diff --git a/src/scan.h b/src/scan.h
index b4e55d55..77d32854 100644
--- a/src/scan.h
+++ b/src/scan.h
@@ -63,6 +63,7 @@ struct scan_bss {
 	struct l_uintset *supported_rates;
 	uint8_t utilization;
 	uint16_t rank;
+	bool sha256:1;
 };
 
 const char *scan_ssid_security_to_str(enum scan_ssid_security ssid_security);
diff --git a/src/wiphy.c b/src/wiphy.c
index f39dbda9..54c0ea52 100644
--- a/src/wiphy.c
+++ b/src/wiphy.c
@@ -1685,6 +1685,13 @@ static void process_bss(struct netdev *netdev, struct scan_bss *bss)
 		}
 
 		ssid_security = scan_get_ssid_security(bss->capability, &rsne);
+
+		if (ssid_security == SCAN_SSID_SECURITY_PSK)
+			bss->sha256 =
+				rsne.akm_suites & IE_RSN_AKM_SUITE_PSK_SHA256;
+		else if (ssid_security == SCAN_SSID_SECURITY_8021X)
+			bss->sha256 =
+				rsne.akm_suites & IE_RSN_AKM_SUITE_8021X_SHA256;
 	} else if (bss->wpa) {
 		struct ie_rsn_info wpa;
 		int res = ie_parse_wpa_from_data(bss->wpa, bss->wpa[1] + 2,