I recommend setting up another WiFi network for the actuator. This way it does not matter, if it is malicious, and if it isn't and it is vulnerable, it isn't connected to the internet, so its attack surface is limited to the other devices on the same station.