diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index dbeaa3c0a..6dc7e8c83 100644
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -3481,6 +3481,8 @@ static int hostapd_config_fill(struct hostapd_config *conf,
 		if (atoi(pos))
 			bss->radio_measurements[0] |=
 				WLAN_RRM_CAPS_NEIGHBOR_REPORT;
+	} else if (os_strcmp(buf, "gas_address3") == 0) {
+		bss->gas_address3 = atoi(pos);
 	} else {
 		wpa_printf(MSG_ERROR,
 			   "Line %d: unknown configuration item '%s'",
diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
index c62fc7e44..c19291de1 100644
--- a/hostapd/hostapd.conf
+++ b/hostapd/hostapd.conf
@@ -1747,6 +1747,13 @@ own_ip_addr=127.0.0.1
 # For example, AP Civic Location ANQP-element with unknown location:
 #anqp_elem=266:000000
 
+# GAS Address 3 behavior
+# 0 = P2P specification (Address3 = AP BSSID) workaround enabled by default
+#     based on GAS request Address3
+# 1 = IEEE 802.11 standard compliant regardless of GAS request Address3
+# 2 = Force non-compliant behavior (Address3 = AP BSSID for all cases)
+#gas_address3=0
+
 # QoS Map Set configuration
 #
 # Comma delimited QoS Map Set in decimal values
diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
index b263eb05c..fbe97fca3 100644
--- a/src/ap/ap_config.h
+++ b/src/ap/ap_config.h
@@ -504,6 +504,7 @@ struct hostapd_bss_config {
 
 	u16 gas_comeback_delay;
 	int gas_frag_limit;
+	int gas_address3;
 
 	u8 qos_map_set[16 + 2 * 21];
 	unsigned int qos_map_set_len;
diff --git a/src/ap/gas_serv.c b/src/ap/gas_serv.c
index 2b6efa849..6ce178de3 100644
--- a/src/ap/gas_serv.c
+++ b/src/ap/gas_serv.c
@@ -1470,7 +1470,12 @@ static void gas_serv_rx_public_action(void *ctx, const u8 *buf, size_t len,
 	 */
 	prot = mgmt->u.action.category == WLAN_ACTION_PROTECTED_DUAL;
 	sa = mgmt->sa;
-	std_addr3 = is_broadcast_ether_addr(mgmt->bssid);
+	if (hapd->conf->gas_address3 == 1)
+		std_addr3 = 1;
+	else if (hapd->conf->gas_address3 == 2)
+		std_addr3 = 0;
+	else
+		std_addr3 = is_broadcast_ether_addr(mgmt->bssid);
 	len -= IEEE80211_HDRLEN + 1;
 	data = buf + IEEE80211_HDRLEN + 1;
 	switch (data[0]) {