diff --git a/include/config.h b/include/config.h
index 12020e5..657ee1e 100644
--- a/include/config.h
+++ b/include/config.h
@@ -36,11 +36,10 @@
 #define JAM_FREQ_DEV_KHZ 380.0f        // default passed to begin(); per-radio deviation applied after init
 #define JAM_RX_BW_KHZ    812.0f        // wide RX BW for begin()
 // GDO0 toggle rate during jam.
-// 500 kHz (2 µs period = 480 ESP32-S3 cycles) leaves ~60% headroom over ISR overhead (~200 cycles),
-// preventing the interrupt storm / WDT boot-loop that 1 MHz caused (240 cycles < ISR overhead).
-// OOK on R1: ±500 kHz main lobe around 315 MHz + strong sidebands covering 314–316 MHz.
-// 2-FSK 380 kHz dev on R2: tone pair 433.54/434.30 MHz + 250 kHz sideband spread, covering 433–433.92 MHz band.
-#define JAM_LFSR_KEY_HZ    500000
+// Restored to 100 kHz (10 µs period). Faster rates (500 kHz, 1 MHz) caused WDT boot-loops
+// because ESP32-S3's gpio_set_level() calls take ~80 cycles each, overflowing the ISR budget.
+// 100 kHz gives plenty of LFSR noise (AM sidebands at ±100, ±300, ±500 kHz) without crashing.
+#define JAM_LFSR_KEY_HZ    100000
 
 // Fixed dual-carrier jamming: each radio holds one frequency at full TX power (TI CC1101 freq + deviation).
 // Many NA ~315 MHz RKE remotes are ASK/OOK (see TI CC1101 datasheet MDMCFG2.MOD_FORMAT). Jam path uses OOK on