diff --git a/source/core/wifi_ctrl_queue_handlers.c b/source/core/wifi_ctrl_queue_handlers.c
index 1ffdd74e2..3c55810a1 100644
--- a/source/core/wifi_ctrl_queue_handlers.c
+++ b/source/core/wifi_ctrl_queue_handlers.c
@@ -2761,6 +2761,8 @@ void process_wpa3_rfc(bool type)
             vapInfo->u.bss_info.security.wpa3_transition_disable = false;
             vapInfo->u.bss_info.security.mfp = wifi_mfp_cfg_optional;
             vapInfo->u.bss_info.security.u.key.type = wifi_security_key_type_psk_sae;
+            /* When WPA3 RFC enables transition mode, restore transition encryption policy. */
+            apply_wpa3_transition_encr_policy(&vapInfo->u.bss_info.security);
         } else {
             if (vapInfo->u.bss_info.security.mode == wifi_security_mode_wpa2_personal) {
                 continue;
@@ -2769,6 +2771,8 @@ void process_wpa3_rfc(bool type)
             if ((radio_params->band == WIFI_FREQUENCY_2_4_BAND) ||  (radio_params->band == WIFI_FREQUENCY_5_BAND) ||
                 (radio_params->band == WIFI_FREQUENCY_5L_BAND) || (radio_params->band == WIFI_FREQUENCY_5H_BAND)) {
                 vapInfo->u.bss_info.security.mode = wifi_security_mode_wpa2_personal;
+                /* RFC disable should not leave WPA2 with invalid encryption. */
+                apply_wpa2_personal_encr_policy(&vapInfo->u.bss_info.security);
             }
         }
 
@@ -4299,6 +4303,8 @@ void process_rsn_override_rfc(bool type)
                 (radio_params->band == WIFI_FREQUENCY_5L_BAND) || (radio_params->band == WIFI_FREQUENCY_5H_BAND)) {
                     vapInfo->u.bss_info.security.mode = wifi_security_mode_wpa2_personal;
                     vapInfo->u.bss_info.security.mfp = wifi_mfp_cfg_disabled;
+                    /* RFC disable should not leave WPA2 with invalid encryption. */
+                    apply_wpa2_personal_encr_policy(&vapInfo->u.bss_info.security);
             }
 
         if(rfc_param->wpa3_rfc) {
@@ -4306,6 +4312,8 @@ void process_rsn_override_rfc(bool type)
                 vapInfo->u.bss_info.security.wpa3_transition_disable = false;
                 vapInfo->u.bss_info.security.mfp = wifi_mfp_cfg_optional;
                 vapInfo->u.bss_info.security.u.key.type = wifi_security_key_type_psk_sae;
+                /* When RSN override re-enables WPA3 transition, restore its encryption policy. */
+                apply_wpa3_transition_encr_policy(&vapInfo->u.bss_info.security);
             }
 #if defined(CONFIG_IEEE80211BE)
             if (radio_params->band == WIFI_FREQUENCY_6_BAND) {
diff --git a/source/dml/tr_181/ml/cosa_wifi_dml.c b/source/dml/tr_181/ml/cosa_wifi_dml.c
index 255422130..5a46be001 100755
--- a/source/dml/tr_181/ml/cosa_wifi_dml.c
+++ b/source/dml/tr_181/ml/cosa_wifi_dml.c
@@ -9298,7 +9298,8 @@ Security_SetParamStringValue
             case wifi_security_mode_wpa2_personal:
 				l_security_cfg->u.key.type = wifi_security_key_type_psk;
 				l_security_cfg->mfp = wifi_mfp_cfg_optional;
-				wpa2_personal_gcmp_fallback_to_aes(l_security_cfg);
+                                /* Preserve AES/AES+TKIP and normalize invalid carry-over values. */
+                                apply_wpa2_personal_encr_policy(l_security_cfg);
 				break;
             case wifi_security_mode_wpa_wpa2_personal:
 				l_security_cfg->u.key.type = wifi_security_key_type_psk;
@@ -9319,6 +9320,8 @@ Security_SetParamStringValue
             case wifi_security_mode_wpa3_transition:
                 l_security_cfg->u.key.type = wifi_security_key_type_psk_sae;
                 l_security_cfg->mfp = wifi_mfp_cfg_optional;
+                /* Restore platform default encryption when switching back to WPA3-Transition. */
+                apply_wpa3_transition_encr_policy(l_security_cfg);
                 break;
             case wifi_security_mode_enhanced_open:
                 l_security_cfg->mfp = wifi_mfp_cfg_required;
diff --git a/source/utils/wifi_util.c b/source/utils/wifi_util.c
index 6723178e2..eaa938ee1 100644
--- a/source/utils/wifi_util.c
+++ b/source/utils/wifi_util.c
@@ -4959,19 +4959,42 @@ bool is_valid_encr_for_mode(wifi_security_modes_t mode, wifi_encryption_method_t
     return (valid_mask & (1u << encr)) != 0;
 }
 
-void wpa2_personal_gcmp_fallback_to_aes(wifi_vap_security_t *security_info)
+void apply_wpa2_personal_encr_policy(wifi_vap_security_t *security_info)
 {
-    if (security_info == NULL) {
+    if (security_info == NULL || security_info->mode != wifi_security_mode_wpa2_personal) {
         return;
     }
 
-    if (security_info->mode == wifi_security_mode_wpa2_personal &&
-        security_info->encr == wifi_encryption_aes_gcmp256) {
+    if (security_info->encr == wifi_encryption_aes_gcmp256) {
         wifi_util_info_print(WIFI_WEBCONFIG,
             "%s:%d enforcing WPA2-Personal encryption fallback AES+GCMP(%d)->AES(%d)\n",
             __func__, __LINE__, wifi_encryption_aes_gcmp256, wifi_encryption_aes);
         security_info->encr = wifi_encryption_aes;
+        return;
+    }
+
+    /* Preserve valid WPA2 encryptions (AES, AES+TKIP); normalize anything else to AES. */
+    if (security_info->encr != wifi_encryption_aes &&
+        security_info->encr != wifi_encryption_aes_tkip) {
+        wifi_util_info_print(WIFI_WEBCONFIG,
+            "%s:%d enforcing WPA2-Personal encryption fallback invalid(%d)->AES(%d)\n",
+            __func__, __LINE__, security_info->encr, wifi_encryption_aes);
+        security_info->encr = wifi_encryption_aes;
+    }
+}
+
+void apply_wpa3_transition_encr_policy(wifi_vap_security_t *security_info)
+{
+    if (security_info == NULL || security_info->mode != wifi_security_mode_wpa3_transition) {
+        return;
     }
+
+#ifdef CONFIG_IEEE80211BE
+    /* 11be builds use AES+GCMP as the policy default for WPA3-Transition. */
+    security_info->encr = wifi_encryption_aes_gcmp256;
+#else
+    security_info->encr = wifi_encryption_aes;
+#endif /* CONFIG_IEEE80211BE */
 }
 
 int get_mesh_sta_mac_address_for_radio(wifi_platform_property_t *wifi_prop, unsigned int radio_index, mac_address_t mac)
diff --git a/source/utils/wifi_util.h b/source/utils/wifi_util.h
index 44eff31c0..271b99307 100644
--- a/source/utils/wifi_util.h
+++ b/source/utils/wifi_util.h
@@ -486,7 +486,8 @@ int interfacename_from_mac(const mac_address_t *mac, char *ifname);
 int mac_address_from_name(const char *ifname, mac_address_t mac);
 bool is_zero_mac(const uint8_t *mac);
 bool is_valid_encr_for_mode(wifi_security_modes_t mode, wifi_encryption_method_t encr);
-void wpa2_personal_gcmp_fallback_to_aes(wifi_vap_security_t *security_info);
+void apply_wpa2_personal_encr_policy(wifi_vap_security_t *security_info);
+void apply_wpa3_transition_encr_policy(wifi_vap_security_t *security_info);
 int get_mesh_sta_mac_address_for_radio(wifi_platform_property_t *wifi_prop, unsigned int radio_index, mac_address_t mac);
 #ifdef __cplusplus
 }
diff --git a/source/webconfig/wifi_decoder.c b/source/webconfig/wifi_decoder.c
index 77f7d7df4..ab4ca42c9 100644
--- a/source/webconfig/wifi_decoder.c
+++ b/source/webconfig/wifi_decoder.c
@@ -1523,7 +1523,13 @@ webconfig_error_t decode_security_object(const cJSON *security, wifi_vap_securit
         return webconfig_error_decode;
     }
 
-    wpa2_personal_gcmp_fallback_to_aes(security_info);
+    /* Normalize mode/encryption pairs before compatibility validation. */
+    if (security_info->mode == wifi_security_mode_wpa3_transition) {
+        apply_wpa3_transition_encr_policy(security_info);
+    }
+    if (security_info->mode == wifi_security_mode_wpa2_personal) {
+        apply_wpa2_personal_encr_policy(security_info);
+    }
 
     if (!is_valid_encr_for_mode(security_info->mode, security_info->encr)) {
         wifi_util_error_print(WIFI_WEBCONFIG, "%s:%d invalid encryption %d for mode %d\n",