Set the site's WiFi centrally and roll it to nodes over the air. Each in-range node adds the network on its next config poll (it never drops the network it's currently using). For a brand-new node with no connectivity, bootstrap it once via local flash or the on-device QR setup.
configVersion increases, and a signed payload verifies on-device (Ed25519). Bad or unsigned config is ignored — thresholds/WiFi never change without a valid signature.