diff --git a/main/main.c b/main/main.c
index c072e34..58abfd4 100644
--- a/main/main.c
+++ b/main/main.c
@@ -19,16 +19,17 @@ void app_main(void)
 
     ESP_ERROR_CHECK(spi_bus_manager_init());
     ESP_ERROR_CHECK(storage_manager_init());
-    ESP_ERROR_CHECK(display_manager_init());
 
-    /* RFID is not fatal: the reader may be unpowered, unwired, or a clone
-     * that needs a slower SPI clock. Continue booting so the display, SoftAP
-     * and web pairing all stay usable; scanning is simply unavailable. */
+    /* RFID comes BEFORE the display: the panel's init traffic plus the strap
+     * load on GPIO15/GPIO2 can glitch the shared SPI bus and make the MFRC522
+     * self-test flake. Starting the reader on a quiet bus yields a clean test. */
     esp_err_t ret = rfid_manager_init();
     if (ret != ESP_OK || rfid_manager_start() != ESP_OK) {
         ESP_LOGW(TAG, "RFID unavailable (%s) - continuing without card scanning", esp_err_to_name(ret));
     }
 
+    ESP_ERROR_CHECK(display_manager_init());
+
     /* Networking is not fatal either: without it the device runs offline
      * (cached cards + AP pairing). Init failures are logged, boot continues. */
     ret = wifi_manager_init();
diff --git a/main/rfid_manager.c b/main/rfid_manager.c
index e47b585..b9ac4fc 100644
--- a/main/rfid_manager.c
+++ b/main/rfid_manager.c
@@ -22,9 +22,9 @@ static const char *TAG = "rfid";
 #define RC522_TASK_PRIORITY    (4)
 
 /* Conservative clock for MFRC522 clones. If the FIFO self-test still
- * reports a mismatch at boot, lower this further (e.g. 1000000) or check
+ * reports a mismatch error, lower further (e.g. 1000000) or check
  * power/wiring. Many clone readers glitch at 4MHz on a shared bus. */
-#define RC522_SPI_CLK_HZ (2000000)
+#define RC522_SPI_CLK_HZ (1000000)
 #define RC522_START_ATTEMPTS (3)
 
 static rc522_driver_handle_t s_driver;
diff --git a/main/web_server.c b/main/web_server.c
index 340db8f..e5bbc5a 100644
--- a/main/web_server.c
+++ b/main/web_server.c
@@ -266,14 +266,23 @@ esp_err_t web_server_start(void)
         .netmask = { .addr = ESP_IP4TOADDR(255, 255, 255, 0) },
         .gw = { .addr = ESP_IP4TOADDR(192, 168, 4, 1) },
     };
-    ESP_ERROR_CHECK(esp_netif_set_ip_info(ap, &ip_info));
+    /* The AP netif has DHCP running by default; stop it before assigning a
+     * static IP, otherwise esp_netif_set_ip_info fails with
+     * ESP_ERR_ESP_NETIF_DHCP_NOT_STOPPED. */
+    esp_netif_dhcps_stop(ap);
+    ret = esp_netif_set_ip_info(ap, &ip_info);
+    if (ret != ESP_OK) {
+        ESP_LOGE(TAG, "set AP IP failed: %s", esp_err_to_name(ret));
+        return ret;
+    }
 
     ret = esp_wifi_start();
     if (ret != ESP_OK) {
         ESP_LOGE(TAG, "wifi start (APSTA) failed: %s", esp_err_to_name(ret));
         return ret;
     }
-    ESP_ERROR_CHECK(esp_netif_dhcps_start(ap));
+
+    (void)esp_netif_dhcps_start(ap); /* harmless if someone else started it */
 
     httpd_config_t config = HTTPD_DEFAULT_CONFIG();
     config.stack_size = 6 * 1024;