diff --git a/ap/van-br0-setup.service b/ap/van-br0-setup.service
new file mode 100644
index 0000000..d8c7473
--- /dev/null
+++ b/ap/van-br0-setup.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=VanLink bridge member setup
+After=systemd-networkd.service hostapd.service
+Wants=systemd-networkd.service hostapd.service
+
+[Service]
+Type=oneshot
+ExecStart=/bin/bash -c "brctl addif br0 enP2p33s0 2>/dev/null || true"
+ExecStart=/bin/bash -c "brctl addif br0 wlp1s0 2>/dev/null || true"
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/deploy.sh b/deploy.sh
index c0b42f1..1a0a103 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -141,6 +141,7 @@ install_rendered ap/van-ap-unmanaged.conf   /etc/NetworkManager/conf.d/van-ap-un
 ln -sfn /dev/null /etc/systemd/network/zzzz-dracut-default.network
 install -D -m0644 ap/nftables.conf          /etc/nftables.conf
 install -D -m0644 ap/regdomain.service      /etc/systemd/system/regdomain.service
+install -D -m0644 ap/van-br0-setup.service  /etc/systemd/system/van-br0-setup.service
 install -D -m0644 ap/80-regdomain.rules     /etc/udev/rules.d/80-regdomain.rules
 install -D -m0644 ap/rtw89.conf             /etc/modprobe.d/rtw89.conf
 install -D -m0644 ap/99-van-router.conf     /etc/sysctl.d/99-van-router.conf
@@ -323,7 +324,7 @@ systemctl mask systemd-networkd-wait-online.service >/dev/null 2>&1 || true
 systemctl unmask hostapd >/dev/null 2>&1 || true
 # Disable system dnsmasq.service to avoid port 53 conflicts — van-ap-dnsmasq owns AP DHCP
 systemctl disable dnsmasq.service >/dev/null 2>&1 || true
-systemctl enable regdomain.service hostapd hostapd-2g van-ap-dnsmasq nftables systemd-networkd van-failover van-thermal van-nvme-watch van-ap-watchdog van-ap-watchdog-2g van-wlan-watchdog van-modem-watch van-sms-watch van-gps-owntracks van-li3-battery van-router-mqtt >/dev/null 2>&1 || true
+systemctl enable regdomain.service van-br0-setup.service hostapd hostapd-2g van-ap-dnsmasq nftables systemd-networkd van-failover van-thermal van-nvme-watch van-ap-watchdog van-ap-watchdog-2g van-wlan-watchdog van-modem-watch van-sms-watch van-gps-owntracks van-li3-battery van-router-mqtt >/dev/null 2>&1 || true
 # bluetooth: host BlueZ serves the onboard hci0 to the HA container over D-Bus
 systemctl enable --now bluetooth >/dev/null 2>&1 || true
 systemctl start homeassistant || warn "homeassistant failed to start (podman/quadlet — check journalctl -u homeassistant)"