diff --git a/nix/os/devices/router0-dmz0/configuration.nix b/nix/os/devices/router0-dmz0/configuration.nix
index 0691c01..a84a298 100644
--- a/nix/os/devices/router0-dmz0/configuration.nix
+++ b/nix/os/devices/router0-dmz0/configuration.nix
@@ -916,16 +916,6 @@ in {
           # This option can be used to exclude all DFS channels from the ACS channel list
           # in cases where the driver supports DFS channels.
           acs_exclude_dfs = 0;
-
-          # Disassociate stations based on excessive transmission failures or other
-          # indications of connection loss. This depends on the driver capabilities and
-          # may not be available with all drivers.
-          disassoc_low_ack = 0;
-
-          skip_inactivity_poll = 1;
-
-          # TODO: check if this is required. multicast can be more efficient so it'd be nice to disable this.
-          multicast_to_unicast = 1;
         };
 
         # use 'iw phy#1 info' to determine your VHT capabilities
@@ -942,9 +932,11 @@ in {
             "RX-STBC1"
             "MAX-AMSDU-7935"
 
+            "40-INTOLERANT"
+
+            # not supported by BPI-R3 module
             # "DELAYED-BA"
             # "DSSS_CCK-40"
-            "40-INTOLERANT"
           ];
         };
 
@@ -1052,8 +1044,29 @@ in {
               # [ENABLE-TLSv1.3] = enable TLSv1.3 (experimental - disabled by default)
               tls_flags = "[ENABLE-TLSv1.3]";
 
+              # TODO: debugging for wifi drops happens below here
+              # Require IEEE 802.1X authorization
               ieee8021x = 0;
+
+              # Optionally, hostapd can be configured to use an integrated EAP server
+              # to process EAP authentication locally without need for an external RADIUS
+              # server. This functionality can be used both as a local authentication server
+              # for IEEE 802.1X/EAPOL and as a RADIUS server for other devices.
+
+              # Use integrated EAP server instead of external RADIUS authentication
+              # server. This is also needed if hostapd is configured to act as a RADIUS
+              # authentication server.
               eap_server = 0;
+
+              # Disassociate stations based on excessive transmission failures or other
+              # indications of connection loss. This depends on the driver capabilities and
+              # may not be available with all drivers.
+              disassoc_low_ack = 0;
+
+              skip_inactivity_poll = 1;
+
+              # TODO: check if this is required. multicast can be more efficient so it'd be nice to disable this.
+              multicast_to_unicast = 0;
             };
           };
         };
diff --git a/nix/os/devices/router0-dmz0/flake.lock b/nix/os/devices/router0-dmz0/flake.lock
index 769e9a9..d155575 100644
--- a/nix/os/devices/router0-dmz0/flake.lock
+++ b/nix/os/devices/router0-dmz0/flake.lock
@@ -121,11 +121,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723112495,
-        "narHash": "sha256-1nt+81yKDAWsHt2v8yYHceZ9mmIon2RcJC3lP1NIQJQ=",
+        "lastModified": 1723893138,
+        "narHash": "sha256-TCGUFSBIaItvaFa+ydPII+Ayrn3OHfV1220RLgtWh5s=",
         "owner": "steveej-forks",
         "repo": "nakato_nixos-sbc",
-        "rev": "f0c85455056dcbfdf8a8cc985db490e7bfb75f36",
+        "rev": "5fb94671a47229e269383e736cb1764c94803ebb",
         "type": "github"
       },
       "original": {