diff --git a/k8s/migration/internal/controller/migrationplan_controller.go b/k8s/migration/internal/controller/migrationplan_controller.go
index 9e8fbbe46..b0d289b6a 100644
--- a/k8s/migration/internal/controller/migrationplan_controller.go
+++ b/k8s/migration/internal/controller/migrationplan_controller.go
@@ -735,11 +735,6 @@ func (r *MigrationPlanReconciler) ReconcileMigrationPlanJob(ctx context.Context,
 		if migrationtemplate.Spec.ProxyVMRef == nil {
 			return ctrl.Result{}, errors.New("StorageCopyMethod is HotAdd but ProxyVMRef is not set in MigrationTemplate")
 		}
-		if migrationplan.Spec.MigrationStrategy.Type == "hot" {
-			return ctrl.Result{}, errors.Errorf(
-				"StorageCopyMethod HotAdd does not support migration type 'hot' — use 'cold' or 'mock'",
-			)
-		}
 		proxyVM = &vjailbreakv1alpha1.ProxyVM{}
 		if err := r.Get(ctx, types.NamespacedName{Name: migrationtemplate.Spec.ProxyVMRef.Name, Namespace: migrationtemplate.Namespace}, proxyVM); err != nil {
 			return ctrl.Result{}, errors.Wrapf(err, "failed to get ProxyVM '%s'", migrationtemplate.Spec.ProxyVMRef.Name)
diff --git a/ui/e2e/migration/helpers/migration.helpers.ts b/ui/e2e/migration/helpers/migration.helpers.ts
index 56eaa4875..8cc6cf0fe 100644
--- a/ui/e2e/migration/helpers/migration.helpers.ts
+++ b/ui/e2e/migration/helpers/migration.helpers.ts
@@ -46,6 +46,7 @@ export const API = {
   podLogs: (namespace: string, podName: string) =>
     `**/namespaces/${namespace}/pods/${podName}/log*`,
   rollingMigrationPlans: `**${V1A1}/rollingmigrationplans`,
+  proxyVMs: `**${V1A1}/proxyvms`,
 }
 
 export const ROUTES = {
@@ -110,6 +111,13 @@ export async function selectPcdCluster(page: Page, clusterValue: string): Promis
   await page.getByRole('option', { name: clusterValue }).click()
 }
 
+// Storage copy method radios (Standard / Storage Accelerated / vJailbreak Accelerated)
+// live in NetworkAndStorageMappingStep. `label` matches the radio's accessible name,
+// so callers can pass e.g. /vJailbreak Accelerated Copy/i for the Hot-Add option.
+export async function selectStorageCopyMethod(page: Page, label: string | RegExp): Promise<void> {
+  await page.getByRole('radio', { name: label }).check()
+}
+
 // ─── Route mocking helpers ────────────────────────────────────────────────────
 
 type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'
diff --git a/ui/e2e/migration/migration-options-toggle.spec.ts b/ui/e2e/migration/migration-options-toggle.spec.ts
index 53f58e673..7452ca077 100644
--- a/ui/e2e/migration/migration-options-toggle.spec.ts
+++ b/ui/e2e/migration/migration-options-toggle.spec.ts
@@ -5,6 +5,7 @@ import {
   openMigrationDrawer,
   selectVmwareCluster,
   selectPcdCluster,
+  selectStorageCopyMethod,
   mockRoute,
   API,
 } from './helpers/migration.helpers'
@@ -73,3 +74,52 @@ test.describe('MIGOPTS-001 — GH-2176 regression: Migration Options toggles res
     await expect(checkbox).not.toBeChecked()
   })
 })
+
+test.describe('MIGOPTS-002 — PR#2352: Hot-Add allows Hot migration data copy', () => {
+  test.beforeEach(async ({ page }) => {
+    await mockFormApis(page)
+    // Selecting the HotAdd radio triggers useProxyVMsQuery; stub it so the request
+    // resolves instead of hanging (an empty list is enough -- this test only checks
+    // that the Data copy method control unlocks, it doesn't need a Ready Proxy VM).
+    await mockRoute(page, API.proxyVMs, 'GET', {
+      apiVersion: 'vjailbreak.k8s.pf9.io/v1alpha1',
+      kind: 'ProxyVMList',
+      metadata: { continue: '', resourceVersion: '1' },
+      items: [],
+    })
+  })
+
+  test('Hot is a selectable data copy method once HotAdd storage copy is chosen', async ({ page }) => {
+    await goToMigrations(page)
+    await openMigrationDrawer(page)
+    await selectVmwareCluster(page, 'DC1-Cluster')
+    await selectPcdCluster(page, 'pcd-cluster-1')
+    await page.waitForFunction(() => {
+      const menus = document.querySelectorAll('.MuiMenu-root')
+      return Array.from(menus).every((m) => m.getAttribute('aria-hidden') === 'true')
+    }, { timeout: 5000 })
+
+    await selectStorageCopyMethod(page, /vJailbreak Accelerated Copy/i)
+
+    const checkbox = page.getByRole('checkbox', { name: /data copy method/i })
+    await checkbox.scrollIntoViewIfNeeded()
+    await expect(checkbox).toBeVisible()
+    await expect(checkbox).not.toBeDisabled()
+
+    const box = await checkbox.boundingBox()
+    if (!box) throw new Error('checkbox not visible')
+    await page.mouse.click(box.x + box.width / 2, box.y + box.height / 2)
+    await expect(checkbox).toBeChecked()
+
+    const dataCopySelect = page.getByTestId('data-copy-method-container').locator('[role="combobox"]')
+    await expect(dataCopySelect).not.toHaveAttribute('aria-disabled', 'true')
+    await dataCopySelect.click()
+
+    const hotOption = page.getByRole('option', { name: 'Copy live VMs, then power off' })
+    await expect(hotOption).toBeVisible()
+    await expect(hotOption).not.toHaveAttribute('aria-disabled', 'true')
+    await hotOption.click()
+
+    await expect(dataCopySelect).toHaveText('Copy live VMs, then power off')
+  })
+})
diff --git a/ui/src/features/migration/steps/MigrationOptionsAlt.tsx b/ui/src/features/migration/steps/MigrationOptionsAlt.tsx
index 528bf2834..8421e88fb 100644
--- a/ui/src/features/migration/steps/MigrationOptionsAlt.tsx
+++ b/ui/src/features/migration/steps/MigrationOptionsAlt.tsx
@@ -95,7 +95,6 @@ export default function MigrationOptionsAlt({
   const { data: globalConfigMap } = useSettingsConfigMapQuery()
 
   const isStorageAcceleratedCopy = params?.storageCopyMethod === 'StorageAcceleratedCopy'
-  const isHotAdd = params?.storageCopyMethod === 'HotAdd'
 
   const hasWindowsVMSelected = useMemo(() => {
     if (!params?.vms || params.vms.length === 0) return false
@@ -215,13 +214,6 @@ export default function MigrationOptionsAlt({
     updateSelectedMigrationOptions
   ])
 
-  useEffect(() => {
-    if (!isHotAdd) return
-    if (params?.dataCopyMethod !== 'cold' && params?.dataCopyMethod !== 'mock') {
-      onChange('dataCopyMethod')('cold')
-    }
-  }, [isHotAdd, onChange])
-
   // Fallback to 'cold' here is fine for rendering (a harmless flash before the real
   // value lands), but treating "not yet resolved" as "genuinely cold" would be wrong
   // for the destructive clearing effect below.
@@ -310,12 +302,6 @@ export default function MigrationOptionsAlt({
               </SectionHeaderRow>
               <Divider />
 
-              {isHotAdd && selectedMigrationOptions.dataCopyMethod && (
-                <Alert severity="info" sx={{ mt: 1 }}>
-                  vJailbreak Accelerated Copy requires Cold or Mock copy. Other data copy methods
-                  are not available.
-                </Alert>
-              )}
               <OptionRow>
                 <OptionLeft>
                   <FormControlLabel
@@ -346,7 +332,7 @@ export default function MigrationOptionsAlt({
                 >
                   <Select
                     size="small"
-                    disabled={!selectedMigrationOptions.dataCopyMethod && !isHotAdd}
+                    disabled={!selectedMigrationOptions.dataCopyMethod}
                     labelId="source-item-label"
                     value={params?.dataCopyMethod || 'cold'}
                     onChange={(e) => {
@@ -358,11 +344,7 @@ export default function MigrationOptionsAlt({
                     fullWidth
                   >
                     {DATA_COPY_OPTIONS.map((item) => (
-                      <MenuItem
-                        key={item.value}
-                        value={item.value}
-                        disabled={isHotAdd && item.value !== 'cold' && item.value !== 'mock'}
-                      >
+                      <MenuItem key={item.value} value={item.value}>
                         {item.label}
                       </MenuItem>
                     ))}
diff --git a/v2v-helper/migrate/hotadd_copy.go b/v2v-helper/migrate/hotadd_copy.go
index 63c24a09a..d260ec1f0 100644
--- a/v2v-helper/migrate/hotadd_copy.go
+++ b/v2v-helper/migrate/hotadd_copy.go
@@ -15,6 +15,7 @@ import (
 	vjailbreakv1alpha1 "github.com/platform9/vjailbreak/k8s/migration/api/v1alpha1"
 	"github.com/platform9/vjailbreak/pkg/common/constants"
 	esxissh "github.com/platform9/vjailbreak/v2v-helper/esxi-ssh"
+	"github.com/platform9/vjailbreak/v2v-helper/nbd"
 	k8sutils "github.com/platform9/vjailbreak/v2v-helper/pkg/k8sutils"
 	"github.com/platform9/vjailbreak/v2v-helper/pkg/utils"
 	"github.com/platform9/vjailbreak/v2v-helper/vcenter"
@@ -35,12 +36,8 @@ const (
 	hotAddNBDCopyRetries    = 3
 	hotAddNBDCopyRetryWait  = 10 * time.Second
 
-	// maxSCSIControllerUnits is the unit-number space findPreferredDiskController
-	// scans per controller (0-15, unit 7 reserved), the classic 15-target SCSI
-	// limit. PVSCSI can address more units on newer hardware versions, but that
-	// depends on VM hardware version and guest driver support we can't assume
-	// for every Proxy VM, so this stays at the conservative, universally-safe
-	// value rather than the higher figure some PVSCSI configurations support.
+	// maxSCSIControllerUnits is the classic 15-target SCSI limit per controller
+	// (0-15, unit 7 reserved) -- conservative, but safe for any Proxy VM.
 	maxSCSIControllerUnits = 16
 )
 
@@ -71,13 +68,8 @@ func (migobj *Migrate) getVCenterClient() (*vcenter.VCenterClient, error) {
 }
 
 // attachAllDisks attaches every frozen disk in transfers to the Proxy VM.
-//
-// Multiple migrations can share one Proxy VM. attachDiskToProxy computes a
-// free controller/unit-number slot from a snapshot of the VM's device list,
-// then submits a ReconfigVM_Task -- not atomic, so concurrent callers can
-// compute the same slot and one fails with "Invalid configuration for device
-// 'N'." utils.WaitForProxyVMLock/ReleaseProxyVMLock serialize this against
-// vpwned-sdk's in-memory lock, held only for this function.
+// Attach is not atomic (compute slot, then ReconfigVM_Task), so concurrent
+// migrations sharing a Proxy VM are serialized via WaitForProxyVMLock.
 func (migobj *Migrate) attachAllDisks(ctx context.Context, migrationName string,
 	proxyVMObj *object.VirtualMachine, transfers []hotAddDiskTransfer,
 ) error {
@@ -194,21 +186,10 @@ func (migobj *Migrate) attachDiskToProxy(ctx context.Context, proxyVMObj *object
 	return 0, fmt.Errorf("could not determine device key for newly attached disk %s", vmdkPath)
 }
 
-// findPreferredDiskController returns a VMware Paravirtual (PVSCSI) SCSI
-// controller that has a free unit-number slot, if the Proxy VM has one.
-// PVSCSI reliably passes SCSI VPD page 0x83 (WWID) through to the guest,
-// which readGuestWWIDs depends on to identify hot-added disks; LSI Logic
-// Parallel/SAS and BusLogic controllers don't reliably do this (see
-// VJAILB-232). deviceList.FindDiskController("") has no controller-type
-// preference and will happily hand back a non-PVSCSI controller even when a
-// PVSCSI one is also present and has room -- which is exactly what happens
-// once a Proxy VM has more than one SCSI controller. This does not create
-// any device; it only chooses among controllers already on the VM, so it
-// needs no permission beyond the read+AddDevice this function already used.
-// Falls back to FindDiskController("") only if no PVSCSI controller has
-// room -- the ProxyVM onboarding gate (proxyvm_controller.go) should prevent
-// a Proxy VM without one from ever being usable, but this keeps the old
-// behavior as a safety net rather than a hard failure.
+// findPreferredDiskController prefers a PVSCSI controller with a free slot --
+// PVSCSI reliably passes WWIDs through to the guest (readGuestWWIDs depends on
+// this), LSI/BusLogic don't (VJAILB-232). Falls back to any controller with
+// room if no PVSCSI one is available.
 func findPreferredDiskController(deviceList object.VirtualDeviceList) (govmomitypes.BaseVirtualController, error) {
 	// Count occupied unit numbers per controller key so "has a PVSCSI
 	// controller" doesn't wrongly match one that's already full.
@@ -405,13 +386,16 @@ func (migobj *Migrate) findFreePorts(sshClient *esxissh.Client, rangeMin, rangeM
 // Polls /proc/net/tcp until the port is bound before returning.
 func (migobj *Migrate) serveViaNBD(sshClient *esxissh.Client, blockDevice string, port int) (int, error) {
 	portHex := strings.ToUpper(fmt.Sprintf("%04x", port))
+	// qemu-nbd defaults to a single client (--shared=1), but CopyChangedBlocks
+	// opens nbd.HandlePoolSize concurrent connections -- without --shared set to
+	// match, the second connection hangs forever waiting for a free client slot.
 	cmd := fmt.Sprintf(
-		`nohup qemu-nbd --format=raw --port=%d --bind=0.0.0.0 --persistent %s </dev/null >/dev/null 2>&1 & `+
+		`nohup qemu-nbd --format=raw --port=%d --bind=0.0.0.0 --persistent --shared=%d %s </dev/null >/dev/null 2>&1 & `+
 			`pid=$!; i=0; `+
 			`while [ $i -lt 20 ] && ! grep -q ":%s " /proc/net/tcp /proc/net/tcp6 2>/dev/null; `+
 			`do i=$((i+1)); sleep 0.25; done; `+
 			`echo $pid`,
-		port, blockDevice, portHex,
+		port, nbd.HandlePoolSize, blockDevice, portHex,
 	)
 	out, err := sshClient.ExecuteCommand(cmd)
 	if err != nil {
@@ -483,11 +467,9 @@ func (migobj *Migrate) adjustProxyDiskCount(ctx context.Context, delta int) {
 	migobj.logMessage(fmt.Sprintf("Warning: gave up updating ProxyVM %s disk count after conflicts", migobj.ProxyVMName))
 }
 
-// cleanupHotAdd kills NBD daemons, detaches proxy VM disks, and removes the snapshot.
-// Individual failures are logged without aborting the cleanup sequence.
-func (migobj *Migrate) cleanupHotAdd(ctx context.Context, sshClient *esxissh.Client,
-	transfers []hotAddDiskTransfer, proxyVMObj *object.VirtualMachine,
-) {
+// killNBDDaemons kills each transfer's qemu-nbd process on the Proxy VM via SSH.
+// Failures are logged without aborting.
+func (migobj *Migrate) killNBDDaemons(sshClient *esxissh.Client, transfers []hotAddDiskTransfer) {
 	for _, t := range transfers {
 		if t.NBDPid <= 0 {
 			continue
@@ -496,28 +478,41 @@ func (migobj *Migrate) cleanupHotAdd(ctx context.Context, sshClient *esxissh.Cli
 			utils.PrintLog(fmt.Sprintf("Warning: failed to kill qemu-nbd PID %d: %v", t.NBDPid, err))
 		}
 	}
+}
 
-	// Detach disks from proxy VM (keepFiles=true — we must NOT delete the frozen VMDK).
-	if proxyVMObj != nil {
-		var vmProps mo.VirtualMachine
-		if err := proxyVMObj.Properties(ctx, proxyVMObj.Reference(), []string{"config.hardware.device"}, &vmProps); err != nil {
-			utils.PrintLog(fmt.Sprintf("Warning: failed to read proxy VM devices during cleanup: %v", err))
-		} else {
-			for _, t := range transfers {
-				if t.DiskKey == 0 {
-					continue
-				}
-				for _, dev := range vmProps.Config.Hardware.Device {
-					if dev.GetVirtualDevice().Key == t.DiskKey {
-						if err := proxyVMObj.RemoveDevice(ctx, true, dev); err != nil {
-							utils.PrintLog(fmt.Sprintf("Warning: failed to detach disk key %d from proxy VM: %v", t.DiskKey, err))
-						}
-						break
-					}
+// detachProxyDisks removes each transfer's disk from the Proxy VM (keepFiles=true —
+// we must NOT delete the frozen VMDK). Failures are logged without aborting.
+func (migobj *Migrate) detachProxyDisks(ctx context.Context, proxyVMObj *object.VirtualMachine, transfers []hotAddDiskTransfer) {
+	if proxyVMObj == nil {
+		return
+	}
+	var vmProps mo.VirtualMachine
+	if err := proxyVMObj.Properties(ctx, proxyVMObj.Reference(), []string{"config.hardware.device"}, &vmProps); err != nil {
+		utils.PrintLog(fmt.Sprintf("Warning: failed to read proxy VM devices during cleanup: %v", err))
+		return
+	}
+	for _, t := range transfers {
+		if t.DiskKey == 0 {
+			continue
+		}
+		for _, dev := range vmProps.Config.Hardware.Device {
+			if dev.GetVirtualDevice().Key == t.DiskKey {
+				if err := proxyVMObj.RemoveDevice(ctx, true, dev); err != nil {
+					utils.PrintLog(fmt.Sprintf("Warning: failed to detach disk key %d from proxy VM: %v", t.DiskKey, err))
 				}
+				break
 			}
 		}
 	}
+}
+
+// cleanupHotAdd kills NBD daemons, detaches proxy VM disks, and removes the snapshot.
+// Individual failures are logged without aborting the cleanup sequence.
+func (migobj *Migrate) cleanupHotAdd(ctx context.Context, sshClient *esxissh.Client,
+	transfers []hotAddDiskTransfer, proxyVMObj *object.VirtualMachine,
+) {
+	migobj.killNBDDaemons(sshClient, transfers)
+	migobj.detachProxyDisks(ctx, proxyVMObj, transfers)
 
 	// Remove the source VM snapshot.
 	if err := migobj.VMops.DeleteSnapshot(hotAddSnapName); err != nil {
@@ -535,45 +530,26 @@ func (migobj *Migrate) cleanupHotAdd(ctx context.Context, sshClient *esxissh.Cli
 	migobj.adjustProxyDiskCount(context.Background(), -attached)
 }
 
-// HotAddCopyDisks powers off the source VM, snapshots it, attaches frozen disks to
-// the Proxy VM, and transfers data via qemu-nbd+nbdcopy. Cleanup runs on return.
-func (migobj *Migrate) HotAddCopyDisks(ctx context.Context, vminfo vm.VMInfo) error {
-	migobj.logMessage("Starting Hot-Add disk copy")
-
-	if migobj.ProxyVMIP == "" || migobj.ProxyVMName == "" {
-		return errors.New("ProxyVMIP and ProxyVMName must be set for HotAdd copy method")
-	}
+// hotAddPreparedSource bundles the SSH connection, Proxy VM object, and
+// per-disk state that PrepareHotAddSource produces and ReleaseHotAddSource tears down.
+type hotAddPreparedSource struct {
+	sshClient  *esxissh.Client
+	proxyVMObj *object.VirtualMachine
+	transfers  []hotAddDiskTransfer
+}
 
+// PrepareHotAddSource snapshots the source VM, attaches its frozen disks to
+// the Proxy VM, and identifies their block devices. On error it cleans up after
+// itself -- the caller must only call ReleaseHotAddSource on a non-nil result.
+func (migobj *Migrate) PrepareHotAddSource(ctx context.Context, vminfo vm.VMInfo) (prepared *hotAddPreparedSource, err error) {
 	// Load the per-proxy-VM SSH private key from the k8s secret named
 	// "{proxyVMName}-hot-add-ssh-key", created during Proxy VM onboarding.
 	sshKeyBytes, err := k8sutils.GetHotAddPrivateKey(ctx, migobj.K8sClient, migobj.ProxyVMK8sName)
 	if err != nil {
-		return errors.Wrap(err, "failed to get Hot-Add SSH private key")
-	}
-
-	// 1. Power off the source VM — skipped for mock migrations.
-	if migobj.MigrationType == "mock" {
-		migobj.logMessage("Mock migration detected, skipping VM power off")
-	} else {
-		migobj.logMessage("Powering off source VM before Hot-Add snapshot")
-		if err := migobj.VMops.VMPowerOff(); err != nil {
-			return errors.Wrap(err, "failed to power off source VM")
-		}
-		if err := utils.DoRetryWithExponentialBackoff(ctx, func() error {
-			currState, stateErr := migobj.VMops.GetVMObj().PowerState(ctx)
-			if stateErr != nil {
-				return stateErr
-			}
-			if currState != govmomitypes.VirtualMachinePowerStatePoweredOff {
-				return fmt.Errorf("VM power-off command completed but VM is still in state: %s", currState)
-			}
-			return nil
-		}, constants.MaxPowerOffRetryLimit, constants.PowerOffRetryCap); err != nil {
-			return errors.Wrap(err, "failed to verify VM power state after power off")
-		}
+		return nil, errors.Wrap(err, "failed to get Hot-Add SSH private key")
 	}
 
-	// 2. Remove any pre-existing snapshot with the same name, then take a fresh one.
+	// 1. Remove any pre-existing snapshot with the same name, then take a fresh one.
 	// VMops.TakeSnapshot uses quiesce=false which works for both cold (VM already
 	// powered off, quiescing is a no-op) and mock (VM on, crash-consistent is correct).
 	migobj.logMessage(constants.EventMessageHotAddSnapshotCreate)
@@ -582,21 +558,21 @@ func (migobj *Migrate) HotAddCopyDisks(ctx context.Context, vminfo vm.VMInfo) er
 			if snap.Name == hotAddSnapName {
 				migobj.logMessage(fmt.Sprintf("Removing pre-existing snapshot '%s'", hotAddSnapName))
 				if delErr := migobj.VMops.DeleteSnapshot(hotAddSnapName); delErr != nil {
-					return errors.Wrapf(delErr, "failed to remove pre-existing snapshot '%s'", hotAddSnapName)
+					return nil, errors.Wrapf(delErr, "failed to remove pre-existing snapshot '%s'", hotAddSnapName)
 				}
 				break
 			}
 		}
 	}
 	if err := migobj.VMops.TakeSnapshot(hotAddSnapName); err != nil {
-		return errors.Wrap(err, "failed to create source VM snapshot")
+		return nil, errors.Wrap(err, "failed to create source VM snapshot")
 	}
 
-	// 3. Enumerate frozen VMDKs from the snapshot backing.
+	// 2. Enumerate frozen VMDKs from the snapshot backing.
 	transfers, err := migobj.getFrozenVMDKs(ctx, vminfo)
 	if err != nil {
 		_ = migobj.VMops.DeleteSnapshot(hotAddSnapName)
-		return errors.Wrap(err, "failed to enumerate frozen VMDKs")
+		return nil, errors.Wrap(err, "failed to enumerate frozen VMDKs")
 	}
 	for i := range transfers {
 		if i < len(vminfo.VMDisks) {
@@ -604,64 +580,124 @@ func (migobj *Migrate) HotAddCopyDisks(ctx context.Context, vminfo vm.VMInfo) er
 		}
 	}
 
-	// 4. Open SSH connection to Proxy VM.
+	// 3. Open SSH connection to Proxy VM.
 	sshClient := esxissh.NewClientWithTimeout(30 * time.Second)
 	connectCtx, cancelConnect := context.WithTimeout(ctx, 60*time.Second)
 	defer cancelConnect()
 	if err := sshClient.Connect(connectCtx, migobj.ProxyVMIP, hotAddSSHUser, sshKeyBytes); err != nil {
 		_ = migobj.VMops.DeleteSnapshot(hotAddSnapName)
-		return errors.Wrapf(err, "SSH to Proxy VM %s failed", migobj.ProxyVMIP)
+		return nil, errors.Wrapf(err, "SSH to Proxy VM %s failed", migobj.ProxyVMIP)
 	}
-	defer func() {
-		if err := sshClient.Disconnect(); err != nil {
-			utils.PrintLog(fmt.Sprintf("Warning: failed to disconnect SSH client: %v", err))
-		}
-	}()
 
-	// 5. Find the Proxy VM object in vCenter.
+	// 4. Find the Proxy VM object in vCenter.
 	proxyVMObj, err := migobj.Vcclient.GetVMByName(ctx, migobj.ProxyVMName)
 	if err != nil {
 		_ = migobj.VMops.DeleteSnapshot(hotAddSnapName)
-		return errors.Wrapf(err, "failed to locate Proxy VM '%s' in vCenter", migobj.ProxyVMName)
+		if discErr := sshClient.Disconnect(); discErr != nil {
+			utils.PrintLog(fmt.Sprintf("Warning: failed to disconnect SSH client: %v", discErr))
+		}
+		return nil, errors.Wrapf(err, "failed to locate Proxy VM '%s' in vCenter", migobj.ProxyVMName)
 	}
 
-	// Cleanup is deferred here so all resources are released on any return path.
-	// context.Background() ensures govmomi calls succeed even if parent ctx is cancelled.
+	// Any failure from here needs the same cleanup ReleaseHotAddSource runs on success.
 	defer func() {
-		migobj.logMessage(constants.EventMessageHotAddCleanup)
-		migobj.cleanupHotAdd(context.Background(), sshClient, transfers, proxyVMObj)
+		if err != nil {
+			migobj.logMessage(constants.EventMessageHotAddCleanup)
+			migobj.cleanupHotAdd(context.Background(), sshClient, transfers, proxyVMObj)
+			if discErr := sshClient.Disconnect(); discErr != nil {
+				utils.PrintLog(fmt.Sprintf("Warning: failed to disconnect SSH client: %v", discErr))
+			}
+		}
 	}()
 
-	// 6. Attach each frozen disk to the Proxy VM. Serialized across migrations
+	// 5. Attach each frozen disk to the Proxy VM. Serialized across migrations
 	// sharing this Proxy VM via a short-lived lock held by vpwned-sdk — see
 	// attachAllDisks for why.
 	migrationName, err := utils.GetMigrationObjectName()
 	if err != nil {
-		return errors.Wrap(err, "failed to get migration object name")
+		return nil, errors.Wrap(err, "failed to get migration object name")
 	}
 	if err := migobj.attachAllDisks(ctx, migrationName, proxyVMObj, transfers); err != nil {
-		return err
+		return nil, err
 	}
 
 	migobj.adjustProxyDiskCount(ctx, len(transfers))
 
-	// 7. Identify block devices on the Proxy VM by matching NAA WWIDs.
+	// 6. Identify block devices on the Proxy VM by matching NAA WWIDs.
 	migobj.logMessage(constants.EventMessageHotAddIdentify)
 	if err := migobj.identifyBlockDevices(ctx, sshClient, transfers, proxyVMObj); err != nil {
-		return errors.Wrap(err, "failed to identify block devices on Proxy VM")
+		return nil, errors.Wrap(err, "failed to identify block devices on Proxy VM")
 	}
 
-	// 8. Pre-allocate one NBD port per disk before launching goroutines so concurrent
+	// 7. Pre-allocate one NBD port per disk before launching goroutines so concurrent
 	//    workers don't race and pick the same port from /proc/net/tcp.
 	ports, err := migobj.findFreePorts(sshClient, constants.HotAddPortRangeMin, constants.HotAddPortRangeMax, len(transfers))
 	if err != nil {
-		return errors.Wrap(err, "failed to allocate NBD ports")
+		return nil, errors.Wrap(err, "failed to allocate NBD ports")
 	}
 	for i := range transfers {
 		transfers[i].NBDPort = ports[i]
 	}
 
-	// 9. Copy all disks concurrently — each disk gets its own NBD server and nbdcopy.
+	return &hotAddPreparedSource{
+		sshClient:  sshClient,
+		proxyVMObj: proxyVMObj,
+		transfers:  transfers,
+	}, nil
+}
+
+// ReleaseHotAddSource tears down everything a successful PrepareHotAddSource created.
+func (migobj *Migrate) ReleaseHotAddSource(ctx context.Context, prepared *hotAddPreparedSource) {
+	if prepared == nil {
+		return
+	}
+	migobj.logMessage(constants.EventMessageHotAddCleanup)
+	migobj.cleanupHotAdd(ctx, prepared.sshClient, prepared.transfers, prepared.proxyVMObj)
+	if err := prepared.sshClient.Disconnect(); err != nil {
+		utils.PrintLog(fmt.Sprintf("Warning: failed to disconnect SSH client: %v", err))
+	}
+}
+
+// HotAddCopyDisks powers off the source VM, then runs Prepare -> copy -> Release once.
+func (migobj *Migrate) HotAddCopyDisks(ctx context.Context, vminfo vm.VMInfo) error {
+	migobj.logMessage("Starting Hot-Add disk copy")
+
+	if migobj.ProxyVMIP == "" || migobj.ProxyVMName == "" {
+		return errors.New("ProxyVMIP and ProxyVMName must be set for HotAdd copy method")
+	}
+
+	// Power off the source VM — skipped for mock migrations.
+	if migobj.MigrationType == "mock" {
+		migobj.logMessage("Mock migration detected, skipping VM power off")
+	} else {
+		migobj.logMessage("Powering off source VM before Hot-Add snapshot")
+		if err := migobj.VMops.VMPowerOff(); err != nil {
+			return errors.Wrap(err, "failed to power off source VM")
+		}
+		if err := utils.DoRetryWithExponentialBackoff(ctx, func() error {
+			currState, stateErr := migobj.VMops.GetVMObj().PowerState(ctx)
+			if stateErr != nil {
+				return stateErr
+			}
+			if currState != govmomitypes.VirtualMachinePowerStatePoweredOff {
+				return fmt.Errorf("VM power-off command completed but VM is still in state: %s", currState)
+			}
+			return nil
+		}, constants.MaxPowerOffRetryLimit, constants.PowerOffRetryCap); err != nil {
+			return errors.Wrap(err, "failed to verify VM power state after power off")
+		}
+	}
+
+	prepared, err := migobj.PrepareHotAddSource(ctx, vminfo)
+	if err != nil {
+		return err
+	}
+	defer migobj.ReleaseHotAddSource(context.Background(), prepared)
+
+	transfers := prepared.transfers
+	sshClient := prepared.sshClient
+
+	// Copy all disks concurrently — each disk gets its own NBD server and nbdcopy.
 	overallStart := time.Now()
 	errCh := make(chan error, len(transfers))
 	var wg sync.WaitGroup
diff --git a/v2v-helper/migrate/hotadd_nbd_provider.go b/v2v-helper/migrate/hotadd_nbd_provider.go
new file mode 100644
index 000000000..c4cb9b95b
--- /dev/null
+++ b/v2v-helper/migrate/hotadd_nbd_provider.go
@@ -0,0 +1,196 @@
+// Copyright © 2025 The vjailbreak authors
+
+package migrate
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/platform9/vjailbreak/pkg/common/constants"
+	esxissh "github.com/platform9/vjailbreak/v2v-helper/esxi-ssh"
+	"github.com/platform9/vjailbreak/v2v-helper/nbd"
+	k8sutils "github.com/platform9/vjailbreak/v2v-helper/pkg/k8sutils"
+	"github.com/platform9/vjailbreak/v2v-helper/pkg/utils"
+	"github.com/vmware/govmomi/object"
+	"github.com/vmware/govmomi/vim25/types"
+)
+
+// hotAddCopyTimeout bounds each vCenter/SSH call StartNBDServer makes.
+const hotAddCopyTimeout = 5 * time.Minute
+
+const (
+	hotAddStartRetries   = 3
+	hotAddStartRetryWait = 10 * time.Second
+)
+
+// hotAddSession is the Proxy VM connection shared by every disk's hotAddNBDServer
+// for one migration. ctx is retained so StartNBDServer/StopNBDServer stay
+// cancellable with the rest of the migration.
+type hotAddSession struct {
+	ctx        context.Context
+	sshClient  *esxissh.Client
+	proxyVMObj *object.VirtualMachine
+}
+
+// NewHotAddSession opens the SSH connection to migobj's Proxy VM and looks up its
+// vCenter object, to be shared across one hotAddNBDServer per disk.
+func (migobj *Migrate) NewHotAddSession(ctx context.Context) (*hotAddSession, error) {
+	sshKeyBytes, err := k8sutils.GetHotAddPrivateKey(ctx, migobj.K8sClient, migobj.ProxyVMK8sName)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to get Hot-Add SSH private key")
+	}
+
+	sshClient := esxissh.NewClientWithTimeout(30 * time.Second)
+	connectCtx, cancel := context.WithTimeout(ctx, 60*time.Second)
+	defer cancel()
+	if err := sshClient.Connect(connectCtx, migobj.ProxyVMIP, hotAddSSHUser, sshKeyBytes); err != nil {
+		return nil, errors.Wrapf(err, "SSH to Proxy VM %s failed", migobj.ProxyVMIP)
+	}
+
+	proxyVMObj, err := migobj.Vcclient.GetVMByName(ctx, migobj.ProxyVMName)
+	if err != nil {
+		_ = sshClient.Disconnect()
+		return nil, errors.Wrapf(err, "failed to locate Proxy VM '%s' in vCenter", migobj.ProxyVMName)
+	}
+
+	return &hotAddSession{ctx: ctx, sshClient: sshClient, proxyVMObj: proxyVMObj}, nil
+}
+
+// Close disconnects the shared SSH client. Safe to call on a nil session.
+func (s *hotAddSession) Close() {
+	if s == nil {
+		return
+	}
+	if err := s.sshClient.Disconnect(); err != nil {
+		utils.PrintLog("Warning: failed to disconnect SSH client: " + err.Error())
+	}
+}
+
+// hotAddNBDServer implements nbd.NBDOperations over the Proxy VM (SSH-attach +
+// qemu-nbd) instead of local VDDK/nbdkit. It embeds nbd.NBDServer to reuse
+// CopyDisk/CopyChangedBlocks/GetProgress unchanged.
+type hotAddNBDServer struct {
+	nbd.NBDServer
+
+	migobj  *Migrate
+	session *hotAddSession
+	diskKey int32
+	nbdPid  int
+}
+
+// NewHotAddNBDServer returns a per-disk nbd.NBDOperations backed by session, which
+// callers create once per migration with NewHotAddSession and share across disks.
+func NewHotAddNBDServer(migobj *Migrate, session *hotAddSession) nbd.NBDOperations {
+	return &hotAddNBDServer{migobj: migobj, session: session}
+}
+
+// StartNBDServer attaches the frozen VMDK at file to the Proxy VM, identifies its
+// block device, and starts qemu-nbd on it, retrying the whole sequence up to
+// hotAddStartRetries times.
+func (h *hotAddNBDServer) StartNBDServer(_ *object.VirtualMachine, _, _, _, _, _, file string, progchan chan string) error {
+	var lastErr error
+	for attempt := 1; attempt <= hotAddStartRetries; attempt++ {
+		if attempt > 1 {
+			utils.PrintLog(fmt.Sprintf("Hot-Add: retrying NBD server start (attempt %d/%d) after: %v", attempt, hotAddStartRetries, lastErr))
+			select {
+			case <-h.session.ctx.Done():
+				return h.session.ctx.Err()
+			case <-time.After(hotAddStartRetryWait):
+			}
+		}
+
+		if err := h.startNBDServerOnce(file, progchan); err != nil {
+			lastErr = err
+			// Reset before retrying so we don't attach the same VMDK twice.
+			teardownCtx, cancel := context.WithTimeout(context.Background(), hotAddCopyTimeout)
+			h.teardown(teardownCtx)
+			cancel()
+			continue
+		}
+		return nil
+	}
+	return errors.Wrapf(lastErr, "failed to start Hot-Add NBD server after %d attempts", hotAddStartRetries)
+}
+
+// startNBDServerOnce is StartNBDServer's single-attempt body.
+func (h *hotAddNBDServer) startNBDServerOnce(file string, progchan chan string) error {
+	ctx, cancel := context.WithTimeout(h.session.ctx, hotAddCopyTimeout)
+	defer cancel()
+
+	migrationName, err := utils.GetMigrationObjectName()
+	if err != nil {
+		return errors.Wrap(err, "failed to get migration object name")
+	}
+
+	transfers := []hotAddDiskTransfer{{SnapshotVMDKPath: file}}
+	if err := h.migobj.attachAllDisks(ctx, migrationName, h.session.proxyVMObj, transfers); err != nil {
+		return err
+	}
+	h.diskKey = transfers[0].DiskKey
+	h.migobj.adjustProxyDiskCount(ctx, 1)
+
+	if err := h.migobj.identifyBlockDevices(ctx, h.session.sshClient, transfers, h.session.proxyVMObj); err != nil {
+		return errors.Wrap(err, "failed to identify block device on Proxy VM")
+	}
+
+	ports, err := h.migobj.findFreePorts(h.session.sshClient, constants.HotAddPortRangeMin, constants.HotAddPortRangeMax, 1)
+	if err != nil {
+		return errors.Wrap(err, "failed to allocate NBD port")
+	}
+
+	pid, err := h.migobj.serveViaNBD(h.session.sshClient, transfers[0].BlockDevice, ports[0])
+	if err != nil {
+		return errors.Wrapf(err, "failed to start qemu-nbd on port %d", ports[0])
+	}
+	h.nbdPid = pid
+
+	h.NBDServer = *nbd.NewTCPSourceServer(h.migobj.ProxyVMIP, ports[0], progchan)
+	return nil
+}
+
+// teardown kills this round's qemu-nbd process and detaches its frozen VMDK.
+// Idempotent -- safe to call repeatedly or with nothing attached.
+func (h *hotAddNBDServer) teardown(ctx context.Context) {
+	hadAttachment := h.diskKey != 0 || h.nbdPid != 0
+	transfers := []hotAddDiskTransfer{{DiskKey: h.diskKey, NBDPid: h.nbdPid}}
+	h.migobj.killNBDDaemons(h.session.sshClient, transfers)
+	h.migobj.detachProxyDisks(ctx, h.session.proxyVMObj, transfers)
+	if hadAttachment {
+		h.migobj.adjustProxyDiskCount(ctx, -1)
+	}
+	h.diskKey = 0
+	h.nbdPid = 0
+}
+
+// StopNBDServer tears down this round's attachment. Uses context.Background(), not
+// h.session.ctx, because cleanup() (migrate.go) calls this after the migration's own
+// ctx is already cancelled -- deriving from it here would fail every SSH command
+// instantly and leave the disk/qemu-nbd stuck on the Proxy VM.
+func (h *hotAddNBDServer) StopNBDServer() error {
+	ctx, cancel := context.WithTimeout(context.Background(), hotAddCopyTimeout)
+	defer cancel()
+	h.teardown(ctx)
+	return nil
+}
+
+func (h *hotAddNBDServer) CopyDisk(ctx context.Context, dest string, diskindex int, destEncrypted bool) error {
+	copyErr := h.NBDServer.CopyDisk(ctx, dest, diskindex, destEncrypted)
+	if copyErr == nil {
+		teardownCtx, cancel := context.WithTimeout(context.Background(), hotAddCopyTimeout)
+		defer cancel()
+		h.teardown(teardownCtx)
+	}
+	return copyErr
+}
+
+func (h *hotAddNBDServer) CopyChangedBlocks(ctx context.Context, changedAreas types.DiskChangeInfo, path string, destEncrypted bool) error {
+	copyErr := h.NBDServer.CopyChangedBlocks(ctx, changedAreas, path, destEncrypted)
+	if copyErr == nil {
+		teardownCtx, cancel := context.WithTimeout(context.Background(), hotAddCopyTimeout)
+		defer cancel()
+		h.teardown(teardownCtx)
+	}
+	return copyErr
+}
diff --git a/v2v-helper/migrate/hotadd_nbd_provider_test.go b/v2v-helper/migrate/hotadd_nbd_provider_test.go
new file mode 100644
index 000000000..b3d362ae1
--- /dev/null
+++ b/v2v-helper/migrate/hotadd_nbd_provider_test.go
@@ -0,0 +1,111 @@
+// Copyright © 2025 The vjailbreak authors
+
+package migrate
+
+import (
+	"context"
+	"net"
+	"testing"
+
+	"github.com/platform9/vjailbreak/v2v-helper/nbd"
+	"github.com/vmware/govmomi/vim25/types"
+)
+
+// unusedTCPPort opens a TCP listener, grabs its port, then closes it --
+// giving tests a port number nothing is listening on so a connection attempt
+// fails fast (connection refused) instead of timing out.
+func unusedTCPPort(t *testing.T) int {
+	t.Helper()
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("failed to reserve a port: %v", err)
+	}
+	port := l.Addr().(*net.TCPAddr).Port
+	if err := l.Close(); err != nil {
+		t.Fatalf("failed to release reserved port: %v", err)
+	}
+	return port
+}
+
+// TestHotAddNBDServer_Teardown_Idempotent covers both states teardown() must
+// handle safely without touching real infra: nothing attached, and something
+// attached. session.proxyVMObj is nil (detachProxyDisks returns immediately)
+// and migobj.K8sClient is nil (adjustProxyDiskCount returns immediately), so
+// this never makes a real vCenter/K8s call -- only the diskKey/nbdPid
+// bookkeeping is under test.
+func TestHotAddNBDServer_Teardown_Idempotent(t *testing.T) {
+	t.Run("nothing attached", func(t *testing.T) {
+		h := &hotAddNBDServer{
+			migobj:  &Migrate{},
+			session: &hotAddSession{},
+		}
+		h.teardown(context.Background())
+		h.teardown(context.Background()) // must not panic or double-decrement
+		if h.diskKey != 0 || h.nbdPid != 0 {
+			t.Errorf("got diskKey=%d nbdPid=%d, want both 0", h.diskKey, h.nbdPid)
+		}
+	})
+
+	t.Run("disk attached, nbd not yet serving", func(t *testing.T) {
+		h := &hotAddNBDServer{
+			migobj:  &Migrate{},
+			session: &hotAddSession{},
+			diskKey: 4242,
+		}
+		h.teardown(context.Background())
+		if h.diskKey != 0 || h.nbdPid != 0 {
+			t.Errorf("got diskKey=%d nbdPid=%d, want both reset to 0", h.diskKey, h.nbdPid)
+		}
+		// Second call on the now-clean state must still be a no-op.
+		h.teardown(context.Background())
+		if h.diskKey != 0 || h.nbdPid != 0 {
+			t.Errorf("second teardown() changed state: diskKey=%d nbdPid=%d", h.diskKey, h.nbdPid)
+		}
+	})
+}
+
+// TestHotAddNBDServer_CopyDisk_SkipsTeardownOnFailure guards the Finding-2
+// regression: CopyDisk must NOT tear down the Proxy VM attachment when the
+// copy itself fails, because nbd_copy.go's callers may still need the
+// attachment/qemu-nbd for the current round. diskKey/nbdPid are left
+// unchanged by a skipped teardown, so they're the observable signal here.
+// nbdPid is deliberately left at 0 so that if this regresses and teardown
+// runs anyway, killNBDDaemons/detachProxyDisks still no-op safely (nil
+// session.sshClient / session.proxyVMObj) instead of panicking.
+func TestHotAddNBDServer_CopyDisk_SkipsTeardownOnFailure(t *testing.T) {
+	h := &hotAddNBDServer{
+		migobj:  &Migrate{},
+		session: &hotAddSession{},
+		diskKey: 4242,
+	}
+	// Nothing is listening on this port, so nbdcopy/libnbd fails fast.
+	h.NBDServer = *nbd.NewTCPSourceServer("127.0.0.1", unusedTCPPort(t), nil)
+
+	err := h.CopyDisk(context.Background(), t.TempDir()+"/dest", 0, false)
+	if err == nil {
+		t.Fatal("expected CopyDisk against an unreachable source to fail")
+	}
+	if h.diskKey != 4242 {
+		t.Errorf("teardown ran despite copy failure: diskKey=%d, want unchanged 4242", h.diskKey)
+	}
+}
+
+// TestHotAddNBDServer_CopyChangedBlocks_SkipsTeardownOnFailure mirrors
+// TestHotAddNBDServer_CopyDisk_SkipsTeardownOnFailure for the incremental-sync
+// path, which is the one nbd_copy.go actually wraps in a retry loop.
+func TestHotAddNBDServer_CopyChangedBlocks_SkipsTeardownOnFailure(t *testing.T) {
+	h := &hotAddNBDServer{
+		migobj:  &Migrate{},
+		session: &hotAddSession{},
+		diskKey: 4242,
+	}
+	h.NBDServer = *nbd.NewTCPSourceServer("127.0.0.1", unusedTCPPort(t), nil)
+
+	err := h.CopyChangedBlocks(context.Background(), types.DiskChangeInfo{}, t.TempDir()+"/dest", false)
+	if err == nil {
+		t.Fatal("expected CopyChangedBlocks against an unreachable source to fail")
+	}
+	if h.diskKey != 4242 {
+		t.Errorf("teardown ran despite copy failure: diskKey=%d, want unchanged 4242", h.diskKey)
+	}
+}
diff --git a/v2v-helper/migrate/migrate.go b/v2v-helper/migrate/migrate.go
index 47c75b340..575619409 100644
--- a/v2v-helper/migrate/migrate.go
+++ b/v2v-helper/migrate/migrate.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/pkg/errors"
 	"github.com/platform9/vjailbreak/pkg/common/constants"
+	"github.com/platform9/vjailbreak/pkg/vpwned/sdk/storage"
 	"github.com/platform9/vjailbreak/v2v-helper/nbd"
 	"github.com/platform9/vjailbreak/v2v-helper/openstack"
 	"github.com/platform9/vjailbreak/v2v-helper/pkg/k8sutils"
@@ -20,7 +21,6 @@ import (
 	"github.com/platform9/vjailbreak/v2v-helper/reporter"
 	"github.com/platform9/vjailbreak/v2v-helper/vcenter"
 	"github.com/platform9/vjailbreak/v2v-helper/vm"
-	"github.com/platform9/vjailbreak/pkg/vpwned/sdk/storage"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
@@ -196,6 +196,10 @@ func (migobj *Migrate) CheckCutoverOptions() (bool, string) {
 	return false, ""
 }
 
+// gracefulCleanupTimeout bounds the OpenStack/Neutron calls cleanup makes after a
+// SIGTERM/SIGINT, once they're on their own fresh context (see gracefulTerminate).
+const gracefulCleanupTimeout = 5 * time.Minute
+
 func (migobj *Migrate) gracefulTerminate(ctx context.Context, vminfo vm.VMInfo, cancel context.CancelFunc) {
 	gracefulShutdown := make(chan os.Signal, 1)
 	// Handle SIGTERM
@@ -203,7 +207,9 @@ func (migobj *Migrate) gracefulTerminate(ctx context.Context, vminfo vm.VMInfo,
 	<-gracefulShutdown
 	migobj.logMessage("Gracefully terminating")
 	cancel()
-	migobj.cleanup(ctx, vminfo, "Migration terminated", nil, nil)
+	cleanupCtx, cleanupCancel := context.WithTimeout(context.Background(), gracefulCleanupTimeout)
+	migobj.cleanup(cleanupCtx, vminfo, "Migration terminated", nil, nil)
+	cleanupCancel()
 	os.Exit(0)
 }
 
@@ -294,21 +300,56 @@ func (migobj *Migrate) MigrateVM(ctx context.Context) error {
 			}
 			return errors.Wrap(err, "failed to create volumes for HotAdd migration")
 		}
-		for idx, vmdisk := range vminfo.VMDisks {
-			path, err := migobj.AttachVolume(ctx, vmdisk)
+
+		if migobj.MigrationType == "cold" {
+			// Cold never needs incremental sync, so it keeps the original one-shot
+			// power-off-then-copy path: attach destination volumes up front, then
+			// HotAddCopyDisks does a single pass with no CBT involved.
+			for idx, vmdisk := range vminfo.VMDisks {
+				path, err := migobj.AttachVolume(ctx, vmdisk)
+				if err != nil {
+					if cleanuperror := migobj.cleanup(ctx, vminfo, fmt.Sprintf("failed to attach volume for HotAdd migration: %s", err), portids, vcenterSettings); cleanuperror != nil {
+						return errors.Wrapf(err, "failed to cleanup after HotAdd attach failure: %s", cleanuperror)
+					}
+					return errors.Wrap(err, "failed to attach volume for HotAdd migration")
+				}
+				vminfo.VMDisks[idx].Path = path
+			}
+			if err := migobj.HotAddCopyDisks(ctx, vminfo); err != nil {
+				if cleanuperror := migobj.cleanup(ctx, vminfo, fmt.Sprintf("failed to perform HotAdd disk copy: %s", err), portids, vcenterSettings); cleanuperror != nil {
+					return errors.Wrapf(err, "failed to cleanup after HotAdd disk copy failure: %s", cleanuperror)
+				}
+				return errors.Wrap(err, "failed to perform HotAdd disk copy")
+			}
+		} else {
+			// Hot/mock: share the same live-replicate loop normal-hot uses, backed by
+			// hotAddNBDServer instead of VDDK -- destination volumes are attached by
+			// LiveReplicateDisks itself, same as the normal-hot branch below.
+			if err := migobj.EnableCBTWrapper(); err != nil {
+				migobj.cleanup(ctx, vminfo, fmt.Sprintf("CBT Failure: %s", err), portids, vcenterSettings)
+				return errors.Wrap(err, "CBT Failure")
+			}
+
+			session, err := migobj.NewHotAddSession(ctx)
 			if err != nil {
-				if cleanuperror := migobj.cleanup(ctx, vminfo, fmt.Sprintf("failed to attach volume for HotAdd migration: %s", err), portids, vcenterSettings); cleanuperror != nil {
-					return errors.Wrapf(err, "failed to cleanup after HotAdd attach failure: %s", cleanuperror)
+				if cleanuperror := migobj.cleanup(ctx, vminfo, fmt.Sprintf("failed to open Hot-Add Proxy VM session: %s", err), portids, vcenterSettings); cleanuperror != nil {
+					return errors.Wrapf(err, "failed to cleanup after Hot-Add session failure: %s", cleanuperror)
 				}
-				return errors.Wrap(err, "failed to attach volume for HotAdd migration")
+				return errors.Wrap(err, "failed to open Hot-Add Proxy VM session")
 			}
-			vminfo.VMDisks[idx].Path = path
-		}
-		if err := migobj.HotAddCopyDisks(ctx, vminfo); err != nil {
-			if cleanuperror := migobj.cleanup(ctx, vminfo, fmt.Sprintf("failed to perform HotAdd disk copy: %s", err), portids, vcenterSettings); cleanuperror != nil {
-				return errors.Wrapf(err, "failed to cleanup after HotAdd disk copy failure: %s", cleanuperror)
+			defer session.Close()
+
+			for range vminfo.VMDisks {
+				migobj.Nbdops = append(migobj.Nbdops, NewHotAddNBDServer(migobj, session))
+			}
+
+			vminfo, err = migobj.LiveReplicateDisks(ctx, vminfo)
+			if err != nil {
+				if cleanuperror := migobj.cleanup(ctx, vminfo, fmt.Sprintf("failed to live replicate disks: %s", err), portids, vcenterSettings); cleanuperror != nil {
+					return errors.Wrapf(err, "failed to cleanup disks: %s", cleanuperror)
+				}
+				return errors.Wrap(err, "failed to live replicate disks")
 			}
-			return errors.Wrap(err, "failed to perform HotAdd disk copy")
 		}
 
 	} else {
@@ -694,6 +735,20 @@ func (migobj *Migrate) detachProbeFromServer(ctx context.Context, serverID, prob
 
 func (migobj *Migrate) cleanup(ctx context.Context, vminfo vm.VMInfo, message string, portids []string, vcenterSettings *k8sutils.VjailbreakSettings) error {
 	migobj.logMessage(fmt.Sprintf("%s. Trying to perform cleanup", message))
+
+	// Stop whatever each disk's NBD provider still has open -- for Hot-Add this is
+	// what kills qemu-nbd and detaches the frozen VMDK from the Proxy VM, so a
+	// mid-flight termination doesn't leave those behind. No-op for cold Hot-Add
+	// (Nbdops is never populated there) and for normal/VDDK when nothing was started.
+	for idx, nbdop := range migobj.Nbdops {
+		if nbdop == nil {
+			continue
+		}
+		if err := nbdop.StopNBDServer(); err != nil {
+			utils.PrintLog(fmt.Sprintf("Warning: failed to stop NBD server for disk %d during cleanup: %v", idx, err))
+		}
+	}
+
 	err := migobj.DetachAllVolumesWithCleanup(ctx, vminfo)
 	if err != nil {
 		utils.PrintLog(fmt.Sprintf("Failed to detach all volumes from VM: %s\n", err))
diff --git a/v2v-helper/nbd/nbdops.go b/v2v-helper/nbd/nbdops.go
index f7d2acd4d..21cfdb58f 100644
--- a/v2v-helper/nbd/nbdops.go
+++ b/v2v-helper/nbd/nbdops.go
@@ -28,6 +28,8 @@ import (
 
 //go:generate mockgen -source=../nbd/nbdops.go -destination=../nbd/nbdops_mock.go -package=nbd
 
+// NBDOperations is the per-disk sync provider seam shared by normal-hot (VDDK) and
+// hot-add flows; server/username/password/thumbprint are VDDK-specific and unused by hot-add.
 type NBDOperations interface {
 	StartNBDServer(vm *object.VirtualMachine, server, username, password, thumbprint, snapref, file string, progchan chan string) error
 	StopNBDServer() error
@@ -39,6 +41,7 @@ type NBDOperations interface {
 type NBDServer struct {
 	cmd          *exec.Cmd
 	tmp_dir      string
+	sourceURL    string
 	progresschan chan string
 	TotalSize    int64
 	StartTime    time.Time
@@ -273,11 +276,17 @@ vixDiskLib.nfcAio.Session.BufCount=4`
 	}
 	nbdserver.cmd = cmd
 	nbdserver.tmp_dir = tmp_dir
+	nbdserver.sourceURL = generateSockUrl(tmp_dir)
 	nbdserver.progresschan = progchan
 	return nil
 }
 
 func (nbdserver *NBDServer) StopNBDServer() error {
+	// Nil-safe: a mid-migration termination may call this on a disk whose
+	// StartNBDServer never ran, leaving cmd at its zero value. Nothing to kill.
+	if nbdserver.cmd == nil || nbdserver.cmd.Process == nil {
+		return nil
+	}
 	err := nbdserver.cmd.Process.Kill()
 	if err != nil {
 		return fmt.Errorf("failed to kill nbdkit: %v", err)
@@ -286,20 +295,6 @@ func (nbdserver *NBDServer) StopNBDServer() error {
 	return nil
 }
 
-// buildNbdcopyArgs constructs the argument list for the nbdcopy invocation
-// used by CopyDisk. It is a pure function (no exec, no I/O) specifically so
-// the --target-is-zero decision can be unit tested without shelling out.
-//
-// --target-is-zero tells nbdcopy to trust that the destination already reads
-// as all-zero, so it can skip writing any source region that is itself
-// zero/sparse. That assumption holds for a plain, freshly created Cinder
-// volume, but not for an encrypted one: encryption is applied transparently
-// at the QEMU layer, so a region that was never actually written through the
-// encryption engine does not decrypt back to zero on readback - it decrypts
-// to pseudo-random, key-derived noise. Skipping those regions produces a
-// disk that looks corrupted (missing partition table, unbootable) even
-// though the copy reported success. For encrypted destinations we must fall
-// back to a full, dense copy - slower, but correct.
 func buildNbdcopyArgs(sockUrl, dest string, destEncrypted bool) []string {
 	args := []string{"--progress=3"}
 	if !destEncrypted {
@@ -324,7 +319,7 @@ func (nbdserver *NBDServer) CopyDisk(ctx context.Context, dest string, diskindex
 			"Disk %d destination volume is encrypted; disabling nbdcopy --target-is-zero and doing a full dense copy", diskindex))
 	}
 
-	args := buildNbdcopyArgs(generateSockUrl(nbdserver.tmp_dir), dest, destEncrypted)
+	args := buildNbdcopyArgs(nbdserver.sourceURL, dest, destEncrypted)
 	cmd := exec.CommandContext(ctx, "nbdcopy", args...)
 	cmd.ExtraFiles = []*os.File{progressWrite}
 
@@ -681,7 +676,7 @@ func (nbdserver *NBDServer) CopyChangedBlocks(ctx context.Context, changedAreas
 	coalesced := coalesceExtents(changedAreas.ChangedArea, int64(ExtentCoalesceGap))
 
 	// Build the handle pool that all workers will share.
-	pool, err := newHandlePool(HandlePoolSize, generateSockUrl(nbdserver.tmp_dir))
+	pool, err := newHandlePool(HandlePoolSize, nbdserver.sourceURL)
 	if err != nil {
 		return fmt.Errorf("failed to build handle pool: %v", err)
 	}
@@ -878,3 +873,18 @@ func (nbdserver *NBDServer) CopyChangedBlocks(ctx context.Context, changedAreas
 func generateSockUrl(tmp_dir string) string {
 	return fmt.Sprintf("nbd+unix:///?socket=%s/nbdkit.sock", tmp_dir)
 }
+
+func generateHotAddNBDUrl(host string, port int) string {
+	return fmt.Sprintf("nbd://%s:%d", host, port)
+}
+
+// NewTCPSourceServer returns an NBDServer pointed at a remote qemu-nbd endpoint
+// (Hot-Add's Proxy VM) instead of a local nbdkit socket. Only CopyDisk/
+// CopyChangedBlocks/GetProgress are meant to be used on the result -- starting and
+// stopping the remote qemu-nbd process is the caller's responsibility.
+func NewTCPSourceServer(host string, port int, progchan chan string) *NBDServer {
+	return &NBDServer{
+		sourceURL:    generateHotAddNBDUrl(host, port),
+		progresschan: progchan,
+	}
+}
diff --git a/v2v-helper/nbd/nbdops_test.go b/v2v-helper/nbd/nbdops_test.go
index bd9573f5d..f2e1992ad 100644
--- a/v2v-helper/nbd/nbdops_test.go
+++ b/v2v-helper/nbd/nbdops_test.go
@@ -248,3 +248,52 @@ func TestCopyDiskProgressDrain(t *testing.T) {
 
 	assert.Equal(t, lines, got)
 }
+
+// TestGenerateHotAddNBDUrl verifies the nbd:// URL format Hot-Add points
+// NewTCPSourceServer at -- it must match what qemu-nbd on the Proxy VM binds
+// to (host:port, TCP, no path).
+func TestGenerateHotAddNBDUrl(t *testing.T) {
+	tests := []struct {
+		name string
+		host string
+		port int
+		want string
+	}{
+		{"ipv4 host", "10.0.0.5", 10809, "nbd://10.0.0.5:10809"},
+		{"hostname", "proxy-vm.local", 12345, "nbd://proxy-vm.local:12345"},
+		{"low port", "127.0.0.1", 1, "nbd://127.0.0.1:1"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, generateHotAddNBDUrl(tt.host, tt.port))
+		})
+	}
+}
+
+// TestNewTCPSourceServer verifies NewTCPSourceServer wires the qemu-nbd
+// endpoint into sourceURL (which CopyDisk/CopyChangedBlocks/newHandlePool all
+// read from) and threads through the progress channel unchanged.
+func TestNewTCPSourceServer(t *testing.T) {
+	progchan := make(chan string, 1)
+	server := NewTCPSourceServer("192.168.1.10", 10809, progchan)
+
+	require.NotNil(t, server)
+	assert.Equal(t, "nbd://192.168.1.10:10809", server.sourceURL)
+	assert.Same(t, progchan, server.progresschan)
+	// A fresh source-server wrapper has never started a local process --
+	// StopNBDServer must be a safe no-op on it (see TestNBDServer_StopNBDServer_NilCmd).
+	assert.Nil(t, server.cmd)
+}
+
+// TestNBDServer_StopNBDServer_NilCmd is a regression test for the nil-safety
+// fix in StopNBDServer: a disk whose StartNBDServer never ran (cmd is still
+// the zero value from &NBDServer{}) must not panic when cleanup() calls
+// StopNBDServer on every migobj.Nbdops entry during a mid-migration
+// termination.
+func TestNBDServer_StopNBDServer_NilCmd(t *testing.T) {
+	server := &NBDServer{}
+	assert.NotPanics(t, func() {
+		err := server.StopNBDServer()
+		assert.NoError(t, err)
+	})
+}