diff --git a/src/common/defs.h b/src/common/defs.h
index 077d6399a..f62c3ceee 100644
--- a/src/common/defs.h
+++ b/src/common/defs.h
@@ -430,6 +430,7 @@ enum chan_width {
 };
 
 enum key_flag {
+	KEY_FLAG_MODIFY			= BIT(0),
 	KEY_FLAG_DEFAULT		= BIT(1),
 	KEY_FLAG_RX			= BIT(2),
 	KEY_FLAG_TX			= BIT(3),
@@ -446,8 +447,10 @@ enum key_flag {
 					  KEY_FLAG_DEFAULT,
 	KEY_FLAG_PAIRWISE_RX_TX		= KEY_FLAG_PAIRWISE | KEY_FLAG_RX_TX,
 	KEY_FLAG_PAIRWISE_RX		= KEY_FLAG_PAIRWISE | KEY_FLAG_RX,
+	KEY_FLAG_PAIRWISE_RX_TX_MODIFY	= KEY_FLAG_PAIRWISE_RX_TX |
+					  KEY_FLAG_MODIFY,
 	/* Max allowed flags for each key type */
-	KEY_FLAG_PAIRWISE_MASK		= KEY_FLAG_PAIRWISE_RX_TX,
+	KEY_FLAG_PAIRWISE_MASK		= KEY_FLAG_PAIRWISE_RX_TX_MODIFY,
 	KEY_FLAG_GROUP_MASK		= KEY_FLAG_GROUP_RX_TX_DEFAULT,
 	KEY_FLAG_PMK_MASK		= KEY_FLAG_PMK,
 };
@@ -455,7 +458,7 @@ enum key_flag {
 static inline int check_key_flag(enum key_flag key_flag)
 {
 	return !!(!key_flag ||
-		  ((key_flag & KEY_FLAG_PAIRWISE) &&
+		  ((key_flag & (KEY_FLAG_PAIRWISE | KEY_FLAG_MODIFY)) &&
 		   (key_flag & ~KEY_FLAG_PAIRWISE_MASK)) ||
 		  ((key_flag & KEY_FLAG_GROUP) &&
 		   (key_flag & ~KEY_FLAG_GROUP_MASK)) ||
diff --git a/src/drivers/driver.h b/src/drivers/driver.h
index 642230ec3..b0373954a 100644
--- a/src/drivers/driver.h
+++ b/src/drivers/driver.h
@@ -1608,6 +1608,10 @@ struct wpa_driver_set_key_params {
 	/**
 	 * key_flag - Additional key flags
 	 *
+	 * %KEY_FLAG_MODIFY
+	 *  Set when an already installed key must be updated.
+	 *  So far the only use-case is changing RX/TX status for
+	 *  pairwise keys. Must not be set when deleting a key.
 	 * %KEY_FLAG_DEFAULT
 	 *  Set when the key is also a default key. Must not be set when
 	 *  deleting a key.
@@ -1636,6 +1640,9 @@ struct wpa_driver_set_key_params {
 	 * %KEY_FLAG_PAIRWISE_RX
 	 *  Pairwise key not yet valid for TX. (Only usable when Extended
 	 *  Key ID is supported by the driver.)
+	 * %KEY_FLAG_PAIRWISE_RX_TX_MODIFY
+	 *  Enable TX for a pairwise key installed with
+	 *  KEY_FLAG_PAIRWISE_RX.
 	 *
 	 * Not a valid standalone key type but pre-defined to be combined
 	 * with other key_flags: