diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
index eef9da3d0..9a3cbeaef 100644
--- a/wpa_supplicant/ctrl_iface.c
+++ b/wpa_supplicant/ctrl_iface.c
@@ -890,6 +890,15 @@ static int wpa_supplicant_ctrl_iface_wps_nfc_tag_read(
 	size_t len;
 	struct wpabuf *buf;
 	int ret;
+	char *freq;
+	int forced_freq = 0;
+
+	freq = strstr(pos, " freq=");
+	if (freq) {
+		*freq = '\0';
+		freq += 6;
+		forced_freq = atoi(freq);
+	}
 
 	len = os_strlen(pos);
 	if (len & 0x01)
@@ -904,7 +913,7 @@ static int wpa_supplicant_ctrl_iface_wps_nfc_tag_read(
 		return -1;
 	}
 
-	ret = wpas_wps_nfc_tag_read(wpa_s, buf);
+	ret = wpas_wps_nfc_tag_read(wpa_s, buf, forced_freq);
 	wpabuf_free(buf);
 
 	return ret;
@@ -1142,6 +1151,15 @@ static int wpas_ctrl_nfc_report_handover(struct wpa_supplicant *wpa_s,
 	struct wpabuf *req, *sel;
 	int ret;
 	char *pos, *role, *type, *pos2;
+	char *freq;
+	int forced_freq = 0;
+
+	freq = strstr(cmd, " freq=");
+	if (freq) {
+		*freq = '\0';
+		freq += 6;
+		forced_freq = atoi(freq);
+	}
 
 	role = cmd;
 	pos = os_strchr(role, ' ');
@@ -1217,10 +1235,11 @@ static int wpas_ctrl_nfc_report_handover(struct wpa_supplicant *wpa_s,
 			ret = wpas_er_wps_nfc_report_handover(wpa_s, req, sel);
 	} else if (os_strcmp(role, "INIT") == 0 && os_strcmp(type, "P2P") == 0)
 	{
-		ret = wpas_p2p_nfc_report_handover(wpa_s, 1, req, sel);
+		ret = wpas_p2p_nfc_report_handover(wpa_s, 1, req, sel, 0);
 	} else if (os_strcmp(role, "RESP") == 0 && os_strcmp(type, "P2P") == 0)
 	{
-		ret = wpas_p2p_nfc_report_handover(wpa_s, 0, req, sel);
+		ret = wpas_p2p_nfc_report_handover(wpa_s, 0, req, sel,
+						   forced_freq);
 	} else {
 		wpa_printf(MSG_DEBUG, "NFC: Unsupported connection handover "
 			   "reported: role=%s type=%s", role, type);
diff --git a/wpa_supplicant/p2p_supplicant.c b/wpa_supplicant/p2p_supplicant.c
index 29e244a96..8d6c381cd 100644
--- a/wpa_supplicant/p2p_supplicant.c
+++ b/wpa_supplicant/p2p_supplicant.c
@@ -7238,18 +7238,20 @@ static int wpas_p2p_nfc_auth_join(struct wpa_supplicant *wpa_s,
 
 
 static int wpas_p2p_nfc_init_go_neg(struct wpa_supplicant *wpa_s,
-				    struct p2p_nfc_params *params)
+				    struct p2p_nfc_params *params,
+				    int forced_freq)
 {
 	wpa_printf(MSG_DEBUG, "P2P: Initiate GO Negotiation based on NFC "
 		   "connection handover");
 	return wpas_p2p_connect(wpa_s, params->peer->p2p_device_addr, NULL,
 				WPS_NFC, 0, 0, 0, 0, wpa_s->conf->p2p_go_intent,
-				0, -1, 0, 1, 1);
+				forced_freq, -1, 0, 1, 1);
 }
 
 
 static int wpas_p2p_nfc_resp_go_neg(struct wpa_supplicant *wpa_s,
-				    struct p2p_nfc_params *params)
+				    struct p2p_nfc_params *params,
+				    int forced_freq)
 {
 	int res;
 
@@ -7257,7 +7259,7 @@ static int wpas_p2p_nfc_resp_go_neg(struct wpa_supplicant *wpa_s,
 		   "connection handover");
 	res = wpas_p2p_connect(wpa_s, params->peer->p2p_device_addr, NULL,
 			       WPS_NFC, 0, 0, 0, 1, wpa_s->conf->p2p_go_intent,
-			       0, -1, 0, 1, 1);
+			       forced_freq, -1, 0, 1, 1);
 	if (res)
 		return res;
 
@@ -7273,7 +7275,7 @@ static int wpas_p2p_nfc_resp_go_neg(struct wpa_supplicant *wpa_s,
 
 static int wpas_p2p_nfc_connection_handover(struct wpa_supplicant *wpa_s,
 					    const struct wpabuf *data,
-					    int sel, int tag)
+					    int sel, int tag, int forced_freq)
 {
 	const u8 *pos, *end;
 	u16 len, id;
@@ -7426,10 +7428,10 @@ static int wpas_p2p_nfc_connection_handover(struct wpa_supplicant *wpa_s,
 	case AUTH_JOIN:
 		return wpas_p2p_nfc_auth_join(wpa_s, &params, tag);
 	case INIT_GO_NEG:
-		return wpas_p2p_nfc_init_go_neg(wpa_s, &params);
+		return wpas_p2p_nfc_init_go_neg(wpa_s, &params, forced_freq);
 	case RESP_GO_NEG:
 		/* TODO: use own OOB Dev Pw */
-		return wpas_p2p_nfc_resp_go_neg(wpa_s, &params);
+		return wpas_p2p_nfc_resp_go_neg(wpa_s, &params, forced_freq);
 	}
 
 	return -1;
@@ -7437,18 +7439,18 @@ static int wpas_p2p_nfc_connection_handover(struct wpa_supplicant *wpa_s,
 
 
 int wpas_p2p_nfc_tag_process(struct wpa_supplicant *wpa_s,
-			     const struct wpabuf *data)
+			     const struct wpabuf *data, int forced_freq)
 {
 	if (wpa_s->global->p2p_disabled || wpa_s->global->p2p == NULL)
 		return -1;
 
-	return wpas_p2p_nfc_connection_handover(wpa_s, data, 1, 1);
+	return wpas_p2p_nfc_connection_handover(wpa_s, data, 1, 1, forced_freq);
 }
 
 
 int wpas_p2p_nfc_report_handover(struct wpa_supplicant *wpa_s, int init,
 				 const struct wpabuf *req,
-				 const struct wpabuf *sel)
+				 const struct wpabuf *sel, int forced_freq)
 {
 	struct wpabuf *tmp;
 	int ret;
@@ -7462,13 +7464,16 @@ int wpas_p2p_nfc_report_handover(struct wpa_supplicant *wpa_s, int init,
 			  wpabuf_head(req), wpabuf_len(req));
 	wpa_hexdump_ascii(MSG_DEBUG, "NFC: Sel",
 			  wpabuf_head(sel), wpabuf_len(sel));
+	if (forced_freq)
+		wpa_printf(MSG_DEBUG, "NFC: Forced freq %d", forced_freq);
 	tmp = ndef_parse_p2p(init ? sel : req);
 	if (tmp == NULL) {
 		wpa_printf(MSG_DEBUG, "P2P: Could not parse NDEF");
 		return -1;
 	}
 
-	ret = wpas_p2p_nfc_connection_handover(wpa_s, tmp, init, 0);
+	ret = wpas_p2p_nfc_connection_handover(wpa_s, tmp, init, 0,
+					       forced_freq);
 	wpabuf_free(tmp);
 
 	return ret;
diff --git a/wpa_supplicant/p2p_supplicant.h b/wpa_supplicant/p2p_supplicant.h
index 4adea48a2..685313c6f 100644
--- a/wpa_supplicant/p2p_supplicant.h
+++ b/wpa_supplicant/p2p_supplicant.h
@@ -153,10 +153,10 @@ struct wpabuf * wpas_p2p_nfc_handover_req(struct wpa_supplicant *wpa_s,
 struct wpabuf * wpas_p2p_nfc_handover_sel(struct wpa_supplicant *wpa_s,
 					  int ndef, int tag);
 int wpas_p2p_nfc_tag_process(struct wpa_supplicant *wpa_s,
-			     const struct wpabuf *data);
+			     const struct wpabuf *data, int forced_freq);
 int wpas_p2p_nfc_report_handover(struct wpa_supplicant *wpa_s, int init,
 				 const struct wpabuf *req,
-				 const struct wpabuf *sel);
+				 const struct wpabuf *sel, int forced_freq);
 int wpas_p2p_nfc_tag_enabled(struct wpa_supplicant *wpa_s, int enabled);
 
 #ifdef CONFIG_P2P
diff --git a/wpa_supplicant/wps_supplicant.c b/wpa_supplicant/wps_supplicant.c
index a4b6da5ca..537aac391 100644
--- a/wpa_supplicant/wps_supplicant.c
+++ b/wpa_supplicant/wps_supplicant.c
@@ -2289,7 +2289,7 @@ static int wpas_wps_nfc_tag_process(struct wpa_supplicant *wpa_s,
 
 
 int wpas_wps_nfc_tag_read(struct wpa_supplicant *wpa_s,
-			  const struct wpabuf *data)
+			  const struct wpabuf *data, int forced_freq)
 {
 	const struct wpabuf *wps = data;
 	struct wpabuf *tmp = NULL;
@@ -2305,7 +2305,8 @@ int wpas_wps_nfc_tag_read(struct wpa_supplicant *wpa_s,
 #ifdef CONFIG_P2P
 			tmp = ndef_parse_p2p(data);
 			if (tmp) {
-				ret = wpas_p2p_nfc_tag_process(wpa_s, tmp);
+				ret = wpas_p2p_nfc_tag_process(wpa_s, tmp,
+							       forced_freq);
 				wpabuf_free(tmp);
 				return ret;
 			}
diff --git a/wpa_supplicant/wps_supplicant.h b/wpa_supplicant/wps_supplicant.h
index ef32da738..86e9d0915 100644
--- a/wpa_supplicant/wps_supplicant.h
+++ b/wpa_supplicant/wps_supplicant.h
@@ -70,7 +70,7 @@ int wpas_wps_start_nfc(struct wpa_supplicant *wpa_s, const u8 *dev_addr,
 		       int p2p_group, const u8 *peer_pubkey_hash,
 		       const u8 *ssid, size_t ssid_len, int freq);
 int wpas_wps_nfc_tag_read(struct wpa_supplicant *wpa_s,
-			  const struct wpabuf *data);
+			  const struct wpabuf *data, int forced_freq);
 struct wpabuf * wpas_wps_nfc_handover_req(struct wpa_supplicant *wpa_s,
 					  int ndef);
 struct wpabuf * wpas_wps_nfc_handover_sel(struct wpa_supplicant *wpa_s,