diff --git a/src/wiphy.c b/src/wiphy.c
index c815850c..6d7a6f89 100644
--- a/src/wiphy.c
+++ b/src/wiphy.c
@@ -182,6 +182,17 @@ bool wiphy_can_connect(struct wiphy *wiphy, struct scan_bss *bss)
 		if (rsn_info.mfpr && !wiphy_select_cipher(wiphy,
 					rsn_info.group_management_cipher))
 			return false;
+
+		/*
+		 * if the AP ONLY supports SAE/WPA3, then we can only connect
+		 * if the wiphy feature is supported. Otherwise the AP may list
+		 * SAE as one of the AKM's but also support PSK (hybrid). In
+		 * this case we still want to allow a connection even if SAE
+		 * is not supported.
+		 */
+		if (IE_AKM_IS_SAE(rsn_info.akm_suites) &&
+				!wiphy_has_feature(wiphy, NL80211_FEATURE_SAE))
+			return false;
 	} else if (r != -ENOENT)
 		return false;