diff --git a/radiuscontroller/Services/RadiusService.cs b/radiuscontroller/Services/RadiusService.cs
index a7c7b2e..ab2f872 100644
--- a/radiuscontroller/Services/RadiusService.cs
+++ b/radiuscontroller/Services/RadiusService.cs
@@ -336,6 +336,13 @@ public class RadiusService : IRadiusService
         if (profile.Status == "Revoked")
         {
             profile.Status = "Active";
+
+            // Remove the zeroed NT-Password that was set on revoke
+            var ntPasswordCheck = await _db.RadCheck.FirstOrDefaultAsync(rc => rc.Username == profile.Username && rc.Attribute == "NT-Password");
+            if (ntPasswordCheck != null)
+            {
+                _db.RadCheck.Remove(ntPasswordCheck);
+            }
         }
 
         await _db.SaveChangesAsync();
diff --git a/radiuscontroller/raddb/mods-enabled/mschap b/radiuscontroller/raddb/mods-enabled/mschap
index 747312e..f1204b0 100644
--- a/radiuscontroller/raddb/mods-enabled/mschap
+++ b/radiuscontroller/raddb/mods-enabled/mschap
@@ -2,4 +2,10 @@ mschap {
 	# Send MS-CHAP-Error with E=691 on authentication failure,
 	# so iOS / Windows show "Incorrect Password" instead of "Unable to join network".
 	send_error = yes
+
+	# Force the rejection format to return the MSCHAPv2 failure code
+	# (Error 691 explicitly maps to an incorrect password on iOS)
+	passchange {
+		ntlm_auth = "/usr/bin/ntlm_auth"
+	}
 }