diff --git a/package/hostapd/hostapd.mk b/package/hostapd/hostapd.mk
index 075cb2a8d0..99f0cdf1b8 100644
--- a/package/hostapd/hostapd.mk
+++ b/package/hostapd/hostapd.mk
@@ -15,7 +15,6 @@ HOSTAPD_LICENSE_FILES = README
 
 HOSTAPD_CPE_ID_VENDOR = w1.fi
 HOSTAPD_SELINUX_MODULES = hostapd
-HOSTAPD_CONFIG_SET =
 
 HOSTAPD_CONFIG_ENABLE = \
 	CONFIG_INTERNAL_LIBTOMMATH \
@@ -83,13 +82,14 @@ HOSTAPD_CONFIG_ENABLE += CONFIG_WPS
 endif
 
 ifeq ($(BR2_PACKAGE_HOSTAPD_WPA3),y)
-HOSTAPD_CONFIG_SET += \
-	CONFIG_DPP \
-	CONFIG_SAE
 HOSTAPD_CONFIG_ENABLE += \
+	CONFIG_DPP \
+	CONFIG_SAE \
 	CONFIG_OWE
 else
 HOSTAPD_CONFIG_DISABLE += \
+	CONFIG_DPP \
+	CONFIG_SAE \
 	CONFIG_OWE
 endif
 
@@ -98,8 +98,9 @@ HOSTAPD_CONFIG_ENABLE += CONFIG_NO_VLAN
 endif
 
 ifeq ($(BR2_PACKAGE_HOSTAPD_VLAN_DYNAMIC),y)
-HOSTAPD_CONFIG_ENABLE += CONFIG_FULL_DYNAMIC_VLAN
-HOSTAPD_CONFIG_SET += NEED_LINUX_IOCTL
+HOSTAPD_CONFIG_ENABLE += \
+	CONFIG_FULL_DYNAMIC_VLAN \
+	NEED_LINUX_IOCTL
 endif
 
 ifeq ($(BR2_PACKAGE_HOSTAPD_VLAN_NETLINK),y)
@@ -123,9 +124,14 @@ define HOSTAPD_CONFIGURE_CMDS
 	cp $(@D)/hostapd/defconfig $(HOSTAPD_CONFIG)
 	sed -i $(patsubst %,-e 's/^#\(%\)/\1/',$(HOSTAPD_CONFIG_ENABLE)) \
 		$(patsubst %,-e 's/^\(%\)/#\1/',$(HOSTAPD_CONFIG_DISABLE)) \
-		$(patsubst %,-e '1i%=y',$(HOSTAPD_CONFIG_SET)) \
 		$(patsubst %,-e %,$(HOSTAPD_CONFIG_EDITS)) \
 		$(HOSTAPD_CONFIG)
+	# set requested configuration options not listed in hostapd defconfig
+	for s in $(HOSTAPD_CONFIG_ENABLE) ; do \
+		if ! grep -q "^$${s}" $(HOSTAPD_CONFIG); then \
+			echo "$${s}=y" >> $(HOSTAPD_CONFIG) ; \
+		fi \
+	done
 endef
 
 define HOSTAPD_BUILD_CMDS
diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk
index b414144774..f0eb36e083 100644
--- a/package/wpa_supplicant/wpa_supplicant.mk
+++ b/package/wpa_supplicant/wpa_supplicant.mk
@@ -164,7 +164,7 @@ WPA_SUPPLICANT_CONFIG_ENABLE += CONFIG_READLINE
 endif
 
 ifeq ($(BR2_PACKAGE_WPA_SUPPLICANT_WPA_CLIENT_SO),y)
-WPA_SUPPLICANT_CONFIG_SET += CONFIG_BUILD_WPA_CLIENT_SO
+WPA_SUPPLICANT_CONFIG_ENABLE += CONFIG_BUILD_WPA_CLIENT_SO
 define WPA_SUPPLICANT_INSTALL_WPA_CLIENT_SO
 	$(INSTALL) -m 0644 -D $(@D)/$(WPA_SUPPLICANT_SUBDIR)/libwpa_client.so \
 		$(TARGET_DIR)/usr/lib/libwpa_client.so
@@ -183,9 +183,14 @@ define WPA_SUPPLICANT_CONFIGURE_CMDS
 	cp $(@D)/wpa_supplicant/defconfig $(WPA_SUPPLICANT_CONFIG)
 	sed -i $(patsubst %,-e 's/^#\(%\)/\1/',$(WPA_SUPPLICANT_CONFIG_ENABLE)) \
 		$(patsubst %,-e 's/^\(%\)/#\1/',$(WPA_SUPPLICANT_CONFIG_DISABLE)) \
-		$(patsubst %,-e '1i%=y',$(WPA_SUPPLICANT_CONFIG_SET)) \
 		$(patsubst %,-e %,$(WPA_SUPPLICANT_CONFIG_EDITS)) \
 		$(WPA_SUPPLICANT_CONFIG)
+	# set requested configuration options not listed in wpa_s defconfig
+	for s in $(WPA_SUPPLICANT_CONFIG_ENABLE) ; do \
+		if ! grep -q "^$${s}" $(WPA_SUPPLICANT_CONFIG); then \
+			echo "$${s}=y" >> $(WPA_SUPPLICANT_CONFIG) ; \
+		fi \
+	done
 endef
 
 # LIBS for wpa_supplicant, LIBS_c for wpa_cli, LIBS_p for wpa_passphrase