diff --git a/deploy/install_netwatch.sh b/deploy/install_netwatch.sh
index f2fa916..90aca49 100755
--- a/deploy/install_netwatch.sh
+++ b/deploy/install_netwatch.sh
@@ -6,9 +6,13 @@
 # Prerequisite: the "home-wifi" and "Hotspot" NetworkManager profiles must
 # already exist (see PLAN.md Phase 6). The optional "phone-hotspot" profile is
 # created through the Settings page.
+#
+# Since Phase 23+: all WiFi traffic (hotspot AP, phone client, home client)
+# runs on wlan1 (TP-Link T3U dongle). wlan0 (onboard) is disabled.
 set -euo pipefail
 
 REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WLAN=wlan1   # T3U dongle — change to wlan0 if reverting to onboard
 
 sudo systemctl stop yaris-uplink-wait.service 2>/dev/null || true
 sudo systemctl stop yaris-netwatch.timer yaris-netwatch.service 2>/dev/null || true
@@ -20,12 +24,25 @@ sudo install -m 644 "$REPO_DIR/deploy/yaris-hotspot-dns.conf" \
     /etc/NetworkManager/dnsmasq-shared.d/yaris-hotspot-dns.conf
 sudo install -m 755 "$REPO_DIR/deploy/90-yaris-uplink" \
     /etc/NetworkManager/dispatcher.d/90-yaris-uplink
-sudo nmcli connection modify Hotspot ipv4.method shared ipv4.addresses 10.42.0.1/24
+
+# Bind all connections to the T3U dongle (wlan1)
+sudo nmcli connection modify home-wifi connection.interface-name "$WLAN"
+sudo nmcli connection modify Hotspot \
+    connection.interface-name "$WLAN" \
+    ipv4.method shared \
+    ipv4.addresses 10.42.0.1/24
 if nmcli connection show phone-hotspot >/dev/null 2>&1; then
     sudo nmcli connection modify phone-hotspot \
-        ipv4.dhcp-send-hostname yes ipv4.dhcp-hostname yaris \
+        connection.interface-name "$WLAN" \
+        ipv4.dhcp-send-hostname yes \
+        ipv4.dhcp-hostname yaris \
         802-11-wireless.mtu 1400
 fi
+
+# Disable onboard wlan0 so it doesn't interfere
+sudo nmcli device disconnect wlan0 2>/dev/null || true
+sudo nmcli device set wlan0 managed no 2>/dev/null || true
+
 sudo cp "$REPO_DIR/deploy/yaris-netwatch.service" /etc/systemd/system/yaris-netwatch.service
 sudo cp "$REPO_DIR/deploy/yaris-netwatch.timer" /etc/systemd/system/yaris-netwatch.timer
 sudo cp "$REPO_DIR/deploy/yaris-uplink-wait.service" /etc/systemd/system/yaris-uplink-wait.service
diff --git a/deploy/yaris_uplink.py b/deploy/yaris_uplink.py
index 345b13d..a5bfb8a 100644
--- a/deploy/yaris_uplink.py
+++ b/deploy/yaris_uplink.py
@@ -12,7 +12,7 @@ import uuid
 PHONE_CONNECTION = "phone-hotspot"
 HOME_CONNECTION = "home-wifi"
 AP_CONNECTION = "Hotspot"
-INTERFACE = "wlan0"
+INTERFACE = "wlan1"       # TP-Link T3U dongle — all client + AP traffic
 STATUS_PATH = "/var/lib/yaris-obd/uplink-status.json"
 PHONE_KEYFILE = (
     "/etc/NetworkManager/system-connections/"