diff --git a/package/hostapd/files/hostapd.sh b/package/hostapd/files/hostapd.sh
index db08e7bce..98c3f61e5 100644
--- a/package/hostapd/files/hostapd.sh
+++ b/package/hostapd/files/hostapd.sh
@@ -47,8 +47,8 @@ hostapd_set_bss_options() {
 	esac
 
 	# enforce CCMP for 11ng and 11na
-	case "$hwmode" in
-		*ng|*na) crypto="CCMP";;
+	case "$hwmode:$crypto" in
+		*ng:TKIP|*na:TKIP) crypto="CCMP TKIP";;
 	esac
 
 	# use crypto/auth settings for building the hostapd config