diff --git a/contrib/wifi-hooks/wifi-post-up.sh b/contrib/wifi-hooks/wifi-post-up.sh
new file mode 100755
index 00000000..f4b2eccb
--- /dev/null
+++ b/contrib/wifi-hooks/wifi-post-up.sh
@@ -0,0 +1,12 @@
+#! /bin/sh
+
+# Dropbear can generate a host key automatically (-R), but the file location is
+# configured at build-time and many ARM builds of dropbear have weird locations.
+# In order to specify a location, we need to generate the key manually.
+if [ ! -e /etc/dropbear/dropbear_ecdsa_host_key ]; then
+	mkdir -p /etc/dropbear
+	/mnt/onboard/.adds/bin/dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key
+fi
+
+# Add `-n` to skip password check, for initial user creation or password setting.
+/mnt/onboard/.adds/bin/dropbear -r /etc/dropbear/dropbear_ecdsa_host_key -p 2233
diff --git a/contrib/wifi-hooks/wifi-pre-down.sh b/contrib/wifi-hooks/wifi-pre-down.sh
new file mode 100755
index 00000000..4506d591
--- /dev/null
+++ b/contrib/wifi-hooks/wifi-pre-down.sh
@@ -0,0 +1,3 @@
+#! /bin/sh
+
+killall dropbear
diff --git a/dist.sh b/dist.sh
index c320e379..5fcb138c 100755
--- a/dist.sh
+++ b/dist.sh
@@ -36,6 +36,7 @@ cp -R css dist
 find dist/css -name '*-user.css' -delete
 find dist/keyboard-layouts -name '*-user.json' -delete
 find dist/hyphenation-patterns -name '*.bounds' -delete
+find dist/scripts -name 'wifi-*-*.sh' -delete
 cp target/arm-unknown-linux-gnueabihf/release/plato dist/
 cp contrib/*.sh dist
 cp contrib/Settings-sample.toml dist
diff --git a/doc/GUIDE.md b/doc/GUIDE.md
index 5cbf6fc1..0991ce45 100644
--- a/doc/GUIDE.md
+++ b/doc/GUIDE.md
@@ -16,6 +16,8 @@ The hyphenation bounds for a particular language can be overridden by creating a
 
 Dictionaries in the *StarDict* and *dictd* formats can be placed in the `dictionaries` directory. *Plato* doesn't support *StarDict* natively and will therefore convert all the *StarDict* dictionaries it might find in the `dictionaries` directory during startup. You can disable this behavior by uncommenting the corresponding line in `config.sh`.
 
+The four scripts `scripts/wifi-{pre,post}-{up,down}.sh` can be created with commands to run before or after the WiFi is enabled or disabled, respectively.
+
 ## Upgrade
 
 Install the corresponding one-click package on top of the previous one. Check out the [release notes](https://github.com/baskerville/plato/releases) before upgrading: manual intervention might be required.
diff --git a/scripts/wifi-disable.sh b/scripts/wifi-disable.sh
index 16e529f4..af88e1fd 100755
--- a/scripts/wifi-disable.sh
+++ b/scripts/wifi-disable.sh
@@ -2,6 +2,10 @@
 
 lsmod | grep -q sdio_wifi_pwr || exit 1
 
+SCRIPTS_DIR=$(dirname "$0")
+PRE_DOWN_SCRIPT=$SCRIPTS_DIR/wifi-pre-down.sh
+[ -e "$PRE_DOWN_SCRIPT" ] && $PRE_DOWN_SCRIPT
+
 killall udhcpc default.script wpa_supplicant 2> /dev/null
 
 [ "$WIFI_MODULE" = dhd ] && wlarm_le -i "$INTERFACE" down
@@ -10,3 +14,6 @@ ifconfig "$INTERFACE" down
 sleep 0.2
 rmmod "$WIFI_MODULE"
 rmmod sdio_wifi_pwr
+
+POST_DOWN_SCRIPT=$SCRIPTS_DIR/wifi-post-down.sh
+[ -e "$POST_DOWN_SCRIPT" ] && $POST_DOWN_SCRIPT
diff --git a/scripts/wifi-enable.sh b/scripts/wifi-enable.sh
index 3ece88aa..6fb8e127 100755
--- a/scripts/wifi-enable.sh
+++ b/scripts/wifi-enable.sh
@@ -2,6 +2,10 @@
 
 lsmod | grep -q sdio_wifi_pwr && exit 1
 
+SCRIPTS_DIR=$(dirname "$0")
+PRE_UP_SCRIPT=$SCRIPTS_DIR/wifi-pre-up.sh
+[ -e "$PRE_UP_SCRIPT" ] && $PRE_UP_SCRIPT
+
 insmod /drivers/"${PLATFORM}"/wifi/sdio_wifi_pwr.ko
 insmod /drivers/"${PLATFORM}"/wifi/"${WIFI_MODULE}".ko
 
@@ -18,3 +22,6 @@ ifconfig "$INTERFACE" up
 pidof wpa_supplicant > /dev/null || wpa_supplicant -D wext -s -i "$INTERFACE" -c /etc/wpa_supplicant/wpa_supplicant.conf -C /var/run/wpa_supplicant -B
 
 udhcpc -S -i "$INTERFACE" -s /etc/udhcpc.d/default.script -t15 -T10 -A3 -b -q > /dev/null &
+
+POST_UP_SCRIPT=$SCRIPTS_DIR/wifi-post-up.sh
+[ -e "$POST_UP_SCRIPT" ] && $POST_UP_SCRIPT