diff --git a/config/ap.nix b/config/ap.nix
index 60db0f5..dcd8577 100644
--- a/config/ap.nix
+++ b/config/ap.nix
@@ -316,6 +316,40 @@
         };
       };
     };
+    ap21 = {
+      interfaces = {
+        c3d2.type = "bridge";
+        mgmt = {
+          gw4 = "mgmt-gw";
+          gw6 = "mgmt-gw";
+          type = "phys";
+        };
+        priv39.type = "bridge";
+        pub.type = "bridge";
+      };
+      links = {
+        ap42.ports = [ "lan" ];
+      };
+      location = "Hof (on events)";
+      model = "ubnt_unifiac-lite";
+      role = "ap";
+      wifi = {
+        "pci0000:00/0000:00:00.0" = {
+          channel = 149;
+          htmode = "VHT80";
+          ssids = {
+            "ZW public" = { net = "pub"; };
+          };
+        };
+        "platform/ahb/18100000.wmac" = {
+          channel = 5;
+          htmode = "HT40+";
+          ssids = {
+            "ZW public" = { net = "pub"; };
+          };
+        };
+      };
+    };
     ap22 = {
       interfaces = {
         mgmt = {
@@ -1101,7 +1135,7 @@
         pub.type = "bridge";
       };
       links = {
-        pub.ports = [ "lan:3" ];
+        ap21.ports = [ "lan:3" ];
         priv4.ports = [ "lan:1" "lan:2" "lan:4" ];
         switch-b3.ports = [ "wan" ];
       };
diff --git a/config/secrets.nix b/config/secrets.nix
index 56c19a8..3eba901 100644
--- a/config/secrets.nix
+++ b/config/secrets.nix
@@ -21,6 +21,7 @@
     ap17.password = "encrypted";
     ap18.password = "encrypted";
     ap19.password = "encrypted";
+    ap21.password = "encrypted";
     ap22.password = "encrypted";
     ap23.password = "encrypted";
     ap24.password = "encrypted";