diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json b/package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json
index 0d0e64d67b..97dea0e42d 100644
--- a/package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json
+++ b/package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json
@@ -962,6 +962,11 @@
 		"rsn_preauth": {
 			"type": "boolean"
 		},
+		"sae_ext_key": {
+			"description": "Advertise the SAE-EXT-KEY AKM alongside plain SAE. Mandatory for EHT, enabled by default.",
+			"type": "boolean",
+			"default": true
+		},
 		"sae_password_file": {
 			"description": "External file containing VLAN SAE MAC address triplets",
 			"type": "string"
diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc
index 4f718327f0..1f139e3a34 100644
--- a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc
+++ b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc
@@ -148,14 +148,24 @@ export function wpa_key_mgmt(config) {
 
 	case 'sae':
 		append_value(config, 'wpa_key_mgmt', 'SAE');
-		if (config.ieee80211r)
+		if (config.sae_ext_key)
+			append_value(config, 'wpa_key_mgmt', 'SAE-EXT-KEY');
+		if (config.ieee80211r) {
 			append_value(config, 'wpa_key_mgmt', 'FT-SAE');
+			if (config.sae_ext_key)
+				append_value(config, 'wpa_key_mgmt', 'FT-SAE-EXT-KEY');
+		}
 		break;
 
 	case 'psk-sae':
 		append_value(config, 'wpa_key_mgmt', 'SAE');
-		if (config.ieee80211r)
+		if (config.sae_ext_key)
+			append_value(config, 'wpa_key_mgmt', 'SAE-EXT-KEY');
+		if (config.ieee80211r) {
 			append_value(config, 'wpa_key_mgmt', 'FT-SAE');
+			if (config.sae_ext_key)
+				append_value(config, 'wpa_key_mgmt', 'FT-SAE-EXT-KEY');
+		}
 
 		append_value(config, 'wpa_key_mgmt', 'WPA-PSK');
 		if (config.ieee80211w)