diff --git a/main/webUI.cpp b/main/webUI.cpp
index 134b09c..a19b8a4 100644
--- a/main/webUI.cpp
+++ b/main/webUI.cpp
@@ -898,12 +898,13 @@ void handleCG() {
         // HTML maxlength is client-side only — a direct POST can deliver any
         // length. Reject anything that would not fit (and leave dst
         // NUL-terminated) before copying into the fixed-size buffer.
-        const char* gp = server.arg("gp").c_str();
+        // Keep the String alive: server.arg() returns a temporary.
+        String gp = server.arg("gp");
         // ota_pass is extern char[] in this TU; size is parameters_size.
-        if (strlen(gp) >= parameters_size) {
+        if (gp.length() >= parameters_size) {
           THEENGS_LOG_WARNING(F("[WebUI] gateway password too long, ignoring" CR));
         } else {
-          strcpy(ota_pass, gp);
+          strcpy(ota_pass, gp.c_str());
           pwUpdate = true;
         }
       }