diff --git a/map-controller/files/etc/config/mapcontroller b/map-controller/files/etc/config/mapcontroller
index 56e54e68a..3030bc837 100644
--- a/map-controller/files/etc/config/mapcontroller
+++ b/map-controller/files/etc/config/mapcontroller
@@ -33,27 +33,27 @@ config sta_steering
 
 config ap
 	option band '2'
-	option ssid '$DEVICE_MANUFACTURER-$BASEMAC_ADDR'
-	option encryption 'sae-mixed'
-	option key '$WIFI_FH_KEY'
+	option ssid '$WIFI_FH_2G_SSID'
+	option encryption '$WIFI_FH_2G_ENCRYPTION'
+	option key '$WIFI_FH_2G_KEY'
 	option vid '1'
 	option type 'fronthaul'
 	option mld_id '1'
 
 config ap
 	option band '5'
-	option ssid '$DEVICE_MANUFACTURER-$BASEMAC_ADDR'
-	option encryption 'sae-mixed'
-	option key '$WIFI_FH_KEY'
+	option ssid '$WIFI_FH_5G_SSID'
+	option encryption '$WIFI_FH_5G_ENCRYPTION'
+	option key '$WIFI_FH_5G_KEY'
 	option vid '1'
 	option type 'fronthaul'
 	option mld_id '1'
 
 config ap
 	option band '6'
-	option ssid '$DEVICE_MANUFACTURER-$BASEMAC_ADDR'
-	option encryption 'sae'
-	option key '$WIFI_FH_KEY'
+	option ssid '$WIFI_FH_6G_SSID'
+	option encryption '$WIFI_FH_6G_ENCRYPTION'
+	option key '$WIFI_FH_6G_KEY'
 	option vid '1'
 	option type 'fronthaul'
 	option mld_id '1'
@@ -87,8 +87,8 @@ config ap
 
 config mld
 	option id '1'
-	option ssid '$DEVICE_MANUFACTURER-$BASEMAC_ADDR'
-	option key '$WIFI_FH_KEY'
+	option ssid '$WIFI_FH_ALL_SSID'
+	option key '$WIFI_FH_ALL_KEY'
 #	option vid '1'
 	option type 'fronthaul'
 
diff --git a/map-controller/files/etc/uci-defaults/99-mapcntlr b/map-controller/files/etc/uci-defaults/99-mapcntlr
index c1020a082..e7ce96cc9 100644
--- a/map-controller/files/etc/uci-defaults/99-mapcntlr
+++ b/map-controller/files/etc/uci-defaults/99-mapcntlr
@@ -1,5 +1,7 @@
 #!/bin/sh
+. /usr/share/libubox/jshn.sh
 
+CFG=/etc/board.json
 . /etc/device_info
 
 WIFI_BH_KEY=$(openssl rand -rand /dev/urandom -hex 64 2>/dev/null | openssl dgst -hex -sha256 | cut -d " " -f 2)
@@ -8,11 +10,82 @@ WIFI_BH_KEY=${WIFI_BH_KEY::-1}
 BASEMAC_ADDR="$(fw_printenv -n ethaddr | tr -d ':' | tr 'a-z' 'A-Z')"
 [ ${#BASEMAC_ADDR} -eq 12 ] || BASEMAC_ADDR="$(db -q get device.deviceinfo.BaseMACAddress | tr -d ':')"
 
-WIFI_FH_KEY="$(db get hw.board.wpa_key)"
-WIFI_FH_KEY="${WIFI_FH_KEY:-1234567890}"
+FALLBACK_SSID="$DEVICE_MANUFACTURER-$BASEMAC_ADDR"
+FALLBACK_KEY="1234567890"
+FALLBACK_2G_ENCRYPTION="sae-mixed"
+FALLBACK_5G_ENCRYPTION="sae-mixed"
+FALLBACK_6G_ENCRYPTION="sae"
+FALLBACK_ALL_ENCRYPTION="sae-mixed"
+
+set_per_band_callback() {
+	local band="$2"
+	json_select "$band"
+	local ssid encryption key
+	json_get_vars ssid encryption key
+	case "$band" in
+	all|2g|5g|6g)
+		local band_upper="$(printf "%s" "$band" | tr 'a-z' 'A-Z')"
+		eval "export -- WIFI_FH_${band_upper}_SSID='$ssid'"
+		eval "export -- WIFI_FH_${band_upper}_ENCRYPTION='$encryption'"
+		eval "export -- WIFI_FH_${band_upper}_KEY='$key'"
+		;;
+	esac
+	json_select ..
+}
+
+set_vars_from_board_json() {
+	json_init
+	json_load_file "$CFG"
+	json_select wlan
+	json_select defaults
+	json_for_each_item set_per_band_callback ssids
+	json_cleanup
+}
+
+set_in_priority() {
+	local destination="$1"
+	for alternative in $2 $3 $4 $5 $6 $7 $8 $9; do
+		eval "value=\${${alternative}}"
+		if [ -n "$value" ]; then
+			echo "Setting $destination to '$value' from \$$alternative"
+			eval "export -- ${destination}='$value'"
+			break
+		fi
+	done
+}
+
+set_missing_vars_from_fallback() {
+	for band in ALL 2G 5G 6G; do
+		for what in SSID KEY; do
+			set_in_priority \
+				WIFI_FH_${band}_${what} \
+				WIFI_FH_${band}_${what} \
+				WIFI_FH_ALL_${what} \
+				FALLBACK_${what}
+		done
+		# Per band fallback variables for encryption because SAE is mandatory on 6 GHz
+		set_in_priority \
+			WIFI_FH_${band}_ENCRYPTION \
+			WIFI_FH_${band}_ENCRYPTION \
+			FALLBACK_${band}_ENCRYPTION
+	done
+}
+
+set_vars_from_board_json
+set_missing_vars_from_fallback
 
 sed -i  -e "s/\$BASEMAC_ADDR/$BASEMAC_ADDR/g" \
-	-e "s/\$WIFI_FH_KEY/$WIFI_FH_KEY/g" \
+	-e "s/\$WIFI_FH_2G_KEY/$WIFI_FH_2G_KEY/g" \
+	-e "s/\$WIFI_FH_5G_KEY/$WIFI_FH_5G_KEY/g" \
+	-e "s/\$WIFI_FH_6G_KEY/$WIFI_FH_6G_KEY/g" \
+	-e "s/\$WIFI_FH_ALL_KEY/$WIFI_FH_ALL_KEY/g" \
+	-e "s/\$WIFI_FH_2G_SSID/$WIFI_FH_2G_SSID/g" \
+	-e "s/\$WIFI_FH_5G_SSID/$WIFI_FH_5G_SSID/g" \
+	-e "s/\$WIFI_FH_6G_SSID/$WIFI_FH_6G_SSID/g" \
+	-e "s/\$WIFI_FH_ALL_SSID/$WIFI_FH_ALL_SSID/g" \
+	-e "s/\$WIFI_FH_2G_ENCRYPTION/$WIFI_FH_2G_ENCRYPTION/g" \
+	-e "s/\$WIFI_FH_5G_ENCRYPTION/$WIFI_FH_5G_ENCRYPTION/g" \
+	-e "s/\$WIFI_FH_6G_ENCRYPTION/$WIFI_FH_6G_ENCRYPTION/g" \
+	-e "s/\$WIFI_FH_ALL_ENCRYPTION/$WIFI_FH_ALL_ENCRYPTION/g" \
 	-e "s/\$WIFI_BH_KEY/$WIFI_BH_KEY/g" \
-	-e "s/\$DEVICE_MANUFACTURER/$DEVICE_MANUFACTURER/g" \
 	/etc/config/mapcontroller	2>/dev/null