diff --git a/docs/network-mobile/helium-plus-guides/helium-plus-mikrotik.mdx b/docs/network-mobile/helium-plus-guides/helium-plus-mikrotik.mdx
index 11f2fe46e..6bf1527eb 100644
--- a/docs/network-mobile/helium-plus-guides/helium-plus-mikrotik.mdx
+++ b/docs/network-mobile/helium-plus-guides/helium-plus-mikrotik.mdx
@@ -135,7 +135,10 @@ the NAS-ID provided during Helium Plus onboarding.
 
 #### Interworking Tab
 
-Fill in as shown:
+The Interworking (Passpoint / Hotspot 2.0) profile is what advertises the Helium
+realms and carrier network identifiers over ANQP. If this profile is incomplete, handsets
+will see the SSID but silently fail to associate — so make sure the domain names, NAI realms,
+and 3GPP cellular network information below are all present.
 
 <figure className="screensnippet-wrapper">
   <img
@@ -145,6 +148,78 @@ Fill in as shown:
   />
 </figure>
 
+Fill in the profile as follows:
+
+| Field                       | Value                                                     |
+| --------------------------- | --------------------------------------------------------- |
+| **ANQP Domain ID**          | `0`                                                       |
+| **Network Type**            | `2` (chargeable public network), access to internet       |
+| **Operator Name**           | `Helium-Operator` (language code `eng`)                   |
+| **IP Address Type**         | IPv4 available (`ip-type ipv4 2`), IPv6 not available      |
+| **Domain Names**            | `freedomfi.com`, `hellohelium.com`                        |
+
+**NAI Realms** — the Helium-issued credentials use EAP-TLS (`13`); the SIM-based carrier
+realms use EAP-AKA (`23`):
+
+| Realm                                  | EAP method   |
+| -------------------------------------- | ------------ |
+| `freedomfi.com`                        | `13` EAP-TLS |
+| `hellohelium.com`                      | `13` EAP-TLS |
+| `wlan.mnc260.mcc310.3gppnetwork.org`   | `23` EAP-AKA |
+| `wlan.mnc530.mcc312.3gppnetwork.org`   | `23` EAP-AKA |
+| `wlan.mnc120.mcc310.3gppnetwork.org`   | `23` EAP-AKA |
+| `wlan.mnc240.mcc310.3gppnetwork.org`   | `23` EAP-AKA |
+
+**3GPP Cellular Network Information** (PLMN, MCC / MNC):
+
+| MCC   | MNC   |
+| ----- | ----- |
+| `310` | `410` |
+| `310` | `280` |
+| `310` | `150` |
+| `313` | `100` |
+
+##### Equivalent RouterOS CLI
+
+The same profile can be applied from the CLI. This is a known-good Helium Passpoint profile —
+substitute your onboarding `NAS-Identifier` on the `aaa attribute` line:
+
+```
+hotspot profile Helium-profile
+hotspot profile Helium-profile anqp-domain-id 0
+hotspot profile Helium-profile network-type 2 access-internet
+hotspot profile Helium-profile operator-name Helium-Operator language-code eng
+hotspot profile Helium-profile ip-type ipv4 2 ipv6 0
+hotspot profile Helium-profile domain-name freedomfi.com
+hotspot profile Helium-profile domain-name hellohelium.com
+hotspot profile Helium-profile nai-realm freedomfi.com encoding-type 0
+hotspot profile Helium-profile nai-realm freedomfi.com eap-method 13
+hotspot profile Helium-profile nai-realm hellohelium.com encoding-type 0
+hotspot profile Helium-profile nai-realm hellohelium.com eap-method 13
+hotspot profile Helium-profile nai-realm wlan.mnc260.mcc310.3gppnetwork.org encoding-type 0
+hotspot profile Helium-profile nai-realm wlan.mnc260.mcc310.3gppnetwork.org eap-method 23
+hotspot profile Helium-profile nai-realm wlan.mnc530.mcc312.3gppnetwork.org encoding-type 0
+hotspot profile Helium-profile nai-realm wlan.mnc530.mcc312.3gppnetwork.org eap-method 23
+hotspot profile Helium-profile nai-realm wlan.mnc120.mcc310.3gppnetwork.org encoding-type 0
+hotspot profile Helium-profile nai-realm wlan.mnc120.mcc310.3gppnetwork.org eap-method 23
+hotspot profile Helium-profile nai-realm wlan.mnc240.mcc310.3gppnetwork.org encoding-type 0
+hotspot profile Helium-profile nai-realm wlan.mnc240.mcc310.3gppnetwork.org eap-method 23
+hotspot profile Helium-profile 3gpp-plmn mcc 310 mnc 410
+hotspot profile Helium-profile 3gpp-plmn mcc 310 mnc 280
+hotspot profile Helium-profile 3gpp-plmn mcc 310 mnc 150
+hotspot profile Helium-profile 3gpp-plmn mcc 313 mnc 100
+security-object Helium security protocol-suite wpa3-aes-8021x
+aaa attribute NAS-Identifier <your-nas-id>
+ssid Helium hotspot-profile Helium-profile
+save configuration
+```
+
+:::note Native RadSec + Orion Wi-Fi
+Newer RouterOS releases support RadSec natively (removing the need for the RadSecProxy
+container in step 1) and document the matching Passpoint / Orion Wi-Fi setup. See MikroTik's
+[Interworking Profiles — Configuration guide using native RadSec and Orion Wi-Fi](https://help.mikrotik.com/docs/spaces/ROS/pages/7962628/Interworking+Profiles#InterworkingProfiles-ConfigurationguideusingnativeRadSecandOrionWifi).
+:::
+
 ### 4. Attach the Profile to an Interface
 
 Assign the configuration profile to the desired WiFi interface. Either click **New** (this will