diff --git a/radiuscontroller/Services/RadiusService.cs b/radiuscontroller/Services/RadiusService.cs
index ac1bca5..164dffa 100644
--- a/radiuscontroller/Services/RadiusService.cs
+++ b/radiuscontroller/Services/RadiusService.cs
@@ -272,7 +272,8 @@ public class RadiusService : IRadiusService
 
         profile.Status = "Revoked";
 
-        // Remove Cleartext-Password and insert Auth-Type := Reject
+        // Remove Cleartext-Password from radcheck so FreeRADIUS rejects future auth with MS-CHAP error 691,
+        // prompting iOS / clients to re-enter credentials instead of requiring 'Forget Network'.
         var checks = await _db.RadCheck.Where(rc => rc.Username == profile.Username).ToListAsync();
         _db.RadCheck.RemoveRange(checks);
 
diff --git a/radiuscontroller/raddb/mods-enabled/mschap b/radiuscontroller/raddb/mods-enabled/mschap
new file mode 100644
index 0000000..747312e
--- /dev/null
+++ b/radiuscontroller/raddb/mods-enabled/mschap
@@ -0,0 +1,5 @@
+mschap {
+	# Send MS-CHAP-Error with E=691 on authentication failure,
+	# so iOS / Windows show "Incorrect Password" instead of "Unable to join network".
+	send_error = yes
+}