diff --git a/tests/hwsim/test_scan.py b/tests/hwsim/test_scan.py
index b624ce287..3f697848d 100644
--- a/tests/hwsim/test_scan.py
+++ b/tests/hwsim/test_scan.py
@@ -377,6 +377,36 @@ def test_scan_for_auth_fail(dev, apdev):
         raise Exception("Unexpected connection")
     dev[0].request("DISCONNECT")
 
+def test_scan_for_auth_wep(dev, apdev):
+    """cfg80211 scan-for-auth workaround with WEP keys"""
+    dev[0].flush_scan_cache()
+    hapd = hostapd.add_ap(apdev[0]['ifname'],
+                          { "ssid": "wep", "wep_key0": '"abcde"',
+                            "auth_algs": "2" })
+    dev[0].scan_for_bss(apdev[0]['bssid'], freq="2412")
+    # Block sme-connect radio work with an external radio work item, so that
+    # SELECT_NETWORK can decide to use fast associate without a new scan while
+    # cfg80211 still has the matching BSS entry, but the actual connection is
+    # not yet started.
+    id = dev[0].request("RADIO_WORK add block-work")
+    ev = dev[0].wait_event(["EXT-RADIO-WORK-START"])
+    if ev is None:
+        raise Exception("Timeout while waiting radio work to start")
+    dev[0].connect("wep", key_mgmt="NONE", wep_key0='"abcde"',
+                   auth_alg="SHARED", scan_freq="2412", wait_connect=False)
+    dev[0].dump_monitor()
+    # Clear cfg80211 BSS table.
+    subprocess.call(['iw', dev[0].ifname, 'scan', 'trigger',
+                     'freq', '2457', 'flush'])
+    ev = dev[0].wait_event(["CTRL-EVENT-SCAN-RESULTS"], 5)
+    if ev is None:
+        raise Exception("External flush scan timed out")
+    # Release blocking radio work to allow connection to go through with the
+    # cfg80211 BSS entry missing.
+    dev[0].request("RADIO_WORK done " + id)
+
+    dev[0].wait_connected(timeout=15)
+
 def test_scan_hidden(dev, apdev):
     """Control interface behavior on scan parameters"""
     hostapd.add_ap(apdev[0]['ifname'], { "ssid": "test-scan",