diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json b/package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json
index 1d71d7e3211..0a8c34539e3 100644
--- a/package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json
+++ b/package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json
@@ -726,11 +726,11 @@
 			"type": "number"
 		},
 		"mlo": {
-			"description": "Multi-Link Operation. On an AP MLD, psk and psk-mixed become psk2, and wpa and wpa-mixed become wpa2; psk2 keeps PSK in the RSNE of the 2.4 and 5 GHz links for single-link stations and offers SAE in the RSNE Override 2 element of every link, which multi-link associations use. The 6 GHz link uses SAE. If the AP MLD has a 6 GHz link, none becomes owe on the other links",
+			"description": "Multi-Link Operation. On an AP MLD, psk and psk-mixed become psk2, and wpa and wpa-mixed become wpa2; psk2 keeps PSK in the RSNE of the 2.4 and 5 GHz links for single-link stations and offers SAE in the RSNE Override 2 element of every link, which multi-link associations use. The 6 GHz link uses SAE. If the AP MLD has a 6 GHz link, none becomes owe on the other links. On an MLD station with a 6 GHz radio and radios of other bands, psk2 becomes sae-mixed and wpa2 becomes wpa3-mixed",
 			"type": "boolean"
 		},
 		"mlo_bands": {
-			"description": "Bands of all radios of the AP MLD, set by netifd",
+			"description": "Bands of all radios of the AP MLD or MLD station, set by netifd",
 			"type": "array",
 			"items": {
 				"type": "string"
diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc
index 3cde7e91a12..0ee0f261f5c 100644
--- a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc
+++ b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc
@@ -43,24 +43,46 @@ const encryption_mld_6g = {
 	'none': 'owe',
 };
 
-/* mld_bands: null for a single-link BSS, else the bands of the AP MLD */
-export function encryption_band(encryption, band, mld_bands) {
-	let modes;
-	if (band == '6g')
-		modes = encryption_6g;
-	else if (index(mld_bands ?? [], '6g') >= 0)
-		modes = encryption_mld_6g;
-	else if (mld_bands != null)
-		modes = encryption_mld;
-	else
-		return encryption;
+/*
+ * One network block serves all links of an MLD station, and wpa_supplicant
+ * removes the PSK AKMs for a 6 GHz BSS.
+ */
+const encryption_sta_mixed_6g = {
+	'psk2': 'sae-mixed',
+	'wpa2': 'wpa3-mixed',
+};
 
+function encryption_map(encryption, modes) {
 	let enc = split(encryption ?? 'none', '+', 2);
 	if (!modes[enc[0]])
 		return encryption;
 
 	enc[0] = modes[enc[0]];
 	return join('+', enc);
+}
+
+/* mld_bands: null for a single-link BSS, else the bands of the AP MLD */
+export function encryption_band(encryption, band, mld_bands) {
+	if (band == '6g')
+		return encryption_map(encryption, encryption_6g);
+	if (index(mld_bands ?? [], '6g') >= 0)
+		return encryption_map(encryption, encryption_mld_6g);
+	if (mld_bands != null)
+		return encryption_map(encryption, encryption_mld);
+
+	return encryption;
+};
+
+/* mld_bands: null for a single-link station, else the bands of the MLD */
+export function encryption_sta_band(encryption, band, mld_bands) {
+	if (!length(mld_bands))
+		return encryption_band(encryption, band);
+	if (index(mld_bands, '6g') < 0)
+		return encryption;
+	if (length(mld_bands) == 1)
+		return encryption_map(encryption, encryption_6g);
+
+	return encryption_map(encryption, encryption_sta_mixed_6g);
 };
 
 export function parse_encryption(config, dev_config, phy_features) {
diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/supplicant.uc b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/supplicant.uc
index c9481b4ec92..2bd83df3c76 100644
--- a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/supplicant.uc
+++ b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/supplicant.uc
@@ -69,7 +69,8 @@ function setup_sta(data, config, phy_features) {
 
 	/* use what a 6 GHz AP with the same configuration offers */
 	if (config.mode == 'sta')
-		config.encryption = iface.encryption_band(config.encryption, data.band);
+		config.encryption = iface.encryption_sta_band(config.encryption, data.band,
+			config.mlo ? config.mlo_bands : null);
 
 	/* WPA3 Specification v3.5 2.5 items 9 and 10: "A STA that enables EHT
 	 * or MLO shall, in its Network Profile, allow AKM suite selector