NetworkManager 1.58.1 fixes automatic connection to SAE/WPA3 networks for profiles using key-mgmt=wpa-psk. That precise scope is more useful than assuming every modern Wi-Fi client is affected or that every failure after suspend has the same cause.
Match the symptom to the documented fix
The 1.58.1 source tag's NEWS file lists the SAE auto-connect correction. The tagged build definition confirms the version. This is an automatic-connection fix for a specified profile setting, not evidence that manual connection always worked or that all WPA3 deployments were broken.
Start by identifying the installed package version, the affected profile and the Wi-Fi security configuration. A distribution can backport a correction without adopting the same upstream version number. Conversely, reading the release note does not prove that the running daemon has been replaced by the newly installed package.
Three different failure stages
An original diagnostic worksheet separates association/authentication, IP address and route, and name resolution. Record which stage succeeds before changing settings. For example, if the machine reconnects to the access point and receives an address but cannot resolve a hostname, “Wi-Fi did not reconnect” hides the relevant evidence.
The point release also corrects nameserver handling and forwarding of non-default DNS ports to systemd-resolved. Those DNS changes do not establish a fix for every authentication failure, just as the SAE correction does not repair every DNS configuration.
Use the profile's actual key-management setting and the connection log from the failed attempt. Keep passwords, enterprise identities and other private fields out of any shared diagnostic excerpt. Reproducing the same failure before and after the distribution's update is more informative than changing the access point, profile and driver simultaneously.
Private 802.1X profiles need a separate check
The release notes say private connections with user permissions can no longer use ca-path or phase2-ca-path; activation fails for those settings. This is not merely a warning about unusual paths. The documented alternatives are ca-cert or system-ca-certs, selected according to the organization's intended certificate trust configuration.
Do not solve the failure by disabling server-certificate validation. A connection that succeeds by trusting the wrong server has not met the original authentication requirement. Keep this enterprise 802.1X issue separate from personal-network SAE behavior.
Moving from an older branch is a larger change
The 1.58 overview covers the broader release, including the removal of the dhclient backend. A move from 1.56 is therefore not just installation of the SAE point fix. Review the distribution's supported update path and the settings it actually uses. PeopleAreGeek has not reproduced the wireless regression on a physical access point; this is a source-based diagnostic guide.
Verify tag and meson version; narrow SAE auto-connect scope, correct private 802.1X rejection behavior, and separate association, routing and DNS.