diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index 18aab8e50..7c15ff570 100644
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -3681,6 +3681,10 @@ static int hostapd_config_fill(struct hostapd_config *conf,
 				   line);
 			return 1;
 		}
+	} else if (os_strcmp(buf, "reg_def_cli_eirp_psd") == 0) {
+		conf->reg_def_cli_eirp_psd = atoi(pos);
+	} else if (os_strcmp(buf, "reg_sub_cli_eirp_psd") == 0) {
+		conf->reg_sub_cli_eirp_psd = atoi(pos);
 	} else if (os_strcmp(buf, "he_oper_chwidth") == 0) {
 		conf->he_oper_chwidth = atoi(pos);
 	} else if (os_strcmp(buf, "he_oper_centr_freq_seg0_idx") == 0) {
diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
index 542489a39..747e5400b 100644
--- a/hostapd/hostapd.conf
+++ b/hostapd/hostapd.conf
@@ -989,6 +989,13 @@ wmm_ac_vo_acm=0
 # See IEEE P802.11-REVme/D4.0, Table E-12 (Regulatory Info subfield encoding)
 # for more details.
 #he_6ghz_reg_pwr_type=0
+#
+# 6 GHz Maximum Tx Power used in Transmit Power Envelope elements, where the
+# "Transmit Power Interpretation" is set to "Regulatory client EIRP PSD".
+# For Maximum Transmit Power Category subfield encoding set to default (0):
+#reg_def_cli_eirp_psd=-1
+# For Maximum Transmit Power Category subfield encoding set to subordinate (1):
+#reg_sub_cli_eirp_psd=-1
 
 # Unsolicited broadcast Probe Response transmission settings
 # This is for the 6 GHz band only. If the interval is set to a non-zero value,
diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
index cc1f37694..a86887930 100644
--- a/src/ap/ap_config.c
+++ b/src/ap/ap_config.c
@@ -282,6 +282,8 @@ struct hostapd_config * hostapd_config_defaults(void)
 	conf->he_6ghz_rx_ant_pat = 1;
 	conf->he_6ghz_tx_ant_pat = 1;
 	conf->he_6ghz_reg_pwr_type = HE_REG_INFO_6GHZ_AP_TYPE_VLP;
+	conf->reg_def_cli_eirp_psd = -1;
+	conf->reg_sub_cli_eirp_psd = -1;
 #endif /* CONFIG_IEEE80211AX */
 
 	/* The third octet of the country string uses an ASCII space character
diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
index 794b48b82..f145425b7 100644
--- a/src/ap/ap_config.h
+++ b/src/ap/ap_config.h
@@ -1149,6 +1149,10 @@ struct hostapd_config {
 	u8 he_6ghz_rx_ant_pat;
 	u8 he_6ghz_tx_ant_pat;
 	u8 he_6ghz_reg_pwr_type;
+
+	int reg_def_cli_eirp_psd;
+	int reg_sub_cli_eirp_psd;
+
 	bool require_he;
 #endif /* CONFIG_IEEE80211AX */
 
diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
index 1703d8317..867229ea1 100644
--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
@@ -7067,7 +7067,11 @@ u8 * hostapd_eid_txpower_envelope(struct hostapd_data *hapd, u8 *eid)
 		tx_pwr_intrpn = REGULATORY_CLIENT_EIRP_PSD;
 
 		/* Default Transmit Power Envelope for Global Operating Class */
-		tx_pwr = REG_PSD_MAX_TXPOWER_FOR_DEFAULT_CLIENT * 2;
+		if (hapd->iconf->reg_def_cli_eirp_psd != -1)
+			tx_pwr = hapd->iconf->reg_def_cli_eirp_psd;
+		else
+			tx_pwr = REG_PSD_MAX_TXPOWER_FOR_DEFAULT_CLIENT * 2;
+
 		eid = hostapd_add_tpe_info(eid, tx_pwr_count, tx_pwr_intrpn,
 					   REG_DEFAULT_CLIENT, tx_pwr);
 
@@ -7076,7 +7080,10 @@ u8 * hostapd_eid_txpower_envelope(struct hostapd_data *hapd, u8 *eid)
 		if (iconf->he_6ghz_reg_pwr_type ==
 		    HE_REG_INFO_6GHZ_AP_TYPE_INDOOR) {
 			/* TODO: Extract PSD limits from channel data */
-			tx_pwr = REG_PSD_MAX_TXPOWER_FOR_SUBORDINATE_CLIENT * 2;
+			if (hapd->iconf->reg_sub_cli_eirp_psd != -1)
+				tx_pwr = hapd->iconf->reg_sub_cli_eirp_psd;
+			else
+				tx_pwr = REG_PSD_MAX_TXPOWER_FOR_SUBORDINATE_CLIENT * 2;
 			eid = hostapd_add_tpe_info(eid, tx_pwr_count,
 						   tx_pwr_intrpn,
 						   REG_SUBORDINATE_CLIENT,