diff --git a/docs/radius/dot1x.md b/docs/radius/dot1x.md
index e19639d8..dd6ddb5b 100644
--- a/docs/radius/dot1x.md
+++ b/docs/radius/dot1x.md
@@ -125,7 +125,15 @@ Created through the UniFi Network API (site `default`):
 |---|---|---|
 | Firewall policy "Allow APs RADIUS" | `62c21e63-8c15-4720-adf8-b2333c090e2f` | zone Isolated `10.2.10.0/24` → zone External `10.2.99.91`, UDP `1812-1813`, ALLOW, IPv4 |
 | RADIUS profile "Cluster 802.1X" | `3e5fcfed-63dc-4e7d-ad51-17cbc074e4bb` | auth `10.2.99.91:1812`, acct `10.2.99.91:1813`, secret `DOT1X_NAS_SECRET`, VLAN assignment on (`vlan_wlan_mode: optional`) |
-| WLAN "Renner Test" | `3eba27e7-ddc2-41fb-ad3f-82add317847a` | copy of "Renner UniFi" (WPA2/WPA3 Enterprise transition, fast roaming, BSS transition, same AP group and bands), network (90) Guest as fallback, RADIUS profile "Cluster 802.1X" |
+| WLAN "Renner UniFi" | `ef4122f2-4a83-4dca-9ef3-468d29f39a6b` | WPA3 Enterprise (no transition), PMF required, fast roaming, BSS transition, client isolation off, RADIUS profile "Cluster 802.1X"; Application Hotspot, type Passpoint (set in the UniFi UI: the API format differs from the UI's) |
+
+Passpoint on "Renner UniFi" (UniFi offers Passpoint only with WPA3 Enterprise):
+venue "Renner", Residential / Private Residence, network type Private with
+Guest Access, IPv4 single NATed private, IPv6 available, NAI realm
+`renner.uno` with EAP-TTLS, sub-methods PAP and username/password, domain
+`renner.uno`, operator friendly name "Renner", connection capability ICMP
+allow. The AKMs on air are `FT/802.1X` and `802.1X/SHA-256`; plain `802.1X`
+is not offered.
 
 ## Live login check
 
@@ -159,7 +167,8 @@ user's own access token, and returns the profile in the response to that GET,
 as the Android installer requires. The page stores nothing. Deleting the app
 password in authentik removes that device from the WLAN. The profile matches
 WLANs that advertise Hotspot 2.0 with domain and NAI realm `renner.uno`
-(EAP-TTLS/PAP). Creating the app password needs no admin rights.
+(EAP-TTLS/PAP), i.e. "Renner UniFi". Creating the app password needs no admin
+rights.
 
 App passwords expire when unused. The page creates them with 29 days (the API
 caps new tokens at 30 days unless the group attribute
@@ -203,7 +212,7 @@ is never sent in clear over the air.
 Settings > Network & Internet > Wi-Fi > Manage known networks > Add network:
 
 - Network name: `Renner UniFi`
-- Security type: WPA2-Enterprise AES
+- Security type: WPA3-Enterprise AES
 - EAP method: EAP-TTLS
 - Authentication method: Unencrypted password (PAP)
 - Server validation: where offered ("Verify server identity" / trusted