diff --git a/CHANGELOG.md b/CHANGELOG.md
index 06d992895..0a4ebe468 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ All notable changes to Bambuddy will be documented in this file.
 
 ### Improved
 - **Spool Notes in Assign Spool Modal** ([#793](https://github.com/maziggy/bambuddy/issues/793)) — Spool cards in the Assign Spool modal now show the spool's note as a hover tooltip, making it easier to identify spools by tracking IDs or other metadata stored in notes. Works with both internal inventory and Spoolman-synced spools. Requested by @LegionCanadian.
+- **WiFi Safeguard for SpoolBuddy Pi** — The install script now drops an APT hook (`/etc/apt/apt.conf.d/80-preserve-wifi`) that backs up NetworkManager WiFi connections before every `apt upgrade` and restores them if they get wiped. Prevents headless SpoolBuddy Pis from losing WiFi connectivity after Raspberry Pi OS package upgrades (observed with Bookworm kernel/raspi-config updates that clear `/etc/NetworkManager/system-connections/`).
 
 ### Fixed
 - **Database Connection Pool Exhaustion on Large Printer Farms** — Users with 100+ printers connected simultaneously experienced `QueuePool limit of size 10 overflow 20 reached, connection timed out` errors. Increased the SQLAlchemy connection pool from 30 total (10 base + 20 overflow) to 220 (20 base + 200 overflow), and raised the SQLite busy_timeout from 5 to 15 seconds to reduce write contention under heavy concurrent MQTT updates.
diff --git a/spoolbuddy/install/install.sh b/spoolbuddy/install/install.sh
index c58d2b738..e329eb25d 100755
--- a/spoolbuddy/install/install.sh
+++ b/spoolbuddy/install/install.sh
@@ -433,6 +433,35 @@ install_system_packages() {
     run_with_progress "Installing system packages" apt-get install -y $SYSTEM_PACKAGES
 }
 
+install_wifi_safeguard() {
+    # Protect WiFi credentials from being wiped by apt upgrades.
+    # Raspberry Pi OS Bookworm migrated from wpa_supplicant/dhcpcd to
+    # NetworkManager, but certain package upgrades (raspberrypi-sys-mods,
+    # raspi-config, NetworkManager itself) can delete saved connections
+    # from /etc/NetworkManager/system-connections/.  This hook backs them
+    # up before dpkg runs and restores them if they vanish.
+    local hook_file="/etc/apt/apt.conf.d/80-preserve-wifi"
+
+    if [[ -f "$hook_file" ]]; then
+        success "WiFi safeguard already installed"
+        return
+    fi
+
+    # Only install if NetworkManager is the active network manager
+    if ! systemctl is-active --quiet NetworkManager 2>/dev/null; then
+        return
+    fi
+
+    cat > "$hook_file" << 'APTEOF'
+// Preserve NetworkManager WiFi connections across apt upgrades.
+// Installed by SpoolBuddy — prevents headless Pis from losing WiFi.
+DPkg::Pre-Invoke { "if [ -d /etc/NetworkManager/system-connections ] && [ -n \"$(ls -A /etc/NetworkManager/system-connections/ 2>/dev/null)\" ]; then cp -a /etc/NetworkManager/system-connections/ /etc/NetworkManager/system-connections.bak/; fi"; };
+DPkg::Post-Invoke { "if [ -d /etc/NetworkManager/system-connections.bak ] && [ -z \"$(ls -A /etc/NetworkManager/system-connections/ 2>/dev/null)\" ]; then cp -a /etc/NetworkManager/system-connections.bak/* /etc/NetworkManager/system-connections/ && nmcli general reload 2>/dev/null; fi"; };
+APTEOF
+
+    success "WiFi safeguard installed (${hook_file})"
+}
+
 # ─────────────────────────────────────────────────────────────────────────────
 # SpoolBuddy Installation
 # ─────────────────────────────────────────────────────────────────────────────
@@ -1305,6 +1334,7 @@ main() {
 
     # ── Step 2: System packages ───────────────────────────────────────────
     install_system_packages
+    install_wifi_safeguard
     detect_python || error "Failed to install Python 3.10+"
     echo ""