diff --git a/modules/meraki-site/main.tf b/modules/meraki-site/main.tf
index 4379bdd..b3c498a 100755
--- a/modules/meraki-site/main.tf
+++ b/modules/meraki-site/main.tf
@@ -159,6 +159,7 @@ resource "meraki_wireless_ssid" "ssids" {
   number              = each.value.number
   name                = each.value.name
   enabled             = each.value.enabled
+  visible             = each.value.visible
   auth_mode           = each.value.auth_mode
   # PSK solo se envía para SSIDs con auth_mode "psk"; para open/open-enhanced se deja null
   psk                 = each.value.auth_mode == "psk" ? (each.value.psk != null ? each.value.psk : var.wifi_password_psk) : null
diff --git a/modules/meraki-site/variables.tf b/modules/meraki-site/variables.tf
index 76b43d9..8686059 100755
--- a/modules/meraki-site/variables.tf
+++ b/modules/meraki-site/variables.tf
@@ -33,6 +33,7 @@ variable "wireless_ssids" {
     number              = number
     name                = string
     enabled             = optional(bool, true)
+    visible             = optional(bool, true)   # false = SSID oculto (no broadcast)
     auth_mode           = string
     psk                 = optional(string, null)   # Contraseña WPA2/WPA3-PSK (sensible, usar TF_VAR o secret)
     encryption_mode     = optional(string, null)   # "wpa" para PSK; null para open/OWE
diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars
index bacef8c..33a5788 100644
--- a/sites/BCN01-LAB/ssids.auto.tfvars
+++ b/sites/BCN01-LAB/ssids.auto.tfvars
@@ -27,6 +27,7 @@ wireless_ssids = [
     number             = 2
     name               = "EQT-CORPO-OWE-OK"
     enabled            = true
+    visible            = false   # SSID oculto — no hace broadcast del nombre
     auth_mode          = "open"
     splash_page        = "Password-protected with custom RADIUS"
     ip_assignment_mode = "Bridge mode"