diff --git a/internal/outpost/radius/eap/README.md b/internal/outpost/radius/eap/README.md
index ec408fcafe..37b8865c20 100644
--- a/internal/outpost/radius/eap/README.md
+++ b/internal/outpost/radius/eap/README.md
@@ -23,7 +23,7 @@ network={
     identity="foo"
     password="bar"
     ca_cert="ca.pem"
-    phase2="eapauth=MSCHAPV2"
+    phase2="auth=MSCHAPV2"
 }
 ```
 
diff --git a/internal/outpost/radius/eap/handler.go b/internal/outpost/radius/eap/handler.go
index ba841647b6..98296a8478 100644
--- a/internal/outpost/radius/eap/handler.go
+++ b/internal/outpost/radius/eap/handler.go
@@ -102,9 +102,9 @@ func (p *Packet) handleEAP(pp protocol.Payload, stm protocol.StateManager, paren
 		return p.handleEAP(pp, stm, nil)
 	}
 
-	if n, ok := p.eap.Payload.(*legacy_nak.Payload); ok {
+	if n, ok := pp.(*eap.Payload).Payload.(*legacy_nak.Payload); ok {
 		log.WithField("desired", n.DesiredType).Debug("Root-EAP: received NAK, trying next protocol")
-		p.eap.Payload = nil
+		pp.(*eap.Payload).Payload = nil
 		return next()
 	}