diff --git a/README.md b/README.md
index c312ae0..c60f9f4 100644
--- a/README.md
+++ b/README.md
@@ -10,12 +10,14 @@ sudo apt install -y python3-pip python3-pil python3-opencv python3-smbus python3
 sudo swapoff -a
 sudo systemctl mask swap.target
 sudo systemctl disable --now bluetooth
+
+sudo nmcli c modify netplan-wlan0-HiddenPlace 802-11-wireless.powersave 2
 ```
 
-Execute `sudo crontab -e` and add
+Execute `sudo crontab -e` reland add
 ```
 @reboot /usr/sbin/iw wlan0 set power_save off
-*/5 * * * * /home/andras/frame/wifi-check.sh > /home/andras/wifi.log 2>&1
+*/5 * * * * /home/andras/frame/wifi-check.sh >> /home/andras/wifi.log 2>&1
 ```
 
 Execute `crontab -e` and add
diff --git a/src/wifi-check.sh b/src/wifi-check.sh
index 9974f49..88a65f8 100755
--- a/src/wifi-check.sh
+++ b/src/wifi-check.sh
@@ -1,8 +1,38 @@
 #!/bin/bash
+# Probe what actually matters (DNS to a real target) and escalate recovery
+# steps until something works. `ip link down/up` alone can't unwedge the
+# brcmfmac chip on the Pi Zero 2W.
 
-if ! ping -c 1 -W 5 192.168.0.1 > /dev/null 2>&1; then
-    logger "WiFi check: no connectivity, restarting wlan0"
-    ip link set wlan0 down
-    sleep 2
-    ip link set wlan0 up
-fi
+CONNECTION="netplan-wlan0-HiddenPlace"
+PROBE_HOST="homeassistant.example.com"
+
+probe() {
+    ping -c 1 -W 5 192.168.0.1 >/dev/null 2>&1 \
+        && getent hosts "$PROBE_HOST" >/dev/null 2>&1
+}
+
+probe && exit 0
+
+logger "wifi-check: probe failed, reconnecting via nmcli"
+nmcli device disconnect wlan0
+sleep 2
+nmcli connection up "$CONNECTION"
+sleep 10
+probe && exit 0
+
+logger "wifi-check: nmcli failed, cycling rfkill"
+rfkill block wifi
+sleep 3
+rfkill unblock wifi
+sleep 15
+probe && exit 0
+
+logger "wifi-check: rfkill failed, reloading brcmfmac"
+modprobe -r brcmfmac brcmutil
+sleep 3
+modprobe brcmfmac
+sleep 20
+probe && exit 0
+
+logger "wifi-check: all recovery failed, rebooting"
+/sbin/reboot