diff --git a/hosts/xlab-gateway/dhcp.nix b/hosts/xlab-gateway/dhcp.nix
index 61cba0d..b92c4b8 100644
--- a/hosts/xlab-gateway/dhcp.nix
+++ b/hosts/xlab-gateway/dhcp.nix
@@ -37,6 +37,19 @@
         { name = "domain-search"; data = "dev.skyw.top"; }
       ];
 
+      # Cisco CAPWAP APs -> Catalyst 9800-CL WMI 10.0.10.10 via DHCP option 43
+      # sub-option 241 (0xf1). Scoped to APs (option-60 "Cisco AP*") so other
+      # clients never receive it. Mirrors door1's kea-dhcp4 cisco-ap class.
+      client-classes = [
+        {
+          name = "cisco-ap";
+          test = "substring(option[60].hex,0,8) == 'Cisco AP'";
+          option-data = [
+            { name = "vendor-encapsulated-options"; csv-format = false; data = "F1:04:0A:00:0A:0A"; always-send = true; }
+          ];
+        }
+      ];
+
       subnet4 = [
         {
           id = 1;