diff --git a/src/hci.c b/src/hci.c
index 6e9bae02b..6ab232d9c 100644
--- a/src/hci.c
+++ b/src/hci.c
@@ -44,7 +44,8 @@
 #include "config.h"
 
 #include "hci.h"
-
+#include "gap.h"
+ 
 #include <stdarg.h>
 #include <string.h>
 #include <stdio.h>
@@ -639,6 +640,11 @@ static void event_handler(uint8_t *packet, int size){
             
         case HCI_EVENT_PIN_CODE_REQUEST:
             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], RECV_PIN_CODE_REQUEST);
+            // non-bondable mode: pin code negative reply will be sent
+            if (!hci_stack.bondable){
+                hci_add_connection_flags_for_flipped_bd_addr(&packet[2], HANDLE_PIN_CODE_REQUEST);
+                break;
+            }
             // PIN CODE REQUEST means the link key request didn't succee -> delete stored link key
             if (!hci_stack.remote_device_db) break;
             bt_flip_addr(addr, &packet[2]);
@@ -1196,6 +1202,13 @@ void hci_run(){
             return;
         }
 
+        if (connection->authentication_flags & HANDLE_PIN_CODE_REQUEST){
+            log_info("denying to pin request\n");
+            hci_send_cmd(&hci_pin_code_request_negative_reply, connection->address);
+            connectionClearAuthenticationFlags(connection, HANDLE_PIN_CODE_REQUEST);
+            return;
+        }
+
         if (connection->authentication_flags & SEND_IO_CAPABILITIES_REPLY){
             hci_send_cmd(&hci_io_capability_request_reply, &connection->address, hci_stack.ssp_io_capability, NULL, hci_stack.ssp_authentication_requirement);
             connectionClearAuthenticationFlags(connection, SEND_IO_CAPABILITIES_REPLY);
@@ -1650,6 +1663,6 @@ void hci_emit_discoverable_enabled(uint8_t enabled){
  * @bbrief enable/disable bonding. default is enabled
  * @praram enabled
  */
-void gap_set_bondable_mode(int enabled);{
+void gap_set_bondable_mode(int enable){
     hci_stack.bondable = enable ? 1 : 0;
 }
diff --git a/src/hci.h b/src/hci.h
index c585cf0aa..5f9a30e70 100644
--- a/src/hci.h
+++ b/src/hci.h
@@ -206,15 +206,16 @@ typedef enum {
     SENT_LINK_KEY_NEGATIVE_REQUEST = 0x0008,
     RECV_LINK_KEY_NOTIFICATION     = 0x0010,
     RECV_PIN_CODE_REQUEST          = 0x0020,
-    SENT_PIN_CODE_REPLY            = 0x0040, 
-    SENT_PIN_CODE_NEGATIVE_REPLY   = 0x0080,
+    HANDLE_PIN_CODE_REQUEST        = 0x0040,
+    SENT_PIN_CODE_REPLY            = 0x0080, 
+    SENT_PIN_CODE_NEGATIVE_REPLY   = 0x0100,
     // SSP
-    RECV_IO_CAPABILITIES_REQUEST   = 0x0100,
-    SEND_IO_CAPABILITIES_REPLY     = 0x0200,
-    RECV_USER_CONFIRM_REQUEST      = 0x0400,
-    SEND_USER_CONFIRM_REPLY        = 0x0800,
-    RECV_USER_PASSKEY_REQUEST      = 0x1000,
-    SEND_USER_PASSKEY_REPLY        = 0x2000,
+    RECV_IO_CAPABILITIES_REQUEST   = 0x0200,
+    SEND_IO_CAPABILITIES_REPLY     = 0x0400,
+    RECV_USER_CONFIRM_REQUEST      = 0x0800,
+    SEND_USER_CONFIRM_REPLY        = 0x1000,
+    RECV_USER_PASSKEY_REQUEST      = 0x2000,
+    SEND_USER_PASSKEY_REPLY        = 0x4000,
 } hci_authentication_flags_t;
 
 typedef enum {
@@ -322,7 +323,7 @@ typedef struct {
     uint8_t   discoverable;
     uint8_t   connectable;
     uint8_t   bondable;
-    
+
     /* buffer for scan enable cmd - 0xff no change */
     uint8_t   new_scan_enable_value;