diff --git a/modules/meraki-site/main.tf b/modules/meraki-site/main.tf
index b3c498a..24225fb 100755
--- a/modules/meraki-site/main.tf
+++ b/modules/meraki-site/main.tf
@@ -151,8 +151,9 @@ resource "meraki_appliance_vlan" "mx_gateways" {
 }
 
 # 3. SSIDs wireless
+# SSIDs con WPA (psk, open-enhanced): incluyen wpa_encryption_mode
 resource "meraki_wireless_ssid" "ssids" {
-  for_each   = { for s in var.wireless_ssids : tostring(s.number) => s }
+  for_each   = { for s in var.wireless_ssids : tostring(s.number) => s if s.auth_mode != "open" }
   depends_on = [meraki_appliance_vlans_settings.activate_vlans]
 
   network_id          = local.network_id
@@ -161,9 +162,7 @@ resource "meraki_wireless_ssid" "ssids" {
   enabled             = each.value.enabled
   visible             = each.value.visible
   auth_mode           = each.value.auth_mode
-  # PSK solo se envía para SSIDs con auth_mode "psk"; para open/open-enhanced se deja null
   psk                 = each.value.auth_mode == "psk" ? (each.value.psk != null ? each.value.psk : var.wifi_password_psk) : null
-  # wpa_encryption_mode se pasa directamente desde el tfvars (null si no aplica)
   wpa_encryption_mode = each.value.wpa_encryption_mode
   encryption_mode     = each.value.encryption_mode
   splash_page         = each.value.splash_page
@@ -179,6 +178,30 @@ resource "meraki_wireless_ssid" "ssids" {
   ] : []
 }
 
+# SSIDs open (sin WPA): wpa_encryption_mode se omite — la API Meraki lo rechaza para auth_mode=open
+resource "meraki_wireless_ssid" "ssids_open" {
+  for_each   = { for s in var.wireless_ssids : tostring(s.number) => s if s.auth_mode == "open" }
+  depends_on = [meraki_appliance_vlans_settings.activate_vlans]
+
+  network_id         = local.network_id
+  number             = each.value.number
+  name               = each.value.name
+  enabled            = each.value.enabled
+  visible            = each.value.visible
+  auth_mode          = each.value.auth_mode
+  splash_page        = each.value.splash_page
+  ip_assignment_mode = each.value.ip_assignment_mode
+  use_vlan_tagging   = each.value.use_vlan_tagging
+  default_vlan_id    = each.value.default_vlan_id
+  radius_servers = length(each.value.radius_servers) > 0 ? [
+    for server in each.value.radius_servers : {
+      host   = server.host
+      port   = server.port
+      secret = var.radius_secret
+    }
+  ] : []
+}
+
 # 4. Reglas de firewall L3
 resource "meraki_appliance_l3_firewall_rules" "reglas_firewall" {
   network_id = local.network_id