diff --git a/src/netdev.c b/src/netdev.c
index e639a1f8..fdf3695f 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -4079,6 +4079,13 @@ static int netdev_handshake_state_setup_connection_type(
 	/*
 	 * Sanity check that any FT AKMs are set only on softmac or on
 	 * devices that support firmware roam
+	 *
+	 * XXX: is this the right condition?
+	 *      This can be reworded as `IE_AKM_IS_FT() && !(softmac || canroam)`,
+	 *      i.e. allow if `softmac OR support roam offload`. Should we also
+	 *      check for SAE offload in the second arm, i.e. allow if
+	 *      `softmac OR (support roam offload AND support SAE offload)`?
+	 *      See comment in wiphy.c:wiphy_select_akm().
 	 */
 	if (L_WARN_ON(IE_AKM_IS_FT(hs->akm_suite) && !softmac && !canroam))
 		return -ENOTSUP;
diff --git a/src/wiphy.c b/src/wiphy.c
index b6774f69..1e18685d 100644
--- a/src/wiphy.c
+++ b/src/wiphy.c
@@ -288,6 +288,8 @@ enum ie_rsn_akm_suite wiphy_select_akm(struct wiphy *wiphy,
 {
 	bool psk_offload = wiphy_has_ext_feature(wiphy,
 				NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK);
+	bool softmac = wiphy_supports_cmds_auth_assoc(wiphy);
+	bool roam_offload = wiphy_supports_firmware_roam(wiphy);
 
 	/*
 	 * If FT is available, use FT authentication to keep the door open
@@ -339,8 +341,19 @@ enum ie_rsn_akm_suite wiphy_select_akm(struct wiphy *wiphy,
 				goto wpa2_personal;
 			}
 
-			if (info->akm_suites &
-					IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256)
+			/*
+			 * XXX: this replicates the condition in netdev.c:netdev_handshake_state_setup_connection_type():
+			 *      `IE_AKM_IS_FT() && !softmac && !canroam` -> ENOTSUP.
+			 *      Thus, unlike condition for WPA2-FT below, we do not check for psk_offload.
+			 *
+			 *      Should this instead be `softmac || (sae_offload && roam_offload)`?
+			 *
+			 *      Or, conservatively, just `softmac` (like FT check for 802.1x above)?
+			 *      FT check for WPA2 below was loosened to allow offload in
+			 *      f5c5efa ("wiphy: allow FT AKM to be used if Auth/Assoc is not supported").
+			 */
+			if ((info->akm_suites & IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256) &&
+				(softmac || roam_offload))
 				return IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256;
 
 			if (info->akm_suites & IE_RSN_AKM_SUITE_SAE_SHA256)
@@ -355,8 +368,7 @@ enum ie_rsn_akm_suite wiphy_select_akm(struct wiphy *wiphy,
 		 */
 		if ((info->akm_suites & IE_RSN_AKM_SUITE_FT_USING_PSK) &&
 					bss->rsne && bss->mde_present) {
-			if (wiphy->support_cmds_auth_assoc ||
-					(psk_offload && wiphy->support_fw_roam))
+			if (softmac || (psk_offload && roam_offload))
 				return IE_RSN_AKM_SUITE_FT_USING_PSK;
 		}