively) so the entire subtree is removed. The caller only
+    // needs to specify the top-level group — every nested child group is
+    // deleted along with it. Connections belonging to any group in the
+    // subtree are removed as well.
+    let to_delete = crate::models::collect_group_subtree(&file.groups, &id);
+
+    file.groups.retain(|g| !to_delete.contains(&g.id));
+    file.connections
+        .retain(|c| !c.group_id.as_ref().is_some_and(|gid| to_delete.contains(gid)));
+
     save_connections_and_invalidate(&app, &path, &file)?;
 
     Ok(())
@@ -4466,14 +4836,8 @@ pub async fn import_connections_payload<R: Runtime>(
         .inner()
         .clone();
 
-    // Merge groups
-    for new_group in payload.groups {
-        if let Some(existing) = current_file.groups.iter_mut().find(|g| g.id == new_group.id) {
-            *existing = new_group;
-        } else {
-            current_file.groups.push(new_group);
-        }
-    }
+    // Merge groups (preserves hierarchy; demotes orphaned parent_ids to root)
+    merge_groups(&mut current_file.groups, payload.groups);
 
     // Merge connections and handle passwords
     for mut new_conn in payload.connections {
diff --git a/src-tauri/src/export_import_tests.rs b/src-tauri/src/export_import_tests.rs
index 1b7fc65f..270404fd 100644
--- a/src-tauri/src/export_import_tests.rs
+++ b/src-tauri/src/export_import_tests.rs
@@ -1,5 +1,6 @@
 #[cfg(test)]
 mod tests {
+    use crate::commands;
     use crate::models::{ExportPayload, ConnectionGroup, SavedConnection, SshConnection, ConnectionParams, DatabaseSelection};
 
     #[test]
@@ -11,6 +12,7 @@ mod tests {
                 name: "Test Group".to_string(),
                 collapsed: false,
                 sort_order: 0,
+                parent_id: None,
             }],
             connections: vec![SavedConnection {
                 id: "conn1".to_string(),
@@ -57,4 +59,205 @@ mod tests {
         assert_eq!(deserialized.connections[0].params.password, Some("password".to_string()));
         assert_eq!(deserialized.ssh_connections[0].password, Some("ssh_password".to_string()));
     }
+
+    // Helper: build a 3-level tree
+    //   - root "A"
+    //     - child "A1" (parent=A)
+    //       - grandchild "A1a" (parent=A1)
+    //   - root "B"
+    fn build_tree() -> Vec<ConnectionGroup> {
+        vec![
+            ConnectionGroup {
+                id: "A".into(),
+                name: "A".into(),
+                collapsed: false,
+                sort_order: 0,
+                parent_id: None,
+            },
+            ConnectionGroup {
+                id: "A1".into(),
+                name: "A1".into(),
+                collapsed: false,
+                sort_order: 0,
+                parent_id: Some("A".into()),
+            },
+            ConnectionGroup {
+                id: "A1a".into(),
+                name: "A1a".into(),
+                collapsed: false,
+                sort_order: 0,
+                parent_id: Some("A1".into()),
+            },
+            ConnectionGroup {
+                id: "B".into(),
+                name: "B".into(),
+                collapsed: false,
+                sort_order: 1,
+                parent_id: None,
+            },
+        ]
+    }
+
+    #[test]
+    fn test_export_preserves_nested_group_hierarchy() {
+        // The export payload must round-trip the parent_id chain through
+        // JSON so the importer can rebuild the tree, not just flat-list
+        // the groups.
+        let tree = build_tree();
+        let payload = ExportPayload {
+            version: 1,
+            groups: tree.clone(),
+            connections: vec![],
+            ssh_connections: vec![],
+            k8s_connections: vec![],
+        };
+
+        let json = serde_json::to_string(&payload).unwrap();
+        let deserialized: ExportPayload = serde_json::from_str(&json).unwrap();
+
+        // Same set of ids
+        let original_ids: std::collections::HashSet<_> = tree.iter().map(|g| g.id.clone()).collect();
+        let new_ids: std::collections::HashSet<_> =
+            deserialized.groups.iter().map(|g| g.id.clone()).collect();
+        assert_eq!(original_ids, new_ids);
+
+        // Every parent_id points to a group that exists in the payload
+        let new_id_refs: std::collections::HashSet<&str> =
+            deserialized.groups.iter().map(|g| g.id.as_str()).collect();
+        for g in &deserialized.groups {
+            if let Some(parent) = g.parent_id.as_deref() {
+                assert!(
+                    new_id_refs.contains(parent),
+                    "After deserialization, {} has parent_id {} which is not in the payload",
+                    g.id,
+                    parent
+                );
+            }
+        }
+
+        // The 3-level chain is intact: A1a -> A1 -> A
+        let a1a = deserialized.groups.iter().find(|g| g.id == "A1a").unwrap();
+        let a1 = deserialized.groups.iter().find(|g| g.id == "A1").unwrap();
+        let a = deserialized.groups.iter().find(|g| g.id == "A").unwrap();
+        assert_eq!(a1a.parent_id.as_deref(), Some("A1"));
+        assert_eq!(a1.parent_id.as_deref(), Some("A"));
+        assert_eq!(a.parent_id, None);
+    }
+
+    #[test]
+    fn test_merge_groups_imports_full_subtree_preserving_hierarchy() {
+        // Simulate the import step: empty local config, payload brings a
+        // 3-level tree. Every group should land with its parent_id intact.
+        let mut existing: Vec<ConnectionGroup> = vec![];
+        let incoming = build_tree();
+        crate::commands::merge_groups(&mut existing, incoming);
+
+        assert_eq!(existing.len(), 4);
+        let a1a = existing.iter().find(|g| g.id == "A1a").unwrap();
+        let a1 = existing.iter().find(|g| g.id == "A1").unwrap();
+        let a = existing.iter().find(|g| g.id == "A").unwrap();
+        let b = existing.iter().find(|g| g.id == "B").unwrap();
+
+        assert_eq!(a1a.parent_id.as_deref(), Some("A1"));
+        assert_eq!(a1.parent_id.as_deref(), Some("A"));
+        assert_eq!(a.parent_id, None);
+        assert_eq!(b.parent_id, None);
+    }
+
+    #[test]
+    fn test_merge_groups_demotes_orphaned_parent_id_to_root() {
+        // The JSON claims "A1a" is a child of "MISSING", which doesn't
+        // exist in the payload nor locally. We must not import a dangling
+        // pointer; instead we treat the orphan as a top-level group.
+        let mut existing: Vec<ConnectionGroup> = vec![];
+        let incoming = vec![ConnectionGroup {
+            id: "A1a".into(),
+            name: "A1a".into(),
+            collapsed: false,
+            sort_order: 0,
+            parent_id: Some("MISSING".into()),
+        }];
+        crate::commands::merge_groups(&mut existing, incoming);
+
+        assert_eq!(existing.len(), 1);
+        assert_eq!(existing[0].parent_id, None);
+    }
+
+    #[test]
+    fn test_merge_groups_keeps_existing_parent_when_payload_overrides() {
+        // The local config has "A" as a top-level group and "A1" as a
+        // child of "A". The payload re-imports the same ids but renames
+        // "A1" to "A-renamed". The child should still be a child of "A"
+        // in the merged result, because the parent's id is unchanged.
+        let mut existing = vec![
+            ConnectionGroup {
+                id: "A".into(),
+                name: "A".into(),
+                collapsed: false,
+                sort_order: 0,
+                parent_id: None,
+            },
+            ConnectionGroup {
+                id: "A1".into(),
+                name: "A1".into(),
+                collapsed: false,
+                sort_order: 0,
+                parent_id: Some("A".into()),
+            },
+        ];
+        let incoming = vec![ConnectionGroup {
+            id: "A1".into(),
+            name: "A-renamed".into(),
+            collapsed: false,
+            sort_order: 0,
+            parent_id: Some("A".into()),
+        }];
+        crate::commands::merge_groups(&mut existing, incoming);
+
+        assert_eq!(existing.len(), 2);
+        let a1 = existing.iter().find(|g| g.id == "A1").unwrap();
+        assert_eq!(a1.name, "A-renamed");
+        assert_eq!(a1.parent_id.as_deref(), Some("A"));
+    }
+
+    #[test]
+    fn test_merge_groups_is_idempotent() {
+        // Re-applying the same payload must not create duplicates or
+        // change the result beyond the first merge.
+        let mut existing: Vec<ConnectionGroup> = vec![];
+        let incoming = build_tree();
+        crate::commands::merge_groups(&mut existing, incoming.clone());
+        let snapshot = existing.clone();
+        crate::commands::merge_groups(&mut existing, incoming);
+        assert_eq!(existing, snapshot);
+    }
+
+    #[test]
+    fn test_merge_groups_incoming_parent_in_existing_only() {
+        // The payload brings "A1" with parent_id = "A", but "A" already
+        // exists in the local config (created independently). The merge
+        // must keep the link working: "A1" remains a child of "A".
+        let mut existing = vec![ConnectionGroup {
+            id: "A".into(),
+            name: "A-existing".into(),
+            collapsed: false,
+            sort_order: 0,
+            parent_id: None,
+        }];
+        let incoming = vec![ConnectionGroup {
+            id: "A1".into(),
+            name: "A1".into(),
+            collapsed: false,
+            sort_order: 0,
+            parent_id: Some("A".into()),
+        }];
+        crate::commands::merge_groups(&mut existing, incoming);
+
+        let a1 = existing.iter().find(|g| g.id == "A1").unwrap();
+        let a = existing.iter().find(|g| g.id == "A").unwrap();
+        assert_eq!(a1.parent_id.as_deref(), Some("A"));
+        // Existing "A" was not in the payload, so it stays as the user
+        // named it locally.
+        assert_eq!(a.name, "A-existing");
+    }
 }
diff --git a/src-tauri/src/group_tree_tests.rs b/src-tauri/src/group_tree_tests.rs
new file mode 100644
index 00000000..a2f39373
--- /dev/null
+++ b/src-tauri/src/group_tree_tests.rs
@@ -0,0 +1,130 @@
+//! Unit tests for the nested connection-group tree helpers in `commands.rs`.
+//!
+//! Covers the cycle detector and the `/`-separated path parser/lookup used
+//! by `create_group_path`. Pure functions, so they don't need any Tauri
+//! runtime or filesystem.
+
+#[cfg(test)]
+mod tests {
+    use crate::commands::{find_child_group, parse_group_path, reject_if_would_create_cycle};
+    use crate::models::ConnectionGroup;
+
+    fn g(id: &str, parent: Option<&str>) -> ConnectionGroup {
+        ConnectionGroup {
+            id: id.to_string(),
+            name: id.to_string(),
+            collapsed: false,
+            sort_order: 0,
+            parent_id: parent.map(|s| s.to_string()),
+        }
+    }
+
+    #[test]
+    fn cycle_check_none_parent_is_always_ok() {
+        let groups = vec![g("a", None), g("b", Some("a")), g("c", Some("b"))];
+        assert!(reject_if_would_create_cycle(&groups, "c", None).is_ok());
+    }
+
+    #[test]
+    fn cycle_check_same_id_is_rejected() {
+        let groups = vec![g("a", None)];
+        let err = reject_if_would_create_cycle(&groups, "a", Some("a")).unwrap_err();
+        assert!(err.to_lowercase().contains("cycle"));
+    }
+
+    #[test]
+    fn cycle_check_direct_parent_is_rejected() {
+        let groups = vec![g("a", Some("b")), g("b", None)];
+        let err = reject_if_would_create_cycle(&groups, "b", Some("a")).unwrap_err();
+        assert!(err.to_lowercase().contains("cycle"));
+    }
+
+    #[test]
+    fn cycle_check_deep_descendant_is_rejected() {
+        let groups = vec![
+            g("a", Some("b")),
+            g("b", Some("c")),
+            g("c", None),
+        ];
+        let err = reject_if_would_create_cycle(&groups, "c", Some("a")).unwrap_err();
+        assert!(err.to_lowercase().contains("cycle"));
+    }
+
+    #[test]
+    fn cycle_check_unrelated_target_is_ok() {
+        let groups = vec![
+            g("a1", Some("a")),
+            g("a", None),
+            g("b1", Some("b")),
+            g("b", None),
+        ];
+        assert!(reject_if_would_create_cycle(&groups, "a", Some("b")).is_ok());
+    }
+
+    #[test]
+    fn cycle_check_handles_preexisting_cycle_safely() {
+        let c = g("c", None);
+        let groups = vec![g("a", Some("b")), g("b", Some("a")), c];
+        let result = reject_if_would_create_cycle(&groups, "c", Some("a"));
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn cycle_check_target_not_in_tree_is_ok() {
+        let groups = vec![g("a", None), g("b", Some("a"))];
+        assert!(reject_if_would_create_cycle(&groups, "b", Some("a")).is_ok());
+    }
+
+    #[test]
+    fn parse_group_path_splits_on_slash() {
+        assert_eq!(
+            parse_group_path("a/b/c").unwrap(),
+            vec!["a".to_string(), "b".to_string(), "c".to_string()]
+        );
+    }
+
+    #[test]
+    fn parse_group_path_trims_whitespace_and_skips_empty() {
+        assert_eq!(
+            parse_group_path("  a /  /  b  / ").unwrap(),
+            vec!["a".to_string(), "b".to_string()]
+        );
+    }
+
+    #[test]
+    fn parse_group_path_rejects_empty_string() {
+        assert!(parse_group_path("").is_err());
+        assert!(parse_group_path("   /  /  ").is_err());
+    }
+
+    #[test]
+    fn parse_group_path_keeps_single_segment() {
+        assert_eq!(parse_group_path("lone").unwrap(), vec!["lone".to_string()]);
+    }
+
+    #[test]
+    fn find_child_group_is_case_insensitive() {
+        // The `g` helper uses the id as the name, so "Production" here
+        // and a search for "production" should still match.
+        let groups = vec![g("Production", None)];
+        let found = find_child_group(&groups, "production", &None);
+        assert!(found.is_some());
+        assert_eq!(found.unwrap().id, "Production");
+    }
+
+    #[test]
+    fn find_child_group_scopes_to_parent() {
+        // Two groups named the same, but with different parents.
+        let groups = vec![
+            g("alpha", Some("parent-1")),
+            g("alpha", Some("parent-2")),
+        ];
+        // Only the one under "parent-1" is found.
+        let found = find_child_group(&groups, "alpha", &Some("parent-1".to_string()));
+        assert!(found.is_some());
+        assert_eq!(found.unwrap().id, "alpha");
+        // Wrong parent yields None.
+        let missing = find_child_group(&groups, "alpha", &None);
+        assert!(missing.is_none());
+    }
+}
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 61f4f8d2..448d59b5 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -33,6 +33,8 @@ pub mod export;
 #[cfg(test)]
 pub mod export_import_tests;
 pub mod health_check;
+#[cfg(test)]
+pub mod group_tree_tests;
 pub mod heartbeat;
 #[cfg(test)]
 pub mod heartbeat_tests;
@@ -308,7 +310,9 @@ pub fn run() {
             commands::get_connection_groups,
             commands::get_connections_with_groups,
             commands::create_connection_group,
+            commands::create_group_path,
             commands::update_connection_group,
+            commands::move_group_to_parent,
             commands::delete_connection_group,
             commands::move_connection_to_group,
             commands::reorder_groups,
diff --git a/src-tauri/src/models.rs b/src-tauri/src/models.rs
index f33e1551..c5be93be 100644
--- a/src-tauri/src/models.rs
+++ b/src-tauri/src/models.rs
@@ -1,7 +1,29 @@
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 
 use serde::{Deserialize, Serialize};
 
+/// Returns the set of group IDs that form the subtree rooted at `root_id`,
+/// including the root itself. Walks `parent_id` pointers transitively so
+/// any number of nesting levels is collected. The caller is expected to
+/// have already verified that `root_id` exists; an unknown id yields a
+/// singleton set containing just that id (which won't match any record).
+pub fn collect_group_subtree(groups: &[ConnectionGroup], root_id: &str) -> HashSet<String> {
+    let mut to_delete: HashSet<String> = HashSet::new();
+    to_delete.insert(root_id.to_string());
+    let mut changed = true;
+    while changed {
+        changed = false;
+        for g in groups {
+            if let Some(parent) = g.parent_id.as_ref() {
+                if to_delete.contains(parent) && to_delete.insert(g.id.clone()) {
+                    changed = true;
+                }
+            }
+        }
+    }
+    to_delete
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(untagged)]
 pub enum DatabaseSelection {
@@ -218,7 +240,7 @@ pub struct SavedConnection {
     pub appearance: Option<ConnectionAppearance>,
 }
 
-#[derive(Debug, Deserialize, Serialize, Clone)]
+#[derive(Debug, Deserialize, Serialize, Clone, PartialEq, Eq)]
 pub struct ConnectionGroup {
     pub id: String,
     pub name: String,
@@ -226,6 +248,10 @@ pub struct ConnectionGroup {
     pub collapsed: bool,
     #[serde(default)]
     pub sort_order: i32,
+    /// `Some(group_id)` makes this group a child of that group; `None` is a
+    /// top-level root. Cycles are rejected by the backend.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub parent_id: Option<String>,
 }
 
 #[derive(Debug, Deserialize, Serialize, Clone, Default)]
diff --git a/src/components/connections/GroupHeader.tsx b/src/components/connections/GroupHeader.tsx
index c9e286f9..74190549 100644
--- a/src/components/connections/GroupHeader.tsx
+++ b/src/components/connections/GroupHeader.tsx
@@ -1,5 +1,5 @@
 import type { RefObject } from 'react';
-import { GripVertical, ChevronRight, Folder, FolderOpen, MoreVertical } from 'lucide-react';
+import { GripVertical, ChevronRight, Folder, FolderOpen, MoreVertical, Plus } from 'lucide-react';
 import clsx from 'clsx';
 import type { ConnectionGroup } from '../../contexts/DatabaseContext';
 
@@ -17,6 +17,8 @@ export interface GroupHeaderProps {
   onRenameConfirm: (groupId: string) => void;
   onGripMouseDown?: (e: React.MouseEvent) => void;
   isDragOver?: boolean;
+  onCreateSubgroup?: (groupId: string) => void;
+  depth?: number;
 }
 
 export const GroupHeader = ({
@@ -33,12 +35,15 @@ export const GroupHeader = ({
   onRenameConfirm,
   onGripMouseDown,
   isDragOver,
+  onCreateSubgroup,
+  depth = 0,
 }: GroupHeaderProps) => (
   <div
     className={clsx(
       "flex items-center gap-2 group cursor-pointer rounded-lg",
       isDragOver && "ring-1 ring-blue-400 bg-blue-500/5"
     )}
+    style={{ paddingLeft: depth > 0 ? Math.min(depth, 6) * 20 : 0 }}
     onClick={onToggleCollapse}
     onContextMenu={(e) => {
       e.preventDefault();
@@ -87,6 +92,18 @@ export const GroupHeader = ({
       <span className="text-sm font-semibold text-primary">{group.name}</span>
     )}
     <span className="text-xs text-muted">({connCount})</span>
+    {onCreateSubgroup && (
+      <button
+        onClick={(e) => {
+          e.stopPropagation();
+          onCreateSubgroup(group.id);
+        }}
+        title="Add subfolder"
+        className="opacity-0 group-hover:opacity-100 p-1 rounded hover:bg-surface-secondary transition-all"
+      >
+        <Plus size={12} className="text-amber-400" />
+      </button>
+    )}
     <button
       onClick={(e) => {
         e.stopPropagation();
diff --git a/src/contexts/DatabaseContext.ts b/src/contexts/DatabaseContext.ts
index a475d144..49a1fc5a 100644
--- a/src/contexts/DatabaseContext.ts
+++ b/src/contexts/DatabaseContext.ts
@@ -63,6 +63,9 @@ export interface ConnectionGroup {
   name: string;
   collapsed: boolean;
   sort_order: number;
+  /** When set, this group is a child of another group. `undefined` or `null`
+   * means top-level root. Cycles are rejected by the backend. */
+  parent_id?: string | null;
 }
 
 export interface ConnectionsFile {
@@ -153,8 +156,18 @@ export interface DatabaseContextType {
   getConnectionData: (connectionId: string) => ConnectionData | undefined;
   isConnectionOpen: (connectionId: string) => boolean;
   // Connection Group methods
-  createGroup: (name: string) => Promise<ConnectionGroup>;
+  createGroup: (name: string, parentId?: string | null) => Promise<ConnectionGroup>;
+  /**
+   * Creates a nested hierarchy from a `/`-separated path (e.g.
+   * "TEST/flexways"). Existing segments are reused, missing ones are
+   * created. Returns the deepest (last) group.
+   */
+  createGroupPath: (path: string, parentId?: string | null) => Promise<ConnectionGroup>;
   updateGroup: (id: string, updates: { name?: string; collapsed?: boolean; sort_order?: number }) => Promise<void>;
+  /** Re-parent a group. `parentId === null` moves the group to the top
+   * level; `undefined` would be a no-op (kept distinct to match the
+   * Tauri command's `Option<String>` parameter). */
+  moveGroupToParent: (id: string, parentId: string | null) => Promise<void>;
   deleteGroup: (id: string) => Promise<void>;
   moveConnectionToGroup: (connectionId: string, groupId: string | null) => Promise<void>;
   reorderGroups: (groupOrders: Array<[string, number]>) => Promise<void>;
diff --git a/src/contexts/DatabaseProvider.tsx b/src/contexts/DatabaseProvider.tsx
index 750ce0a0..26356bba 100644
--- a/src/contexts/DatabaseProvider.tsx
+++ b/src/contexts/DatabaseProvider.tsx
@@ -836,12 +836,38 @@ export const DatabaseProvider = ({ children }: { children: ReactNode }) => {
   }, []);
 
   // Connection Group methods
-  const createGroup = useCallback(async (name: string): Promise<ConnectionGroup> => {
-    const group = await invoke<ConnectionGroup>('create_connection_group', { name });
+  const createGroup = useCallback(async (
+    name: string,
+    parentId?: string | null
+  ): Promise<ConnectionGroup> => {
+    // The Tauri command expects `parent_id: Option<String>`. Passing
+    // `null` directly is fine — Tauri serialises it as `null` in JSON
+    // and the Rust deserializer maps it to `None`. Passing `undefined`
+    // would also work because serde's default attribute treats it the
+    // same, but we normalise to `null` for explicitness.
+    const group = await invoke<ConnectionGroup>('create_connection_group', {
+      name,
+      parentId: parentId ?? null,
+    });
     setConnectionGroups(prev => [...prev, group]);
     return group;
   }, []);
 
+  const createGroupPath = useCallback(async (
+    path: string,
+    parentId?: string | null
+  ): Promise<ConnectionGroup> => {
+    const group = await invoke<ConnectionGroup>('create_group_path', {
+      path,
+      parentId: parentId ?? null,
+    });
+    // Re-fetch the full group list because the backend may have reused
+    // existing segments and created new ones we don't yet know about.
+    const fresh = await invoke<ConnectionGroup[]>('get_connection_groups');
+    setConnectionGroups(fresh);
+    return group;
+  }, []);
+
   const updateGroup = useCallback(async (
     id: string,
     updates: { name?: string; collapsed?: boolean; sort_order?: number }
@@ -852,13 +878,27 @@ export const DatabaseProvider = ({ children }: { children: ReactNode }) => {
     );
   }, []);
 
+  const moveGroupToParent = useCallback(async (
+    id: string,
+    parentId: string | null
+  ): Promise<void> => {
+    await invoke('move_group_to_parent', { id, parentId });
+    setConnectionGroups(prev =>
+      prev.map(g => (g.id === id ? { ...g, parent_id: parentId } : g))
+    );
+  }, []);
+
   const deleteGroup = useCallback(async (id: string): Promise<void> => {
+    // The backend cascade-deletes the target group, every nested child
+    // group, and all connections belonging to any group in that subtree.
+    // Re-load from the backend instead of mirroring the cascade in
+    // optimistic state — this keeps the optimistic update trivial and
+    // guarantees the UI matches the persisted file even if the cascade
+    // behaviour evolves.
     await invoke('delete_connection_group', { id });
-    setConnectionGroups(prev => prev.filter(g => g.id !== id));
-    // Update connections that were in this group
-    setConnections(prev =>
-      prev.map(c => (c.group_id === id ? { ...c, group_id: undefined } : c))
-    );
+    const fresh = await invoke<ConnectionsFile>('get_connections_with_groups');
+    setConnections(fresh.connections);
+    setConnectionGroups(fresh.groups);
   }, []);
 
   const moveConnectionToGroup = useCallback(async (
@@ -952,7 +992,9 @@ export const DatabaseProvider = ({ children }: { children: ReactNode }) => {
       getConnectionData,
       isConnectionOpen,
       createGroup,
+      createGroupPath,
       updateGroup,
+      moveGroupToParent,
       deleteGroup,
       moveConnectionToGroup,
       reorderGroups,
diff --git a/src/i18n/locales/de.json b/src/i18n/locales/de.json
index 6bf12985..c8d4ab8c 100644
--- a/src/i18n/locales/de.json
+++ b/src/i18n/locales/de.json
@@ -717,12 +717,14 @@
     "selectTypeFirst": "Zuerst Kontext/Namespace/Typ auswählen",
     "useK8s": "Kubernetes-Port-Forward verwenden",
     "useK8sConnection": "Gespeicherte Verbindung",
-    "advanced": "Erweitert",
     "startupScript": "Startskript",
     "startupScriptDescription": "SQL, das bei jeder neuen Verbindung zu dieser Datenquelle ausgeführt wird. Verwenden Sie es für Sitzungseinstellungen wie SET / set_config (z. B. zum Umgehen von RLS). Trennen Sie Anweisungen mit Semikolons.",
     "startupScriptPlaceholder": "SELECT set_config('app.bypass_rls', 'on', false);",
     "scrollTabsLeft": "Registerkarten nach links blättern",
-    "scrollTabsRight": "Registerkarten nach rechts blättern"
+    "scrollTabsRight": "Registerkarten nach rechts blättern",
+    "useIamAuth": "AWS-IAM-Authentifizierung verwenden (RDS)",
+    "useIamAuthHint": "Das Passwortfeld wird als RDS-Auth-Token verwendet (aus `aws rds generate-db-auth-token`). Erfordert TLS. Tokens laufen alle 15 Minuten ab.",
+    "useIamAuthTlsRequired": "Aktiviere oben einen SSL-Modus, um die AWS-IAM-Authentifizierung zu nutzen."
   },
   "sshConnections": {
     "title": "SSH-Verbindungen",
@@ -1431,7 +1433,8 @@
     "createFirst": "Erstelle deine erste Gruppe, um Verbindungen zu organisieren",
     "groupName": "Gruppenname",
     "dragHint": "Verbindungen hierher ziehen",
-    "createError": "Erstellen der Gruppe fehlgeschlagen"
+    "createError": "Erstellen der Gruppe fehlgeschlagen",
+    "subgroupNamePrompt": "Subfolder name (use / for nested levels)"
   },
   "queryModal": {
     "database": "Datenbank",
diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json
index 3f126659..e9f6f667 100644
--- a/src/i18n/locales/en.json
+++ b/src/i18n/locales/en.json
@@ -751,12 +751,14 @@
     "selectTypeFirst": "Select context/namespace/type first",
     "useK8s": "Use Kubernetes Port-Forward",
     "useK8sConnection": "Saved Connection",
-    "advanced": "Advanced",
     "startupScript": "Startup Script",
     "startupScriptDescription": "SQL run on every new connection to this data source. Use it for session settings such as SET / set_config (e.g. bypassing RLS). Separate statements with semicolons.",
     "startupScriptPlaceholder": "SELECT set_config('app.bypass_rls', 'on', false);",
     "scrollTabsLeft": "Scroll tabs left",
-    "scrollTabsRight": "Scroll tabs right"
+    "scrollTabsRight": "Scroll tabs right",
+    "useIamAuth": "Use AWS IAM Authentication (RDS)",
+    "useIamAuthHint": "The password field is treated as an RDS auth token (from `aws rds generate-db-auth-token`). Requires TLS. Tokens expire every 15 minutes.",
+    "useIamAuthTlsRequired": "Enable an SSL mode above to use AWS IAM authentication."
   },
   "sshConnections": {
     "title": "SSH Connections",
@@ -1507,7 +1509,8 @@
     "createFirst": "Create your first group to organize connections",
     "groupName": "Group name",
     "dragHint": "Drag connections here",
-    "createError": "Failed to create group"
+    "createError": "Failed to create group",
+    "subgroupNamePrompt": "Subfolder name (use / for nested levels)"
   },
   "queryModal": {
     "database": "Database",
diff --git a/src/i18n/locales/es.json b/src/i18n/locales/es.json
index d4f3aa41..a5d2e129 100644
--- a/src/i18n/locales/es.json
+++ b/src/i18n/locales/es.json
@@ -722,12 +722,14 @@
     "selectTypeFirst": "Selecciona primero contexto/namespace/tipo",
     "useK8s": "Usar Port-Forward de Kubernetes",
     "useK8sConnection": "Conexión guardada",
-    "advanced": "Avanzado",
     "startupScript": "Script de inicio",
     "startupScriptDescription": "SQL que se ejecuta en cada nueva conexión a esta fuente de datos. Úsalo para ajustes de sesión como SET / set_config (p. ej., para omitir RLS). Separa las sentencias con punto y coma.",
     "startupScriptPlaceholder": "SELECT set_config('app.bypass_rls', 'on', false);",
     "scrollTabsLeft": "Desplazar pestañas a la izquierda",
-    "scrollTabsRight": "Desplazar pestañas a la derecha"
+    "scrollTabsRight": "Desplazar pestañas a la derecha",
+    "useIamAuth": "Usar autenticación AWS IAM (RDS)",
+    "useIamAuthHint": "El campo de contraseña se interpreta como un token de autenticación de RDS (obtenido con `aws rds generate-db-auth-token`). Requiere TLS. Los tokens caducan cada 15 minutos.",
+    "useIamAuthTlsRequired": "Activa un modo SSL arriba para usar la autenticación AWS IAM."
   },
   "sshConnections": {
     "title": "Conexiones SSH",
diff --git a/src/i18n/locales/fr.json b/src/i18n/locales/fr.json
index eedf2cf2..b3db7b26 100644
--- a/src/i18n/locales/fr.json
+++ b/src/i18n/locales/fr.json
@@ -717,12 +717,14 @@
     "selectTypeFirst": "Sélectionnez d'abord contexte/namespace/type",
     "useK8s": "Utiliser le Port-Forward Kubernetes",
     "useK8sConnection": "Connexion enregistrée",
-    "advanced": "Avancé",
     "startupScript": "Script de démarrage",
     "startupScriptDescription": "SQL exécuté à chaque nouvelle connexion à cette source de données. Utilisez-le pour des paramètres de session tels que SET / set_config (par exemple, pour contourner la RLS). Séparez les instructions par des points-virgules.",
     "startupScriptPlaceholder": "SELECT set_config('app.bypass_rls', 'on', false);",
     "scrollTabsLeft": "Défiler les onglets vers la gauche",
-    "scrollTabsRight": "Défiler les onglets vers la droite"
+    "scrollTabsRight": "Défiler les onglets vers la droite",
+    "useIamAuth": "Utiliser l'authentification AWS IAM (RDS)",
+    "useIamAuthHint": "Le champ mot de passe est traité comme un jeton d'authentification RDS (généré par `aws rds generate-db-auth-token`). Nécessite TLS. Les jetons expirent toutes les 15 minutes.",
+    "useIamAuthTlsRequired": "Activez un mode SSL ci-dessus pour utiliser l'authentification AWS IAM."
   },
   "sshConnections": {
     "title": "Connexions SSH",
@@ -1431,7 +1433,8 @@
     "createFirst": "Créez votre premier groupe pour organiser vos connexions",
     "groupName": "Nom du groupe",
     "dragHint": "Glissez les connexions ici",
-    "createError": "Échec de création du groupe"
+    "createError": "Échec de création du groupe",
+    "subgroupNamePrompt": "Subfolder name (use / for nested levels)"
   },
   "queryModal": {
     "database": "Base de données",
diff --git a/src/i18n/locales/it.json b/src/i18n/locales/it.json
index 4bf32e0c..88c4b6be 100644
--- a/src/i18n/locales/it.json
+++ b/src/i18n/locales/it.json
@@ -722,12 +722,14 @@
     "selectTypeFirst": "Seleziona prima contesto/namespace/tipo",
     "useK8s": "Usa Port-Forward Kubernetes",
     "useK8sConnection": "Connessione salvata",
-    "advanced": "Avanzate",
     "startupScript": "Script di avvio",
     "startupScriptDescription": "SQL eseguito a ogni nuova connessione a questa origine dati. Usalo per le impostazioni di sessione come SET / set_config (ad es. per bypassare la RLS). Separa le istruzioni con punto e virgola.",
     "startupScriptPlaceholder": "SELECT set_config('app.bypass_rls', 'on', false);",
     "scrollTabsLeft": "Scorri schede a sinistra",
-    "scrollTabsRight": "Scorri schede a destra"
+    "scrollTabsRight": "Scorri schede a destra",
+    "useIamAuth": "Usa autenticazione AWS IAM (RDS)",
+    "useIamAuthHint": "Il campo password è trattato come un token di autenticazione RDS (da `aws rds generate-db-auth-token`). Richiede TLS. I token scadono ogni 15 minuti.",
+    "useIamAuthTlsRequired": "Attiva una modalità SSL qui sopra per usare l'autenticazione AWS IAM."
   },
   "sshConnections": {
     "title": "Connessioni SSH",
diff --git a/src/i18n/locales/ja.json b/src/i18n/locales/ja.json
index e8f79120..f36a1627 100644
--- a/src/i18n/locales/ja.json
+++ b/src/i18n/locales/ja.json
@@ -731,12 +731,14 @@
     "selectTypeFirst": "先にコンテキスト/ネームスペース/タイプを選択してください",
     "useK8s": "Kubernetes ポートフォワードを使用",
     "useK8sConnection": "保存された接続",
-    "advanced": "詳細設定",
     "startupScript": "起動スクリプト",
     "startupScriptDescription": "このデータソースへの新規接続ごとに実行される SQL です。SET / set_config（例: RLS のバイパス）などのセッション設定に使用します。複数のステートメントはセミコロンで区切ってください。",
     "startupScriptPlaceholder": "SELECT set_config('app.bypass_rls', 'on', false);",
     "scrollTabsLeft": "タブを左にスクロール",
-    "scrollTabsRight": "タブを右にスクロール"
+    "scrollTabsRight": "タブを右にスクロール",
+    "useIamAuth": "AWS IAM 認証を使用する (RDS)",
+    "useIamAuthHint": "パスワード欄は RDS 認証トークン (`aws rds generate-db-auth-token` の出力) として扱われます。TLS 必須。トークンの有効期限は 15 分です。",
+    "useIamAuthTlsRequired": "AWS IAM 認証を使用するには、上記で SSL モードを有効にしてください。"
   },
   "sshConnections": {
     "title": "SSH 接続",
@@ -1450,7 +1452,8 @@
     "createFirst": "最初のグループを作成して接続を整理しましょう",
     "groupName": "グループ名",
     "dragHint": "接続をここにドラッグ",
-    "createError": "グループの作成に失敗しました"
+    "createError": "グループの作成に失敗しました",
+    "subgroupNamePrompt": "Subfolder name (use / for nested levels)"
   },
   "queryModal": {
     "database": "データベース",
diff --git a/src/i18n/locales/ru.json b/src/i18n/locales/ru.json
index 7611649a..7416624f 100644
--- a/src/i18n/locales/ru.json
+++ b/src/i18n/locales/ru.json
@@ -710,12 +710,14 @@
     "useK8s": "Использовать проброс портов Kubernetes",
     "useK8sConnection": "Сохранённое подключение",
     "appearance": "Внешний вид",
-    "advanced": "Дополнительно",
     "startupScript": "Сценарий запуска",
     "startupScriptDescription": "SQL, выполняемый при каждом новом подключении к этому источнику данных. Используйте его для настроек сеанса, таких как SET / set_config (например, для обхода RLS). Разделяйте операторы точкой с запятой.",
     "startupScriptPlaceholder": "SELECT set_config('app.bypass_rls', 'on', false);",
     "scrollTabsLeft": "Прокрутить вкладки влево",
-    "scrollTabsRight": "Прокрутить вкладки вправо"
+    "scrollTabsRight": "Прокрутить вкладки вправо",
+    "useIamAuth": "Использовать аутентификацию AWS IAM (RDS)",
+    "useIamAuthHint": "Поле пароля используется как токен аутентификации RDS (команда `aws rds generate-db-auth-token`). Требуется TLS. Срок действия токенов — 15 минут.",
+    "useIamAuthTlsRequired": "Чтобы использовать аутентификацию AWS IAM, включите режим SSL выше."
   },
   "sshConnections": {
     "title": "SSH-подключения",
@@ -1483,7 +1485,8 @@
     "createFirst": "Создайте первую группу для организации подключений",
     "groupName": "Название группы",
     "dragHint": "Перетащите подключения сюда",
-    "createError": "Не удалось создать группу"
+    "createError": "Не удалось создать группу",
+    "subgroupNamePrompt": "Subfolder name (use / for nested levels)"
   },
   "queryModal": {
     "database": "База данных",
diff --git a/src/i18n/locales/zh.json b/src/i18n/locales/zh.json
index 7dabdba7..3caf07ab 100644
--- a/src/i18n/locales/zh.json
+++ b/src/i18n/locales/zh.json
@@ -685,12 +685,14 @@
     "selectTypeFirst": "请先选择上下文/命名空间/类型",
     "useK8s": "使用 Kubernetes 端口转发",
     "useK8sConnection": "已保存的连接",
-    "advanced": "高级",
     "startupScript": "启动脚本",
     "startupScriptDescription": "每次新建到此数据源的连接时执行的 SQL。可用于会话设置，例如 SET / set_config（如绕过 RLS）。多条语句请用分号分隔。",
     "startupScriptPlaceholder": "SELECT set_config('app.bypass_rls', 'on', false);",
     "scrollTabsLeft": "向左滚动标签页",
-    "scrollTabsRight": "向右滚动标签页"
+    "scrollTabsRight": "向右滚动标签页",
+    "useIamAuth": "使用 AWS IAM 身份验证 (RDS)",
+    "useIamAuthHint": "密码字段将被视为 RDS 身份验证令牌（由 `aws rds generate-db-auth-token` 生成）。需要 TLS。令牌每 15 分钟过期。",
+    "useIamAuthTlsRequired": "请在上方启用 SSL 模式以使用 AWS IAM 身份验证。"
   },
   "sshConnections": {
     "title": "SSH 连接",
@@ -1376,7 +1378,8 @@
     "createFirst": "创建您的第一个分组以组织连接",
     "groupName": "分组名称",
     "dragHint": "将连接拖到此处",
-    "createError": "创建分组失败"
+    "createError": "创建分组失败",
+    "subgroupNamePrompt": "Subfolder name (use / for nested levels)"
   },
   "queryModal": {
     "database": "数据库",
diff --git a/src/pages/Connections.tsx b/src/pages/Connections.tsx
index 368bfb79..410c9281 100644
--- a/src/pages/Connections.tsx
+++ b/src/pages/Connections.tsx
@@ -46,8 +46,9 @@ export const Connections = () => {
     isConnectionOpen,
     switchConnection,
     connectionGroups,
-    createGroup,
+    createGroupPath,
     updateGroup,
+    moveGroupToParent,
     deleteGroup,
     moveConnectionToGroup,
     reorderGroups,
@@ -81,6 +82,8 @@ export const Connections = () => {
   } | null>(null);
   const [editingGroupId, setEditingGroupId] = useState<string | null>(null);
   const [editGroupName, setEditGroupName] = useState("");
+  const [subgroupInputFor, setSubgroupInputFor] = useState<string | null>(null);
+  const [subgroupInputValue, setSubgroupInputValue] = useState("");
   const [confirmModal, setConfirmModal] = useState<{
     title: string;
     message: string;
@@ -158,6 +161,21 @@ export const Connections = () => {
     [connectionGroups],
   );
 
+  // parentId -> children, with null key for top-level groups
+  const groupsByParent = useMemo(() => {
+    const map = new Map<string | null, typeof connectionGroups>();
+    for (const g of connectionGroups) {
+      const key = g.parent_id ?? null;
+      const arr = map.get(key) ?? [];
+      arr.push(g);
+      map.set(key, arr);
+    }
+    for (const [, arr] of map) {
+      arr.sort((a, b) => a.sort_order - b.sort_order);
+    }
+    return map;
+  }, [connectionGroups]);
+
   // Organize connections by group
   const { groupedConnections, ungroupedConnections } = useMemo(() => {
     const grouped: Record<string, SavedConnection[]> = {};
@@ -186,10 +204,12 @@ export const Connections = () => {
   }, [connections]);
 
   // Group management functions
-  const handleCreateGroup = async () => {
+  const handleCreateGroup = async (parentId?: string | null) => {
     if (!newGroupName.trim()) return;
     try {
-      await createGroup(newGroupName.trim());
+      // `/` separates nested levels: "TEST/flexways" creates `flexways`
+      // inside the existing `TEST` group, or both if TEST doesn't exist.
+      await createGroupPath(newGroupName.trim(), parentId ?? null);
       setNewGroupName("");
       setIsCreatingGroup(false);
       await loadConnections();
@@ -199,6 +219,47 @@ export const Connections = () => {
     }
   };
 
+  const handleCreateSubgroup = async (parentGroupId: string) => {
+    const name = window.prompt(
+      t("groups.subgroupNamePrompt", { defaultValue: "Subfolder name (use / for nested levels)" }),
+    );
+    if (!name || !name.trim()) return;
+    try {
+      await createGroupPath(name.trim(), parentGroupId);
+      await loadConnections();
+    } catch (e) {
+      console.error("Failed to create subgroup:", e);
+      setError(t("groups.createError"));
+    }
+  };
+
+  const startInlineSubgroupInput = (parentGroupId: string) => {
+    setSubgroupInputFor(parentGroupId);
+    setSubgroupInputValue("");
+  };
+
+  const cancelInlineSubgroupInput = () => {
+    setSubgroupInputFor(null);
+    setSubgroupInputValue("");
+  };
+
+  const confirmInlineSubgroupInput = async () => {
+    if (!subgroupInputFor) return;
+    const name = subgroupInputValue.trim();
+    if (!name) {
+      cancelInlineSubgroupInput();
+      return;
+    }
+    try {
+      await createGroupPath(name, subgroupInputFor);
+      cancelInlineSubgroupInput();
+      await loadConnections();
+    } catch (e) {
+      console.error("Failed to create subgroup:", e);
+      setError(t("groups.createError"));
+    }
+  };
+
   const handleToggleGroupCollapsed = async (groupId: string) => {
     setCollapsedGroups((prev) => {
       const next = new Set(prev);
@@ -489,6 +550,48 @@ export const Connections = () => {
       setDraggingGroupId(null);
       setDragOverGroupId(null);
       if (!targetGroupId || targetGroupId === sourceGroupId) return;
+
+      // Drop right of target's left edge => re-parent as child; else reorder
+      const targetEl = document.querySelector(
+        `[data-group-id="${targetGroupId}"]`,
+      ) as HTMLElement | null;
+      const sourceDepthAttr =
+        document
+          .querySelector(`[data-group-id="${sourceGroupId}"]`)
+          ?.getAttribute("data-group-depth") ?? "0";
+      const sourceDepth = Number.parseInt(sourceDepthAttr, 10) || 0;
+      let reparent = false;
+      if (targetEl) {
+        const rect = targetEl.getBoundingClientRect();
+        const indentStep = 16;
+        reparent = ev.clientX > rect.left + indentStep;
+      }
+
+      if (reparent) {
+        const isAncestor = (maybeAncestorId: string): boolean => {
+          let cur = connectionGroups.find((g) => g.id === maybeAncestorId);
+          while (cur) {
+            if (cur.id === sourceGroupId) return true;
+            cur = connectionGroups.find((g) => g.id === cur!.parent_id);
+          }
+          return false;
+        };
+        if (sourceDepth > 0 || isAncestor(targetGroupId)) {
+          setError(
+            t("groups.cannotMoveIntoDescendant", {
+              defaultValue: "Cannot move a group into one of its own subfolders",
+            }),
+          );
+          return;
+        }
+        void moveGroupToParent(sourceGroupId, targetGroupId).catch((err) => {
+          console.error("Failed to move group:", err);
+          setError(String(err));
+        });
+        return;
+      }
+
+      // Same-depth reorder
       const newOrder = [...sortedGroups];
       const fromIdx = newOrder.findIndex((g) => g.id === sourceGroupId);
       const toIdx = newOrder.findIndex((g) => g.id === targetGroupId);
@@ -516,8 +619,142 @@ export const Connections = () => {
     onRenameConfirm: handleRenameGroup,
     onGripMouseDown: (e: React.MouseEvent) => handleGripMouseDown(e, group.id),
     isDragOver: dragOverGroupId === group.id && draggingGroupId !== group.id,
+    onCreateSubgroup: startInlineSubgroupInput,
   });
 
+  const renderGroupTree = (
+    parentId: string | null,
+    mode: "grid" | "list",
+    depth: number = 0,
+  ): React.ReactNode => {
+    const children = groupsByParent.get(parentId) ?? [];
+    if (children.length === 0) return null;
+    return children.map((group) => {
+      const groupConns = filteredGroupedConnections[group.id] || [];
+      const isCollapsed = collapsedGroups.has(group.id);
+      if (search.trim() && !hasAnyMatchingDescendant(group.id, search)) {
+        return null;
+      }
+      const indentPx = Math.min(depth, 6) * 16;
+      const connCount = countDescendantConnections(group.id);
+      return (
+        <div
+          key={group.id}
+          data-group-id={group.id}
+          data-group-depth={depth}
+          className={mode === "grid" ? "space-y-3" : "space-y-2"}
+        >
+          <GroupHeader
+            {...groupHeaderProps(group)}
+            connCount={connCount}
+            depth={depth}
+          />
+          {subgroupInputFor === group.id && (
+            <div
+              className="flex items-center gap-2"
+              style={{ paddingLeft: 24 + indentPx }}
+              onClick={(e) => e.stopPropagation()}
+            >
+              <FolderPlus size={12} className="text-amber-400 shrink-0" />
+              <input
+                type="text"
+                value={subgroupInputValue}
+                onChange={(e) => setSubgroupInputValue(e.target.value)}
+                onKeyDown={(e) => {
+                  if (e.key === "Enter") void confirmInlineSubgroupInput();
+                  if (e.key === "Escape") cancelInlineSubgroupInput();
+                }}
+                onBlur={() => {
+                  if (subgroupInputValue.trim()) {
+                    void confirmInlineSubgroupInput();
+                  } else {
+                    cancelInlineSubgroupInput();
+                  }
+                }}
+                placeholder="Subfolder name (use / for nested)"
+                autoFocus
+                className="flex-1 px-2 py-1 bg-elevated border border-strong rounded text-sm text-primary placeholder:text-muted focus:border-amber-500/70 focus:outline-none"
+              />
+              <button
+                onMouseDown={(e) => e.preventDefault()}
+                onClick={() => void confirmInlineSubgroupInput()}
+                disabled={!subgroupInputValue.trim()}
+                className="p-1 rounded bg-amber-600 hover:bg-amber-500 text-white disabled:opacity-50 disabled:cursor-not-allowed transition-colors"
+              >
+                <Plus size={12} />
+              </button>
+              <button
+                onMouseDown={(e) => e.preventDefault()}
+                onClick={cancelInlineSubgroupInput}
+                className="p-1 rounded text-muted hover:text-primary hover:bg-surface-secondary transition-colors"
+              >
+                <X size={12} />
+              </button>
+            </div>
+          )}
+          {!isCollapsed && (
+            <div
+              className={
+                mode === "grid"
+                  ? "grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-3"
+                  : "flex flex-col gap-1.5"
+              }
+              style={{ paddingLeft: 24 + indentPx + (depth + 1) * 20 }}
+            >
+              {groupConns.map((conn) =>
+                mode === "grid" ? (
+                  <ConnectionCard key={conn.id} {...connCardProps(conn)} />
+                ) : (
+                  <ConnectionListItem
+                    key={conn.id}
+                    {...connCardProps(conn)}
+                  />
+                ),
+              )}
+            </div>
+          )}
+          {!isCollapsed && renderGroupTree(group.id, mode, depth + 1)}
+        </div>
+      );
+    });
+  };
+
+  const hasAnyMatchingDescendant = (
+    rootGroupId: string,
+    query: string,
+  ): boolean => {
+    const lc = query.toLowerCase();
+    const stack: string[] = [rootGroupId];
+    const visited = new Set<string>();
+    while (stack.length > 0) {
+      const id = stack.pop()!;
+      if (visited.has(id)) continue;
+      visited.add(id);
+      const conns = filteredGroupedConnections[id] || [];
+      if (conns.length > 0) return true;
+      const g = connectionGroups.find((x) => x.id === id);
+      if (g && g.name.toLowerCase().includes(lc)) return true;
+      const kids = groupsByParent.get(id) ?? [];
+      for (const kid of kids) stack.push(kid.id);
+    }
+    return false;
+  };
+
+  const countDescendantConnections = (groupId: string): number => {
+    let total = 0;
+    const stack: string[] = [groupId];
+    const visited = new Set<string>();
+    while (stack.length > 0) {
+      const id = stack.pop()!;
+      if (visited.has(id)) continue;
+      visited.add(id);
+      total += (filteredGroupedConnections[id] || []).length;
+      const kids = groupsByParent.get(id) ?? [];
+      for (const kid of kids) stack.push(kid.id);
+    }
+    return total;
+  };
+
   return (
     <div className="h-full flex flex-col overflow-hidden bg-base">
       {/* ── Header ────────────────────────────────────────────────────────── */}
@@ -663,7 +900,9 @@ export const Connections = () => {
                         setNewGroupName("");
                       }
                     }}
-                    placeholder={t("groups.groupName")}
+                    placeholder={t("groups.groupName", {
+                      defaultValue: "Group name (use / for nested)",
+                    })}
                     autoFocus
                     className="w-40 px-3 py-2 bg-elevated border border-strong rounded-xl text-sm text-primary placeholder:text-muted focus:border-amber-500/70 focus:outline-none transition-colors"
                   />
@@ -747,32 +986,7 @@ export const Connections = () => {
             {/* ── Grid view ─────────────────────────────────────────────── */}
             {viewMode === "grid" ? (
               <div className="space-y-6">
-                {sortedGroups.map((group) => {
-                  const groupConns = filteredGroupedConnections[group.id] || [];
-                  if (groupConns.length === 0 && search.trim()) return null;
-                  return (
-                    <div
-                      key={group.id}
-                      data-group-id={group.id}
-                      className="space-y-3"
-                    >
-                      <GroupHeader
-                        {...groupHeaderProps(group)}
-                        connCount={groupConns.length}
-                      />
-                      {!collapsedGroups.has(group.id) && (
-                        <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-3 pl-6">
-                          {groupConns.map((conn) => (
-                            <ConnectionCard
-                              key={conn.id}
-                              {...connCardProps(conn)}
-                            />
-                          ))}
-                        </div>
-                      )}
-                    </div>
-                  );
-                })}
+                {renderGroupTree(null, "grid")}
 
                 {filteredUngroupedConnections.length > 0 && (
                   <div className="space-y-3">
@@ -813,32 +1027,7 @@ export const Connections = () => {
             ) : (
               /* ── List view ──────────────────────────────────────────────── */
               <div className="space-y-6">
-                {sortedGroups.map((group) => {
-                  const groupConns = filteredGroupedConnections[group.id] || [];
-                  if (groupConns.length === 0 && search.trim()) return null;
-                  return (
-                    <div
-                      key={group.id}
-                      data-group-id={group.id}
-                      className="space-y-2"
-                    >
-                      <GroupHeader
-                        {...groupHeaderProps(group)}
-                        connCount={groupConns.length}
-                      />
-                      {!collapsedGroups.has(group.id) && (
-                        <div className="flex flex-col gap-1.5 pl-6">
-                          {groupConns.map((conn) => (
-                            <ConnectionListItem
-                              key={conn.id}
-                              {...connCardProps(conn)}
-                            />
-                          ))}
-                        </div>
-                      )}
-                    </div>
-                  );
-                })}
+                {renderGroupTree(null, "list")}
 
                 {filteredUngroupedConnections.length > 0 && (
                   <div className="space-y-2">
@@ -910,6 +1099,14 @@ export const Connections = () => {
           x={groupContextMenu.x}
           y={groupContextMenu.y}
           items={[
+            {
+              label: t("groups.newSubfolder", { defaultValue: "New subfolder" }),
+              icon: FolderPlus,
+              action: () => {
+                void handleCreateSubgroup(groupContextMenu.groupId);
+              },
+            },
+            { separator: true as const },
             {
               label: t("groups.rename"),
               icon: Edit,