diff --git a/src/main.cpp b/src/main.cpp
index 2f1de85..ed8c9fa 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -112,12 +112,6 @@ static void handle_connect() {
     server.send_P(200, "text/html", CONNECTING_HTML);
 }
 
-// Captive portal detection endpoints — all redirect to portal
-static void handle_captive() {
-    server.sendHeader("Location", "http://" AP_IP "/");
-    server.send(302, "text/plain", "");
-}
-
 // ── WiFi provisioning ─────────────────────────────────────────────────────────
 
 static void enter_provisioning(const String& mac, bool retry = false) {
@@ -130,23 +124,37 @@ static void enter_provisioning(const String& mac, bool retry = false) {
 
     Serial.println(retry ? "AP (retry): " + apSsid : "AP: " + apSsid);
 
+    // Register handlers BEFORE softAP comes up so a fast-joining iOS
+    // device that probes immediately never hits a connection-refused.
+    // iOS CNA probes the moment DHCP completes; if the first probe
+    // fails the network sometimes gets marked as broken and the
+    // captive banner never fires.
+    //
+    // Every CNA probe path (Apple, Android, Windows) is routed straight
+    // to handle_root — i.e. 200 OK with the portal HTML body. We used
+    // to 302-redirect to "/", which works on a desktop browser but is
+    // unreliable from the iOS lock-screen-camera join path: iOS
+    // occasionally treats the redirect as "internet works" and skips
+    // the captive banner. A 200 with a non-"Success" body is the
+    // canonical signal that this is a captive network.
+    server.on("/",                          HTTP_GET,  handle_root);
+    server.on("/connect",                   HTTP_POST, handle_connect);
+    server.on("/hotspot-detect.html",       handle_root);  // iOS / macOS
+    server.on("/library/test/success.html", handle_root);  // iOS legacy
+    server.on("/generate_204",              handle_root);  // Android
+    server.on("/gen_204",                   handle_root);  // Android variant
+    server.on("/ncsi.txt",                  handle_root);  // Windows
+    server.on("/connecttest.txt",           handle_root);  // Windows 10+
+    server.onNotFound(handle_root);
+
     WiFi.disconnect(true);
     WiFi.mode(WIFI_AP);
     WiFi.softAP(apSsid.c_str());
-    delay(500);
 
-    // Redirect all DNS to this device
+    server.begin();
     dns.setErrorReplyCode(DNSReplyCode::NoError);
     dns.start(53, "*", WiFi.softAPIP());
 
-    server.on("/",                     HTTP_GET,  handle_root);
-    server.on("/connect",              HTTP_POST, handle_connect);
-    server.on("/generate_204",         handle_captive);
-    server.on("/hotspot-detect.html",  handle_captive);
-    server.on("/ncsi.txt",             handle_captive);
-    server.onNotFound(handle_root);
-    server.begin();
-
     // On retry, repaint with red accents + "Connection Failed — try again"
     // label so the user has a clear visual signal that their last credential
     // entry didn't work. On first entry, paint the standard yellow Step 1/2.