You could also use the dashboard API to change the password weekly with a timed script.
PUTUpdate the attributes of an SSID
The name of an SSID
Whether or not an SSID is enabled
The association control method for the SSID ('open', 'psk', 'open-with-radius', '8021x-meraki' or '8021x-radius')
The psk encryption mode for the SSID ('wpa', 'wep' or 'wpa-eap')
The passkey for the SSID. This param is only valid if the authMode is 'psk'
The types of WPA encryption. ('WPA1 and WPA2' or 'WPA2 only')
The type of splash page for the SSID ('None', 'Click-through splash page', 'Billing', 'Password-protected with Meraki RADIUS', 'Password-protected with custom RADIUS', 'Password-protected with Active Directory', 'Password-protected with LDAP', 'SMS authentication', 'Systems Manager Sentry', 'Facebook Wi-Fi', 'Google OAuth' or 'Sponsored guest'). This attribute is not supported for template children.
The RADIUS 802.1x servers to be used for authentication. This param is only valid if the authMode is 'open-with-radius' or '8021x-radius'
IP address of your RADIUS server
UDP port the RADIUS server listens on for Access-requests
RADIUS client shared secret
If true, Meraki devices will act as a RADIUS Dynamic Authorization Server and will respond to RADIUS Change-of-Authorization and Disconnect messages sent by the RADIUS server.
This policy determines how authentication requests should be handled in the event that all of the configured RADIUS servers are unreachable ('Deny access' or 'Allow access')
This policy determines which RADIUS server will be contacted first in an authentication attempt and the ordering of any necessary retry attempts ('Strict priority order' or 'Round robin')
Whether or not RADIUS accounting is enabled. This param is only valid if the authMode is 'open-with-radius' or '8021x-radius'
The RADIUS accounting 802.1x servers to be used for authentication. This param is only valid if the authMode is 'open-with-radius' or '8021x-radius' and radiusAccountingEnabled is 'true'
IP address to which the APs will send RADIUS accounting messages
Port on the RADIUS server that is listening for accounting messages
Shared key used to authenticate messages between the APs and RADIUS server
The client IP assignment mode ('NAT mode', 'Bridge mode', 'Layer 3 roaming', 'Layer 3 roaming with a concentrator' or 'VPN')
Direct trafic to use specific VLANs. This param is only valid with 'Bridge mode' and 'Layer 3 roaming'
The concentrator to use for 'Layer 3 roaming with a concentrator' or 'VPN'.
The VLAN ID used for VLAN tagging. This param is only valid with 'Layer 3 roaming with a concentrator' and 'VPN'
The default VLAN ID used for 'all other APs'. This param is only valid with 'Bridge mode' and 'Layer 3 roaming'
The list of tags and VLAN IDs used for VLAN tagging. This param is only valid with 'Bridge mode', 'Layer 3 roaming'
Comma-separated list of AP tags
Numerical identifier that is assigned to the VLAN
Allow access to a configurable list of IP ranges, which users may access prior to sign-on.
Specify your walled garden by entering space-separated addresses, ranges using CIDR notation, domain names, and domain wildcards (e.g. 192.168.1.1/24 192.168.37.10/32 www.yahoo.com *.google.com). Meraki's splash page is automatically included in your walled garden.
The minimum bitrate in Mbps. ('1', '2', '5.5', '6', '9', '11', '12', '18', '24', '36', '48' or '54')
The client-serving radio frequencies. ('Dual band operation', '5 GHz band only' or 'Dual band operation with Band Steering')
The upload bandwidth limit in Kbps. (0 represents no limit.)
The download bandwidth limit in Kbps. (0 represents no limit.)