You try to include a Z-Wave lock, sensor, or switch on your hub. The hub goes into inclusion mode. You trigger the device. The hub does see something, but then reports inclusion failed. You repeat. Same result every time. The device shows the inclusion LED briefly and then gives up. This is one of the most frustrating Z-Wave behaviors and it is almost always about the inclusion security mismatch.
Z-Wave inclusion has three security levels
Z-Wave devices can join a network at one of three security levels: non-secure (no encryption), S0 (legacy encryption), and S2 (current encryption with three sub-levels: unauthenticated, authenticated, and access control). The level the device requires must match what the hub offers during inclusion.
Locks and garage door controllers typically require S2 access control. Sensors and switches typically support S0 or S2 unauthenticated. Older devices may only support non-secure inclusion.
If your hub is set to attempt the wrong security level, inclusion will fail. The hub thinks it succeeded at the network layer but the encryption negotiation never completes.
Check what the device requires
Look up the device’s Z-Wave certification on the Silicon Labs Z-Wave database. Search for the model and read the supported security classes. This tells you what the device expects.
If you do not have access to the database, the device’s manual usually mentions the security requirement, often in language like “requires S2 authenticated inclusion” or “include using SmartStart”. If the manual says nothing about security, it is probably a non-secure or S0 device.
S2 inclusion needs a DSK
S2 authenticated and access control inclusions need a Device Specific Key (DSK), which is a 5-digit number printed on a sticker on the device. During inclusion, the hub prompts for the DSK, you enter it, and the encryption handshake completes.
If you do not enter the DSK, or you enter the wrong DSK, inclusion fails silently. The hub may not even tell you that a DSK was expected. You just see the failure.
For a lock or garage door controller, look for a sticker on the back of the device. The DSK is usually labeled DSK or PIN and is 5 digits. Some devices have a longer DSK; only the first 5 digits are typed during inclusion.
SmartStart vs traditional inclusion
Modern Z-Wave devices often support SmartStart, where you scan a QR code with the hub app and the device is added when you power it on. SmartStart bypasses many of the manual inclusion issues and is more reliable.
If your hub supports SmartStart (SmartThings, Hubitat, and Home Assistant all do), try SmartStart first. Scan the QR code, then power-cycle the device. It should be included automatically within a minute.
The proximity issue
Z-Wave inclusion is sensitive to distance. The device should be within 6 feet of the hub during inclusion. Once included, it joins the mesh and can be moved to its final location.
If you are trying to include a wired-in switch that you cannot move, the inclusion is much harder. The fix is to move the hub temporarily, include the switch, then move the hub back. The inclusion happens in seconds; the device remains in the network even after the hub moves.
The previously-included device
If the device was previously included on another hub (or even your own hub before a reset), it cannot be re-included until it is excluded first. Z-Wave devices remember their home ID and refuse to join a network with a different ID without being explicitly excluded.
Run an exclusion on your hub first. The hub goes into exclusion mode (sometimes called “general exclusion” or “any exclusion”), you trigger the device’s inclusion button, and the device is excluded from whatever network it was on. After exclusion, retry inclusion.
If you do not have access to the original hub, every hub can run exclusion in this “general” mode that exclude devices from any network, not just its own. Your current hub can exclude devices that were previously paired to someone else’s hub.
Repeated inclusion failures
If inclusion fails repeatedly even after exclusion and clean attempts, the device may be in a state where its internal include counter has incremented past a manufacturer-set limit. Power-cycle the device and wait 30 seconds before retrying. Most devices reset their inclusion counter on power cycle.
If power cycling does not help, the device firmware may be corrupted. Some Z-Wave devices have an “Over The Air” update capability that can refresh the firmware once included on any hub. The catch: you have to get it included somehow first. Try a different hub if you have access to one.
Mesh quality during inclusion
If your existing Z-Wave mesh is in poor shape, inclusion of new devices may fail because the hub cannot find a clean route during the inclusion handshake. Run a Z-Wave network heal before attempting inclusion. The heal takes 20 to 60 minutes and rebuilds the routing tables of all included devices. After the heal completes, inclusion of new devices is more reliable.
When the device is faulty
If you have ruled out security mismatch, DSK errors, proximity, previous network membership, and mesh quality, and the device still fails to include, the Z-Wave radio in the device may be defective. Try a different known-good Z-Wave device on the same hub to confirm the hub is fine. If the other device includes successfully, the original device is the problem.
Why DSK QR codes on locks are different from regular Matter QR codes
The DSK QR code on a Z-Wave lock looks identical to the Matter QR codes you see on other accessories, but it serves a different purpose. The Z-Wave DSK is used during inclusion only and is not reusable. Once the lock is included, the DSK is consumed. If you exclude and re-include, the lock has the same DSK but the inclusion event treats it as a fresh ceremony.
This matters because users sometimes assume the QR code is a generic device identifier and try to scan it for non-inclusion purposes. It will not work for that. For the broader picture of how locks pair across ecosystems, see our smart lock pairing guide.
