diff --git a/tests/hwsim/test_eht.py b/tests/hwsim/test_eht.py
index 659fdf504..ae078ee5b 100644
--- a/tests/hwsim/test_eht.py
+++ b/tests/hwsim/test_eht.py
@@ -53,3 +53,66 @@ def test_prefer_eht_20(dev, apdev):
     est = dev[0].get_bss(apdev[0]['bssid'])['est_throughput']
     if est != "172103":
       raise Exception("Unexpected BSS1 est_throughput: " + est)
+
+def start_eht_sae_ap(apdev, ml=False):
+    params = hostapd.wpa2_params(ssid="eht", passphrase="12345678")
+    params["ieee80211ax"] = "1"
+    params["ieee80211be"] = "1"
+    params['ieee80211w'] = '2'
+    params['rsn_pairwise'] = "GCMP-256"
+    params['group_cipher'] = "GCMP-256"
+    params["group_mgmt_cipher"] = "BIP-GMAC-256"
+    params['beacon_prot'] = '2'
+    params['wpa_key_mgmt'] = 'SAE-EXT-KEY'
+    params['sae_groups'] = "20"
+    params['sae_pwe'] = "1"
+    if ml:
+        ml_elem = "ff0d6b" + "3001" + "0a" + "021122334455" + "01" + "00" + "00"
+        params['vendor_elements'] = ml_elem
+    try:
+        hapd = hostapd.add_ap(apdev, params)
+    except Exception as e:
+        if isinstance(e, Exception) and \
+           str(e) == "Failed to set hostapd parameter ieee80211be":
+            raise HwsimSkip("EHT not supported")
+        raise
+
+def test_eht_sae(dev, apdev):
+    """EHT AP with SAE"""
+    check_sae_capab(dev[0])
+
+    hapd = start_eht_sae_ap(apdev[0])
+    try:
+        dev[0].set("sae_groups", "20")
+        dev[0].set("sae_pwe", "2")
+        dev[0].connect("eht", key_mgmt="SAE-EXT-KEY", psk="12345678",
+                       ieee80211w="2", beacon_prot="1",
+                       pairwise="GCMP-256", group="GCMP-256",
+                       group_mgmt="BIP-GMAC-256", scan_freq="2412")
+    finally:
+        dev[0].set("sae_pwe", "0")
+
+def test_eht_sae_mlo(dev, apdev):
+    """EHT+MLO AP with SAE"""
+    check_sae_capab(dev[0])
+
+    hapd = start_eht_sae_ap(apdev[0], ml=True)
+    try:
+        dev[0].set("sae_groups", "20")
+        dev[0].set("sae_pwe", "2")
+        dev[0].connect("eht", key_mgmt="SAE-EXT-KEY", psk="12345678",
+                       ieee80211w="2", beacon_prot="1",
+                       pairwise="GCMP-256", group="GCMP-256",
+                       group_mgmt="BIP-GMAC-256", scan_freq="2412",
+                       wait_connect=False)
+        ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
+                                "CTRL-EVENT-AUTH-REJECT"], timeout=10)
+        if ev is None:
+            raise Exception("No connection result reported")
+        if "CTRL-EVENT-AUTH-REJECT" in ev:
+            # There is no MLO support with SAE in hostapd yet, so allow failure
+            # due to MLD address not being used.
+            if "status_code=15" not in ev:
+                raise Exception("Unexpected authentication failure: " + ev)
+    finally:
+        dev[0].set("sae_pwe", "0")