diff --git a/luci-app-wwand/Makefile b/luci-app-wwand/Makefile
index 5cbfb555..ff7935c6 100644
--- a/luci-app-wwand/Makefile
+++ b/luci-app-wwand/Makefile
@@ -15,11 +15,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-wwand
-PKG_RELEASE:=12
+PKG_RELEASE:=13
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/ddimension/luci-app-wwand.git
-PKG_SOURCE_VERSION:=6ae65a7ec66eaa66cbe434f7166ad18f3fb448ac
+PKG_SOURCE_VERSION:=e519a102fe0e4849323781fcb2bdf1cd8946eaf7
 PKG_SOURCE_DATE:=2026-09-07
 PKG_MIRROR_HASH:=skip
 
diff --git a/mptcp/Makefile b/mptcp/Makefile
index a7504b5b..1121a694 100644
--- a/mptcp/Makefile
+++ b/mptcp/Makefile
@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mptcp
 PKG_VERSION:=6.1
-PKG_RELEASE:=13
+PKG_RELEASE:=14
 
 PKG_MAINTAINER:=Ycarus (Yannick Chabanois) <ycarus@zugaina.org>
 PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
diff --git a/mptcp/files/etc/hotplug.d/iface/30-mptcp b/mptcp/files/etc/hotplug.d/iface/30-mptcp
index f9dc4581..7492de4d 100644
--- a/mptcp/files/etc/hotplug.d/iface/30-mptcp
+++ b/mptcp/files/etc/hotplug.d/iface/30-mptcp
@@ -22,17 +22,29 @@ case "$INTERFACE" in
 esac
 MULTIPATH="$(uci -q get network.$MP_INTERFACE.multipath)"
 
+# Re-add the endpoint in the mode the interface is configured for, not always
+# as an active subflow: a WAN set to "backup" was promoted to a normal subflow
+# on every DHCP renew / RA refresh of its interface. "master" has no endpoint
+# flag of its own, it is an active subflow like "on" (see mptcp's init script).
+# The explicit endpoint id keeps the id of a WAN stable across those events, so
+# the peer can still pin traffic to it by the subflow remote_id.
+case "$MULTIPATH" in
+	backup)  MULTIPATH_MODE="backup" ;;
+	*)       MULTIPATH_MODE="on" ;;
+esac
+MULTIPATH_ID="$(uci -q get network.$MP_INTERFACE.metric)"
+
 if [ "$ACTION" = ifupdate -a -n "$IFUPDATE_ADDRESSES" ] && [ -n "$MULTIPATH" ] && [ "$MULTIPATH" != "off" ]; then
 	logger -t "mptcp" "New IP ($IFUPDATE_ADDRESSES) for $INTERFACE ($DEVICE)"
-	multipath $DEVICE off 2>&1 >/dev/null || exit 0
-	multipath $DEVICE on 2>&1 >/dev/null || exit 0
+	multipath $DEVICE off >/dev/null 2>&1 || exit 0
+	multipath $DEVICE $MULTIPATH_MODE $MULTIPATH_ID >/dev/null 2>&1 || exit 0
 elif [ "$ACTION" = ifupdate ] && [ -n "$MULTIPATH" ] && [ "$MULTIPATH" != "off" ]; then
 	logger -t "mptcp" "Update of $INTERFACE ($DEVICE)"
-	multipath $DEVICE off 2>&1 >/dev/null || exit 0
-	multipath $DEVICE on 2>&1 >/dev/null || exit 0
+	multipath $DEVICE off >/dev/null 2>&1 || exit 0
+	multipath $DEVICE $MULTIPATH_MODE $MULTIPATH_ID >/dev/null 2>&1 || exit 0
 elif [ "$ACTION" = ifup -o "$ACTION" = iflink  -o "$ACTION" = link-up ] && [ -z "$(echo $DEVICE | grep oip | grep gre)" ] && [ -n "$MULTIPATH" ] && [ "$MULTIPATH" != "off" ]; then
 	logger -t "mptcp" "Reloading mptcp config due to $ACTION of $INTERFACE ($DEVICE)"
 	/etc/init.d/mptcp reload "$DEVICE" >/dev/null || exit 0
 elif [ "$ACTION" = ifdown -o "$ACTION" = link-down ]; then
-	multipath $DEVICE off 2>&1 >/dev/null || exit 0
+	multipath $DEVICE off >/dev/null 2>&1 || exit 0
 fi
diff --git a/mptcp/files/etc/init.d/mptcp b/mptcp/files/etc/init.d/mptcp
index 3efee4d3..8b6e370b 100755
--- a/mptcp/files/etc/init.d/mptcp
+++ b/mptcp/files/etc/init.d/mptcp
@@ -182,7 +182,18 @@ interface_max_metric() {
 		loopback)
 			;;
 		*)
-			config_get metric "$config" ip4table
+			# Called with the openmptcprouter config loaded, where the routing
+			# table id lives in "metric" (network.<iface>.ip4table is the same
+			# value in the network config): reading ip4table here always got an
+			# empty string, so every WAN raised a shell "out of range" error and
+			# count stayed 0. Interfaces added afterwards then restarted metric
+			# allocation from 1 in interface_multipath_settings and collided with
+			# the routing tables, route metrics and MPTCP endpoint ids of the
+			# existing ones.
+			config_get metric "$config" metric
+			case "$metric" in
+				''|*[!0-9]*) return 0 ;;
+			esac
 			if [ "$metric" -gt "$count" ] && [ "$metric" -lt "1000" ]; then
 				count=$metric
 			fi
@@ -208,6 +219,13 @@ _root_qdisc_managed_elsewhere() {
 		[ "$(uci -q get sqm.${sec}.enabled)" = "1" ] && return 0
 	done
 	[ "$(uci -q get qos.${config}.enabled)" = "1" ] && return 0
+	# omr-quota shapes an interface whose quota is exceeded with a tbf root
+	# qdisc (throttle action, daily-budget speed limit); nothing else in OMR
+	# installs tbf. Replacing it with fq lifted the quota's speed limit until
+	# the daemon's next poll -- on every ifup hotplug / tracker status change.
+	case "$(tc qdisc show dev "$dev" root 2>/dev/null)" in
+		"qdisc tbf "*) return 0 ;;
+	esac
 	return 1
 }
 
@@ -267,8 +285,15 @@ interface_multipath_settings() {
 		done
 	}
 	[ "$mode" = "" ] && {
+		# Migration path for configs that only ever had the mode in the
+		# openmptcprouter copy. Log it: it also fires when something dropped
+		# network.<iface>.multipath behind the user's back, in which case the
+		# interface silently comes back in its previous mode (#4368).
 		mode="$(uci -q get openmptcprouter.${config}.multipath)"
-		[ -n "$mode" ] && uci -q set network.${config}.multipath="$mode"
+		[ -n "$mode" ] && {
+			logger -t "MPTCP" "No multipath setting for $config, restoring $mode from openmptcprouter config"
+			uci -q set network.${config}.multipath="$mode"
+		}
 	}
 	[ "$mode" = "" ] && {
 		[ "$config" = "lan" ] && mode="off"
diff --git a/mptcp/files/etc/uci-defaults/mptcp-defaults b/mptcp/files/etc/uci-defaults/mptcp-defaults
old mode 100644
new mode 100755
index 6fb51fe4..37fb1577
--- a/mptcp/files/etc/uci-defaults/mptcp-defaults
+++ b/mptcp/files/etc/uci-defaults/mptcp-defaults
@@ -1,12 +1,4 @@
 #!/bin/sh
-[ ! -f "/usr/share/ucitrack/luci-app-mptcp.json" ] && {
-    cat > /usr/share/ucitrack/luci-app-mptcp.json << EEOF
-{
-    "config": "mptcp",
-    "init": "mptcp"
-}
-EEOF
-}
 # Upstream (6.x) MPTCP exposes the scheduler list; the out-of-tree v0.9x
 # stack (blest/roundrobin/redundant/ecf) does not. Pick a default the running
 # kernel accepts: 'blest' on 6.x is rejected by the sysctl and /etc/init.d/mptcp
@@ -110,18 +102,10 @@ if [ "$(uci -q get network.globals.mptcp_add_addr_accepted)" = "1" ]; then
 	EOF
 fi
 
-uci -q batch <<-EOF >/dev/null
-    delete ucitrack.@mptcp[-1]
-    add ucitrack mptcp
-    set ucitrack.@mptcp[-1].init=mptcp
-    commit ucitrack
-EOF
-if [ "$(uci -q get ucitrack.@network[-1].affects | grep mptcp)" = "" ]; then
-	uci -q batch <<-EOF >/dev/null
-	    add_list ucitrack.@network[-1].affects=mptcp
-	    commit ucitrack
-	EOF
-fi
+# The pre-procd config-change registration was dropped from here: OMR images
+# ship no /etc/config/ucitrack, so it failed silently anyway, and the init
+# declares procd_add_reload_trigger "network", which is what actually reloads
+# mptcp when the network config changes.
 if [ "$(uci -q get network.globals.mptcp_close_timeout)" = "" ]; then
 	uci -q batch <<-EOF >/dev/null
 	set network.globals.mptcp_close_timeout=60
diff --git a/wwand/Makefile b/wwand/Makefile
index 13b03d10..2253c805 100644
--- a/wwand/Makefile
+++ b/wwand/Makefile
@@ -43,11 +43,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wwand
-PKG_RELEASE:=26
+PKG_RELEASE:=27
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/ddimension/wwand.git
-PKG_SOURCE_VERSION:=41954da43ddbfcc0260a40801099413217a5ce93
+PKG_SOURCE_VERSION:=2961940abc827ccf644091eeabde91a1578d344d
 PKG_SOURCE_DATE:=2026-09-07
 PKG_MIRROR_HASH:=skip