Thread networks periodically rotate security keys to limit exposure if one packet leaks. Border routers must distribute the new key to all children before the old key expires. When synchronization fails, part of your mesh still encrypts with yesterday’s key while routers speak today’s — accessories drop in waves, often right after a hub firmware update or power outage.
This is not something you fix with a phone reboot alone. It is a mesh-wide credentials problem that looks like random unresponsiveness.
Signs key rotation failed
Many devices offline at once, not one bad bulb. Recovery after hub reboot lasts minutes, then failures return on a schedule.
Problem began after border router firmware updates across Apple, Google, or Home Assistant OTBR within the same week.
New devices commission fine while older Thread children never return — they may still hold pre-rotation material.
Diagnostics mention security errors, MIC failures, or attach failures without obvious range issues.
What to do — and what not to do
Do not import unofficial “key reset” files into OTBR or Home Assistant. Do not disable encryption or downgrade firmware without vendor guidance.
Do back up Home Assistant and document hub versions before coordinated updates next time.
Recovery path for homeowners
Unify updates: put every border router on current stable firmware within one maintenance window. Mixed generations are a common rotation failure mode.
Sequential hub restart: main router, then each border router once, waiting ten minutes between ecosystem families. Let rotation complete before re-adding devices.
Shrink the mesh temporarily: power down secondary border routers until primaries stabilize, then reintroduce one hub per day.
Recommission stragglers: devices still offline after twenty-four hours of stable hubs need OEM factory reset and join again near a powered router — not mass resets of healthy gear.
Single fabric focus: troubleshoot Apple-owned Thread separately from a Google-owned fabric if you run both; rotation state does not cross fabrics.
When to call vendor support
Whole-home failures on a single-vendor hub with current firmware deserve Apple, Google, Samsung, or Aqara support tickets with timestamps around the first dropout.
Enterprise VLAN or IPv6-disabled networks can block key distribution — network design help may be required.
Verify rotation succeeded
After recovery, no devices should drop on a predictable hourly pattern. Power-cycle one border router during the day; sleepy and mains devices should reattach within fifteen minutes without manual re-pair. Schedule automations across floors for forty-eight hours clean.