diff --git a/firmware/main/Kconfig.projbuild b/firmware/main/Kconfig.projbuild
index e5f3b99..8e8c79a 100644
--- a/firmware/main/Kconfig.projbuild
+++ b/firmware/main/Kconfig.projbuild
@@ -1,10 +1,12 @@
 menu "ESPresso Frame Configuration"
 
     config ESP_AP_SSID
-        string "Provisioning softAP SSID"
+        string "Provisioning softAP SSID prefix"
         default "ESPRESSO"
         help
-            SSID of the softAP the device brings up when it needs provisioning.
+            SSID prefix of the softAP the device brings up when it needs
+            provisioning; the device appends "_XXXXXX" (last 3 bytes of its
+            WiFi MAC) so multiple frames never collide on the same SSID.
             The password is generated randomly per device on first boot and
             shown on the e-ink panel both as a WiFi-join QR code and as
             plaintext underneath it, so it can be typed in by hand on a
diff --git a/firmware/main/wifi_provisioning.c b/firmware/main/wifi_provisioning.c
index 9596019..ac3b3d6 100644
--- a/firmware/main/wifi_provisioning.c
+++ b/firmware/main/wifi_provisioning.c
@@ -112,7 +112,12 @@ static void generate_ap_password(char *out, size_t out_size)
 
 void ap_identity_get(char *ssid_out, size_t ssid_len, char *pass_out, size_t pass_len)
 {
-    snprintf(ssid_out, ssid_len, "%s", CONFIG_ESP_AP_SSID);
+    /* Suffix with the last 3 bytes of the station MAC so two frames on the
+     * same network never advertise the same SSID. esp_read_mac() works
+     * before the WiFi driver is started. */
+    uint8_t mac[6];
+    ESP_ERROR_CHECK(esp_read_mac(mac, ESP_MAC_WIFI_STA));
+    snprintf(ssid_out, ssid_len, "%s_%02X%02X%02X", CONFIG_ESP_AP_SSID, mac[3], mac[4], mac[5]);
 
     nvs_handle_t handle;
     ESP_ERROR_CHECK(nvs_open(NVS_NAMESPACE, NVS_READWRITE, &handle));