diff --git a/payload/user/remote_access/pager-webui/server.py b/payload/user/remote_access/pager-webui/server.py
index ecc0814..3cd12b4 100644
--- a/payload/user/remote_access/pager-webui/server.py
+++ b/payload/user/remote_access/pager-webui/server.py
@@ -3009,23 +3009,40 @@ def _deploy_enterprise(fields):
                 'ctrl_interface=%s\n' % (ENT_IFACE, ssid, int(ch), ENT_EAP_USERS, ENT_CTRL_DIR))
     except OSError as exc:
         raise RuntimeError('could not write enterprise config: %s' % exc)
-    # Tell the karma build which iface is the management (enterprise) AP.
+    # Tell the karma build which iface is the management (enterprise) AP and
+    # make karma respond to any SSID (deny mode = allow by default).
     device_run(['uci', 'set', 'pineapd.@hostapd[0].mgmtiface=%s' % ENT_IFACE])
+    device_run(['uci', 'set', 'pineapd.@ssid_filter[0].mode=deny'])
+    device_run(['uci', 'set', 'pineapd.@mac_filter[0].mode=deny'])
     device_run(['uci', 'commit', 'pineapd'])
     _pause_hop()
-    rc, out, err = device_run(['/usr/sbin/hostapd', '-B', '-P', ENT_PIDFILE, ENT_CONF],
-                              timeout=20)
-    verified = _ent_running()
-    if not verified:
-        _disable_enterprise_ap()
-        raise RuntimeError('hostapd failed to start for enterprise AP: %s' % (err or out)[-300:])
-    deadline = time.time() + 20
-    while time.time() < deadline:
-        rc, out = _ent_ctrl('status')
-        if 'state=ENABLED' in out:
+    # The daemon's wireless reconciliation races standalone iface creation;
+    # retry through a few quiet windows before giving up.
+    verified = False
+    last_err = ''
+    for attempt in range(3):
+        rc, out, err = device_run(['/usr/sbin/hostapd', '-B', '-P', ENT_PIDFILE, ENT_CONF],
+                                  timeout=25)
+        deadline = time.time() + 12
+        while time.time() < deadline:
+            rc2, out2 = _ent_ctrl('status')
+            if 'state=ENABLED' in (out2 or ''):
+                verified = True
+                break
+            time.sleep(2)
+        if verified:
             break
-        time.sleep(2)
-    verified = 'state=ENABLED' in (_ent_ctrl('status')[1] or '')
+        last_err = (err or out or '')[-500:]
+        _disable_enterprise_ap()
+        if attempt < 2:
+            time.sleep(5)
+            rc, out, err = device_run(['iw', 'phy', 'phy1', 'interface', 'add',
+                                       ENT_IFACE, 'type', 'managed'], timeout=15)
+            if rc == 0:
+                device_run(['iw', 'dev', ENT_IFACE, 'set', 'type', 'ap'])
+                device_run(['ip', 'link', 'set', ENT_IFACE, 'up'])
+    if not verified:
+        raise RuntimeError('hostapd failed to start for enterprise AP: %s' % last_err)
     _ent_ctrl('pineap_enable')
     _ent_ctrl('pineape_enable')
     _ent_ctrl('pineape_auth_enable')