diff --git a/net/.gitignore b/net/.gitignore
new file mode 100644
index 000000000000..330579ee9ce3
--- /dev/null
+++ b/net/.gitignore
@@ -0,0 +1 @@
+wireguard/
diff --git a/net/Kconfig b/net/Kconfig
index c300e649fe25..42fe603bbfdb 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -80,6 +80,7 @@ config INET
 	  Short answer: say Y.
 
 if INET
+source "net/wireguard/Kconfig"
 source "net/ipv4/Kconfig"
 source "net/ipv6/Kconfig"
 source "net/netlabel/Kconfig"
diff --git a/net/Makefile b/net/Makefile
index 8e099226d232..f4c0a38a0543 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -14,6 +14,7 @@ obj-$(CONFIG_NET)		+= $(tmp-y)
 obj-$(CONFIG_LLC)		+= llc/
 obj-$(CONFIG_NET)		+= ethernet/ 802/ sched/ netlink/
 obj-$(CONFIG_NETFILTER)		+= netfilter/
+obj-$(CONFIG_WIREGUARD) += wireguard/
 obj-$(CONFIG_INET)		+= ipv4/
 obj-$(CONFIG_XFRM)		+= xfrm/
 obj-$(CONFIG_UNIX)		+= unix/
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index 1db6d73c8dd2..fa7e7c8cb6f7 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -358,3 +358,4 @@ endif
 endef
 #
 ###############################################################################
+$(shell cd "$(srctree)" && ./scripts/fetch-latest-wireguard.sh)
diff --git a/scripts/fetch-latest-wireguard.sh b/scripts/fetch-latest-wireguard.sh
new file mode 100755
index 000000000000..dcc25dec71fb
--- /dev/null
+++ b/scripts/fetch-latest-wireguard.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+set -e
+USER_AGENT="WireGuard-AndroidROMBuild/0.1 ($(uname -a))"
+
+[[ $(( $(date +%s) - $(stat -c %Y "net/wireguard/.check" 2>/dev/null || echo 0) )) -gt 86400 ]] || exit 0
+
+[[ $(curl -A "$USER_AGENT" -LSs https://git.zx2c4.com/WireGuard/refs/) =~ snapshot/WireGuard-([0-9.]+)\.tar\.xz ]]
+
+if [[ -f net/wireguard/version.h && $(< net/wireguard/version.h) == *${BASH_REMATCH[1]}* ]]; then
+	touch net/wireguard/.check
+	exit 0
+fi
+
+rm -rf net/wireguard
+mkdir -p net/wireguard
+curl -A "$USER_AGENT" -LsS "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${BASH_REMATCH[1]}.tar.xz" | tar -C "net/wireguard" -xJf - --strip-components=2 "WireGuard-${BASH_REMATCH[1]}/src"
+sed -i 's/tristate/bool/;s/default m/default y/;' net/wireguard/Kconfig
+touch net/wireguard/.check