diff --git a/package/gluon-private-wifi/luasrc/lib/gluon/upgrade/325-gluon-private-wifi b/package/gluon-private-wifi/luasrc/lib/gluon/upgrade/325-gluon-private-wifi
index 8facf45d959dbd1c5509d6f8ec0c6b28c5c20016..2485847cd2591f0e3e74544579c121baac9644ee 100755
--- a/package/gluon-private-wifi/luasrc/lib/gluon/upgrade/325-gluon-private-wifi
+++ b/package/gluon-private-wifi/luasrc/lib/gluon/upgrade/325-gluon-private-wifi
@@ -13,6 +13,11 @@ wireless.foreach_radio(uci, function(radio)
 	end
 
 	uci:set('wireless', name, 'ifname', suffix and 'wl-wan' .. suffix)
+
+	-- migrate encryption from Gluon v2023.2.x or older
+	-- remove in 2027 or on first release supporting only upgrades from >=v2025.1.x
+	local encryption = uci:get('wireless', name, 'encryption')
+	uci:set('wireless', name, 'encryption', encryption:gsub("psk3", "sae"))
 end)
 
 uci:save('wireless')
diff --git a/package/gluon-web-private-wifi/luasrc/lib/gluon/config-mode/model/admin/privatewifi.lua b/package/gluon-web-private-wifi/luasrc/lib/gluon/config-mode/model/admin/privatewifi.lua
index 1be55abdff2a1fefc25d03b2aa035b8f5cf1589b..fae83c74c07d07476e1666e6870057bb50b0e4f0 100644
--- a/package/gluon-web-private-wifi/luasrc/lib/gluon/config-mode/model/admin/privatewifi.lua
+++ b/package/gluon-web-private-wifi/luasrc/lib/gluon/config-mode/model/admin/privatewifi.lua
@@ -49,8 +49,8 @@ local encryption = s:option(ListValue, "encryption", translate("Encryption"))
 encryption:depends(enabled, true)
 encryption:value("psk2", translate("WPA2"))
 if wireless.device_supports_wpa3() then
-	encryption:value("psk3-mixed", translate("WPA2 / WPA3"))
-	encryption:value("psk3", translate("WPA3"))
+	encryption:value("sae-mixed", translate("WPA2 / WPA3"))
+	encryption:value("sae", translate("WPA3"))
 end
 encryption.default = uci:get('wireless', primary_iface, 'encryption') or "psk2"