diff --git a/firmware/lib/net_guard/net_guard.cpp b/firmware/lib/net_guard/net_guard.cpp
index a1d5ca1..123368d 100644
--- a/firmware/lib/net_guard/net_guard.cpp
+++ b/firmware/lib/net_guard/net_guard.cpp
@@ -126,7 +126,11 @@ extern "C" void net_guard_tick() {
     }
 
     if (s_up || s_cfg == nullptr) return;
-    if (millis() < s_next_retry_ms) return;
+    // Wrap-safe: signed difference handles the ~49.7-day millis() wrap. The
+    // device is meant to run for months between reboots, so absolute compare
+    // (millis() < s_next_retry_ms) would either tight-loop retries across the
+    // wrap or stall them until millis() climbed back past an old high mark.
+    if ((int32_t)(millis() - s_next_retry_ms) < 0) return;
     if (s_up) return;  // re-check after the timing gate — closes GOT_IP-vs-tick race
     s_attempts++;
     // WiFi.begin() alone re-associates cleanly; a prior WiFi.disconnect() call