diff --git a/extmod/network_cyw43.c b/extmod/network_cyw43.c
index e1df4fc61..70d9158e1 100644
--- a/extmod/network_cyw43.c
+++ b/extmod/network_cyw43.c
@@ -253,6 +253,54 @@ static mp_obj_t network_cyw43_scan(size_t n_args, const mp_obj_t *pos_args, mp_m
 }
 static MP_DEFINE_CONST_FUN_OBJ_KW(network_cyw43_scan_obj, 1, network_cyw43_scan);
 
+// The cyw43 firmware not-uncommonly reports an authentication failure on the
+// very first association to an AP, even when the password is correct: a bad-auth
+// event is quickly followed by a good one, or the WPA handshake times out once.
+// A plain re-join then succeeds.  Rather than surface a spurious "wrong password"
+// that every application has to work around with its own retry loop, the join
+// parameters are cached and the join is transparently re-issued a few times
+// before a BADAUTH status is reported to Python.  Set to 0 to disable.
+#ifndef MICROPY_PY_NETWORK_CYW43_JOIN_RETRIES
+#define MICROPY_PY_NETWORK_CYW43_JOIN_RETRIES (3)
+#endif
+
+typedef struct _network_cyw43_join_params_t {
+    uint8_t retries_left;
+    bool has_bssid;
+    size_t ssid_len;
+    size_t key_len;
+    uint32_t auth_type;
+    uint32_t channel;
+    uint8_t ssid[32];
+    uint8_t key[64];
+    uint8_t bssid[6];
+} network_cyw43_join_params_t;
+
+static network_cyw43_join_params_t network_cyw43_join_params;
+
+// Re-issue the most recent join using the cached parameters.
+static int network_cyw43_rejoin(network_cyw43_obj_t *self) {
+    network_cyw43_join_params_t *j = &network_cyw43_join_params;
+    return cyw43_wifi_join(self->cyw, j->ssid_len, j->ssid, j->key_len,
+        j->key_len ? j->key : NULL, j->auth_type,
+        j->has_bssid ? j->bssid : NULL, j->channel);
+}
+
+// Return the link status, transparently retrying a transient authentication
+// failure on the STA interface (see network_cyw43_join_params above).
+static int network_cyw43_link_status(network_cyw43_obj_t *self) {
+    int status = cyw43_tcpip_link_status(self->cyw, self->itf);
+    if (self->itf == CYW43_ITF_STA && status == CYW43_LINK_BADAUTH
+        && network_cyw43_join_params.retries_left > 0) {
+        network_cyw43_join_params.retries_left -= 1;
+        if (network_cyw43_rejoin(self) == 0) {
+            // Report the join as still in progress so the caller keeps waiting.
+            return CYW43_LINK_JOIN;
+        }
+    }
+    return status;
+}
+
 static mp_obj_t network_cyw43_connect(size_t n_args, const mp_obj_t *pos_args, mp_map_t *kw_args) {
     enum { ARG_ssid, ARG_key, ARG_auth, ARG_security, ARG_bssid, ARG_channel };
     static const mp_arg_t allowed_args[] = {
@@ -309,6 +357,28 @@ static mp_obj_t network_cyw43_connect(size_t n_args, const mp_obj_t *pos_args, m
         auth_type = args[ARG_security].u_int;
     }
 
+    // Cache the join parameters so a transient authentication failure can be
+    // retried transparently (see network_cyw43_link_status).  If the credentials
+    // are too long to cache, auto-retry is simply disabled for this join.
+    network_cyw43_join_params_t *j = &network_cyw43_join_params;
+    if (ssid.len <= sizeof(j->ssid) && key.len <= sizeof(j->key)) {
+        j->ssid_len = ssid.len;
+        memcpy(j->ssid, ssid.buf, ssid.len);
+        j->key_len = key.len;
+        if (key.buf != NULL) {
+            memcpy(j->key, key.buf, key.len);
+        }
+        j->auth_type = auth_type;
+        j->has_bssid = bssid.buf != NULL;
+        if (bssid.buf != NULL) {
+            memcpy(j->bssid, bssid.buf, sizeof(j->bssid));
+        }
+        j->channel = args[ARG_channel].u_int;
+        j->retries_left = MICROPY_PY_NETWORK_CYW43_JOIN_RETRIES;
+    } else {
+        j->retries_left = 0;
+    }
+
     // Start the WiFi join procedure.  It will run in the background.
     int ret = cyw43_wifi_join(self->cyw, ssid.len, ssid.buf, key.len, key.buf,
         auth_type, bssid.buf, args[ARG_channel].u_int);
@@ -328,7 +398,7 @@ static MP_DEFINE_CONST_FUN_OBJ_1(network_cyw43_disconnect_obj, network_cyw43_dis
 
 static mp_obj_t network_cyw43_isconnected(mp_obj_t self_in) {
     network_cyw43_obj_t *self = MP_OBJ_TO_PTR(self_in);
-    bool result = (cyw43_tcpip_link_status(self->cyw, self->itf) == CYW43_LINK_UP);
+    bool result = (network_cyw43_link_status(self) == CYW43_LINK_UP);
 
     if (result && self->itf == CYW43_ITF_AP) {
         // For AP we need to not only know if the link is up, but also if any stations
@@ -360,7 +430,7 @@ static mp_obj_t network_cyw43_status(size_t n_args, const mp_obj_t *args) {
 
     if (n_args == 1) {
         // no arguments: return link status
-        return MP_OBJ_NEW_SMALL_INT(cyw43_tcpip_link_status(self->cyw, self->itf));
+        return MP_OBJ_NEW_SMALL_INT(network_cyw43_link_status(self));
     }
 
     // one argument: return status based on query parameter