diff --git a/roles/network/templates/network/dhcpcd.conf.j2 b/roles/network/templates/network/dhcpcd.conf.j2
index f1265b10c..ac139711a 100644
--- a/roles/network/templates/network/dhcpcd.conf.j2
+++ b/roles/network/templates/network/dhcpcd.conf.j2
@@ -42,16 +42,12 @@ slaac private
 # Always (try) to run DHCP client on RPi's Ethernet port, for in-field
 # "cablemodems" used by many non-technical operators, who want Zero-Hassle
 # Updates.  This means AVOIDING "denyinterfaces eth0" below:
-{% if is_raspbian and hostapd_enabled %}
-denyinterfaces{% if discovered_wireless_iface != "none" %} {{ discovered_wireless_iface }}{% endif %}
-{% elif is_raspbian %}
-#denyinterfaces{% if discovered_wireless_iface != "none" %} {{ discovered_wireless_iface }}{% endif %}
-{% else %}
-denyinterfaces{% if iiab_wireless_lan_iface is defined %} {{ iiab_wireless_lan_iface }}{% endif %}{% if iiab_wired_lan_iface is defined %} {{ iiab_wired_lan_iface }}{% endif %}
+{% if is_rpi and hostapd_enabled %}
+denyinterfaces ap0
+{% endif %}
+{% if iiab_wired_lan_iface is defined %}
+denyinterfaces {{ iiab_wired_lan_iface }}
 {% endif %}
-
-# FYI this 'denyinterfaces' line (here in /etc/dhcpcd.conf) is commented out by
-# /usr/bin/iiab-hotspot-off, and uncommented by /usr/bin/iiab-hotspot-on
 
 {% if dhcpcd_result == "enabled" and iiab_lan_iface != "none" %}
 interface {{ iiab_lan_iface }}