diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 7f873e9c8a72..e82706044582 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -152,6 +152,8 @@
 
 - `luaPackages.lrexlib-pcre` has been removed as part of the process to fully migrate from the end-of-life PRCE library to PCRE2. `luaPackages.lrexlib-pcre2` and multiple other versions of lrexlib can be used instead.
 
+- `hostapd` was upgraded to version 2.12+, which moves move supported, basic, and beacon transmission rate configuration to be at BSS level instead of per-radio for all BSSs. Refer to the [upstream example config](https://git.w1.fi/cgit/hostap/plain/hostapd/hostapd.conf) for details.
+
 - `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
 
 - `buildMozillaMach` is now using `enable<feature>` and `with<dependency>`
diff --git a/pkgs/by-name/ho/hostapd/package.nix b/pkgs/by-name/ho/hostapd/package.nix
index 1387b69dffdd..33815f3ccd47 100644
--- a/pkgs/by-name/ho/hostapd/package.nix
+++ b/pkgs/by-name/ho/hostapd/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hostapd";
-  version = "2.11";
+  version = "2.12";
 
   src = fetchurl {
     url = "https://w1.fi/releases/hostapd-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-Kz+stjL9T2XjL0v4Kna0tyxQH5laT2LjMCGf567RdHo=";
+    sha256 = "sha256-9DUCVhwoukerd+GOGpc9BzYcaMyLFBeOYZvVeWtw6r0=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -39,6 +39,9 @@ stdenv.mkDerivation (finalAttrs: {
     "man"
   ];
 
+  strictDeps = true;
+  enableParallelBuilding = true;
+
   # Based on hostapd's defconfig. Only differences are tracked.
   extraConfig = ''
     # Use epoll(7) instead of select(2) on linux