diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index 125f52e13..8b2979c6d 100644
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -470,9 +470,24 @@ static struct wpa_ssid * wpa_scan_res_match(struct wpa_supplicant *wpa_s,
 		   " wps" : "");
 
 	e = wpa_blacklist_get(wpa_s, bss->bssid);
-	if (e && e->count > 1) {
-		wpa_printf(MSG_DEBUG, "   skip - blacklisted");
-		return 0;
+	if (e) {
+		int limit = 1;
+		if (wpa_supplicant_enabled_networks(wpa_s->conf) == 1) {
+			/*
+			 * When only a single network is enabled, we can
+			 * trigger blacklisting on the first failure. This
+			 * should not be done with multiple enabled networks to
+			 * avoid getting forced to move into a worse ESS on
+			 * single error if there are no other BSSes of the
+			 * current ESS.
+			 */
+			limit = 0;
+		}
+		if (e->count > limit) {
+			wpa_printf(MSG_DEBUG, "   skip - blacklisted "
+				   "(count=%d limit=%d)", e->count, limit);
+			return 0;
+		}
 	}
 
 	if (ssid_len == 0) {
diff --git a/wpa_supplicant/scan.c b/wpa_supplicant/scan.c
index 68c8ce053..074d75ba6 100644
--- a/wpa_supplicant/scan.c
+++ b/wpa_supplicant/scan.c
@@ -79,12 +79,13 @@ static int wpas_wps_in_use(struct wpa_config *conf,
 int wpa_supplicant_enabled_networks(struct wpa_config *conf)
 {
 	struct wpa_ssid *ssid = conf->ssid;
+	int count = 0;
 	while (ssid) {
 		if (!ssid->disabled)
-			return 1;
+			count++;
 		ssid = ssid->next;
 	}
-	return 0;
+	return count;
 }