diff --git a/.github/workflows/apply.yml b/.github/workflows/apply.yml
index db97234..b377a71 100644
--- a/.github/workflows/apply.yml
+++ b/.github/workflows/apply.yml
@@ -39,3 +39,4 @@ jobs:
           AWS_REGION:               us-east-1
           MERAKI_DASHBOARD_API_KEY: ${{ secrets.MERAKI_DASHBOARD_API_KEY }}
           TF_VAR_radius_secret:     ${{ secrets.RADIUS_SECRET }}
+          TF_VAR_wifi_password_psk: ${{ secrets.WIFI_PASSWORD_PSK }}
\ No newline at end of file
diff --git a/.github/workflows/plan.yml b/.github/workflows/plan.yml
index 957789f..096270a 100644
--- a/.github/workflows/plan.yml
+++ b/.github/workflows/plan.yml
@@ -41,6 +41,7 @@ jobs:
           AWS_REGION:                  us-east-1
           MERAKI_DASHBOARD_API_KEY:    ${{ secrets.MERAKI_DASHBOARD_API_KEY }}
           TF_VAR_radius_secret:        ${{ secrets.RADIUS_SECRET }}
+          TF_VAR_wifi_password_psk:    ${{ secrets.WIFI_PASSWORD_PSK }}
 
       - name: Comentar Plan en el PR
         uses: actions/github-script@v7
diff --git a/modules/meraki-site/main.tf b/modules/meraki-site/main.tf
index 1195b1f..1e4724e 100755
--- a/modules/meraki-site/main.tf
+++ b/modules/meraki-site/main.tf
@@ -160,7 +160,8 @@ resource "meraki_wireless_ssid" "ssids" {
   name                = each.value.name
   enabled             = each.value.enabled
   auth_mode           = each.value.auth_mode
-  psk                 = each.value.psk
+  # Si el SSID no tiene psk en el tfvars, usa var.wifi_password_psk (TF_VAR_wifi_password_psk)
+  psk                 = each.value.psk != null ? each.value.psk : var.wifi_password_psk
   # wpa_encryption_mode solo es compatible con auth_mode != "open"
   # Para OWE (open + WPA3) la API rechaza el campo; la encriptación Enhanced Open
   # se negocia a nivel de beacon y no se expone como atributo de la API Meraki.
diff --git a/modules/meraki-site/variables.tf b/modules/meraki-site/variables.tf
index f4c55d9..0c69c15 100755
--- a/modules/meraki-site/variables.tf
+++ b/modules/meraki-site/variables.tf
@@ -58,6 +58,12 @@ variable "radius_secret" {
   description = "Shared secret para autenticación RADIUS. Pasar via TF_VAR_radius_secret"
 }
 
+variable "wifi_password_psk" {
+  type      = string
+  description = "Password para la SSID WPA2 desde GitHub Secrets"
+  sensitive = true
+}
+
 # Definición del mapa de VLANs
 variable "switch_vlans" {
   type = map(object({
diff --git a/sites/BCN01-LAB/main.tf b/sites/BCN01-LAB/main.tf
index 1b252d4..c4f0b92 100755
--- a/sites/BCN01-LAB/main.tf
+++ b/sites/BCN01-LAB/main.tf
@@ -36,4 +36,5 @@ module "bcn01_lab" {
   switch_management_vlan    = var.switch_management_vlan
   stack_routing_interfaces  = var.stack_routing_interfaces
   appliance_ports           = var.appliance_ports
+  wifi_password_psk   = var.wifi_password_psk
 }
diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars
index 7c4a777..d84a38b 100644
--- a/sites/BCN01-LAB/ssids.auto.tfvars
+++ b/sites/BCN01-LAB/ssids.auto.tfvars
@@ -20,5 +20,16 @@ wireless_ssids = [
         port = 1912
       }
     ]
+  },
+  {
+    number              = 1
+    name                = "EQT-GUEST"
+    enabled             = true
+    auth_mode           = "psk"            # Modo para contraseña compartida
+    wpa_encryption_mode = "WPA2 only"     # Lo que pediste para compatibilidad
+    # psk se inyecta via TF_VAR_wifi_password_psk (GitHub secret WIFI_PASSWORD_PSK)
+    ip_assignment_mode  = "Bridge mode"
+    use_vlan_tagging    = true
+    default_vlan_id     = 101
   }
 ]
diff --git a/sites/BCN01-LAB/variables.tf b/sites/BCN01-LAB/variables.tf
index 4af645a..e3537c9 100755
--- a/sites/BCN01-LAB/variables.tf
+++ b/sites/BCN01-LAB/variables.tf
@@ -50,6 +50,12 @@ variable "wireless_ssids" {
   description = "Lista de SSIDs wireless a configurar en el site"
 }
 
+variable "wifi_password_psk" {
+  type      = string
+  description = "Password para la SSID WPA2 desde GitHub Secrets"
+  sensitive = true
+}
+
 # Shared secret para servidores RADIUS (sensible, no incluir en tfvars)
 variable "radius_secret" {
   type        = string