diff --git a/scripts/android-profile-template.xml b/scripts/android-profile-template.xml
new file mode 100644
index 0000000..38ff863
--- /dev/null
+++ b/scripts/android-profile-template.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<WLANProfile xmlns="https://www.microsoft.com/networking/WLAN/profile/v1">
+    <name>DGNumRadius</name>
+    <SSIDConfig>
+        <SSID>
+            <name>@SSID@</name>
+        </SSID>
+    </SSIDConfig>
+    <connectionType>ESS</connectionType>
+    <connectionMode>auto</connectionMode>
+    <MSM>
+        <security>
+            <authEncryption>
+                <authentication>WPA2</authentication>
+                <encryption>AES</encryption>
+                <useOneX>true</useOneX>
+            </authEncryption>
+            <OneX xmlns="https://www.microsoft.com/networking/OneX/v1">
+                <EAPConfig>
+                    <EapHostConfig xmlns="https://www.microsoft.com/provisioning/EapHostConfig" 
+                                   xmlns:eapCommon="https://www.microsoft.com/provisioning/EapCommon" 
+                                   xmlns:baseEap="https://www.microsoft.com/provisioning/BaseEapMethodConfig">
+                        <EapMethod>
+                            <eapCommon:Type>25</eapCommon:Type> 
+                            <eapCommon:AuthorId>0</eapCommon:AuthorId> 
+                       </EapMethod>
+                       <Config xmlns:baseEap="https://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1" 
+                               xmlns:msPeap="https://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV1" 
+                               xmlns:msChapV2="https://www.microsoft.com/provisioning/MsChapV2ConnectionPropertiesV1"
+                               xmlns:msChapV2User="https://www.microsoft.com/provisioning/MsChapV2UserPropertiesV1">
+                           <baseEap:Eap>
+                               <baseEap:Type>25</baseEap:Type> 
+                               <msPeap:EapType>
+                                   <msPeap:ServerValidation>
+                                       <msPeap:DisableUserPromptForServerValidation>false</msPeap:DisableUserPromptForServerValidation> 
+                                       <msPeap:TrustedRootCA /> 
+                                   </msPeap:ServerValidation>
+                                   <msPeap:FastReconnect>true</msPeap:FastReconnect> 
+                                   <msPeap:InnerEapOptional>0</msPeap:InnerEapOptional> 
+                                   <msPeap:ServerNames>radius.dgnum.eu</msPeap:ServerNames>
+                                   <baseEap:Eap>
+                                       <baseEap:Type>26</baseEap:Type> 
+                                       <msChapV2:EapType>
+                                           <msChapV2:UseWinLogonCredentials>false</msChapV2:UseWinLogonCredentials>
+                                       </msChapV2:EapType>
+                                       <msChapV2User:EapType>
+                                           <msChapV2User:Username>@USERNAME@</msChapV2User:Username>
+                                           <msChapV2User:Password>@PASSWORD@</msChapV2User:Password>
+                                       </msChapV2User>
+                                   </baseEap:Eap>
+                                   <msPeap:EnableQuarantineChecks>false</msPeap:EnableQuarantineChecks> 
+                                   <msPeap:RequireCryptoBinding>false</msPeap:RequireCryptoBinding> 
+                                   <msPeap:PeapExtensions /> 
+                               </msPeap:EapType>
+                           </baseEap:Eap>
+                       </Config>
+                   </EapHostConfig>
+                </EAPConfig>
+            </OneX>
+        </security>
+    </MSM>
+</WLANProfile>
diff --git a/scripts/build-android-profile.nix b/scripts/build-android-profile.nix
new file mode 100644
index 0000000..8fdac9d
--- /dev/null
+++ b/scripts/build-android-profile.nix
@@ -0,0 +1,19 @@
+{
+  pkgs ? import <nixpkgs> { },
+  username,
+  domain ? "sso.dgnum.eu",
+  ssid ? "DGNum 5G prototype (AX)",
+  password,
+}:
+pkgs.runCommand "connection-${username}-android-profile.xml"
+  {
+    SSID = ssid;
+    USERNAME = "${username}@${domain}";
+    PASSWORD = password;
+  }
+  ''
+    substitute ${./android-profile-template.xml} $out \
+      --subst-var SSID \
+      --subst-var USERNAME \
+      --subst-var PASSWORD
+  ''