diff --git a/picopy/config.py b/picopy/config.py
index 4d1e115..0fddad5 100644
--- a/picopy/config.py
+++ b/picopy/config.py
@@ -53,7 +53,7 @@ DEFAULT_CONFIG = {
     'verify_checksum': False, 'delete_source': False,
     # WiFi
     'wifi_ssid': '', 'wifi_password': '',
-    'ap_ssid': 'PiCopy', 'ap_password': 'PiCopy,',
+    'ap_ssid': 'PiCopy', 'ap_password': 'PiCopy123',
     # WireGuard
     'wireguard_auto': False,
 }
@@ -70,6 +70,9 @@ def load_cfg():
         except Exception: pass
     except Exception as e:
         log.warning(f'config.json nicht lesbar: {e}')
+    # Migration: altes 7-Zeichen-Standardpasswort auf gültiges WPA2-Passwort anheben
+    if cfg.get('ap_password') == 'PiCopy,':
+        cfg['ap_password'] = 'PiCopy123'
     return cfg
 
 
diff --git a/picopy/wifi.py b/picopy/wifi.py
index 1dc880e..5b062a4 100644
--- a/picopy/wifi.py
+++ b/picopy/wifi.py
@@ -57,6 +57,9 @@ def is_ap_active():
 
 
 def start_ap(ssid, password):
+    if len(password) < 8:
+        log.error(f'AP-Passwort zu kurz ({len(password)} Zeichen, min. 8 für WPA2)')
+        return False
     log.info(f'Starte AP: {ssid}')
     nm('con', 'delete', NM_AP_CON)
     time.sleep(1)
@@ -80,13 +83,18 @@ def stop_ap():
 
 def connect_client_wifi(ssid, password):
     log.info(f'Verbinde mit WiFi: {ssid}')
-    # Bestehende PiCopy-WiFi Verbindung löschen
     nm('con', 'delete', NM_CLIENT_CON)
     time.sleep(1)
-    r = nm('dev', 'wifi', 'connect', ssid,
-           'password', password,
-           'name', NM_CLIENT_CON,
-           'ifname', 'wlan0')
+    try:
+        # --wait 15: nmcli gibt nach 15 s auf; subprocess-Timeout als Sicherheitsnetz
+        r = subprocess.run(
+            ['nmcli', '--wait', '15', 'dev', 'wifi', 'connect', ssid,
+             'password', password, 'name', NM_CLIENT_CON, 'ifname', 'wlan0'],
+            capture_output=True, text=True, timeout=25,
+        )
+    except subprocess.TimeoutExpired:
+        log.warning(f'WiFi-Verbindung Timeout (SSID: {ssid})')
+        return False
     ok = r.returncode == 0
     if ok:
         log.info(f'Verbunden mit {ssid}')
diff --git a/version.txt b/version.txt
index 9c31391..6120160 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.0.72
\ No newline at end of file
+1.0.73
\ No newline at end of file