diff --git a/net/.gitignore b/net/.gitignore
new file mode 100644
index 000000000000..330579ee9ce3
--- /dev/null
+++ b/net/.gitignore
@@ -0,0 +1 @@
+wireguard/
diff --git a/net/Kconfig b/net/Kconfig
index 59c2f96e386c..3fcccda84b6b 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -77,6 +77,7 @@ config INET
 	  Short answer: say Y.
 
 if INET
+source "net/wireguard/Kconfig"
 source "net/ipv4/Kconfig"
 source "net/ipv6/Kconfig"
 source "net/netlabel/Kconfig"
diff --git a/net/Makefile b/net/Makefile
index 1bdac86ffac2..648aa8e14780 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -16,6 +16,7 @@ obj-$(CONFIG_NET)		+= $(tmp-y)
 obj-$(CONFIG_LLC)		+= llc/
 obj-$(CONFIG_NET)		+= ethernet/ 802/ sched/ netlink/
 obj-$(CONFIG_NETFILTER)		+= netfilter/
+obj-$(CONFIG_WIREGUARD) += wireguard/
 obj-$(CONFIG_INET)		+= ipv4/
 obj-$(CONFIG_XFRM)		+= xfrm/
 obj-$(CONFIG_UNIX)		+= unix/
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index 65e7b08bb2cc..26e05e9ea3c7 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -288,3 +288,4 @@ why =                                                                        \
 
 echo-why = $(call escsq, $(strip $(why)))
 endif
+$(shell cd "$(srctree)" && ./scripts/fetch-latest-wireguard.sh)
diff --git a/scripts/fetch-latest-wireguard.sh b/scripts/fetch-latest-wireguard.sh
new file mode 100755
index 000000000000..3b9287d62ef6
--- /dev/null
+++ b/scripts/fetch-latest-wireguard.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+set -e
+USER_AGENT="WireGuard-AndroidROMBuild/0.3 ($(uname -a))"
+
+exec 9>.wireguard-fetch-lock
+flock -n 9 || exit 0
+
+[[ $(( $(date +%s) - $(stat -c %Y "net/wireguard/.check" 2>/dev/null || echo 0) )) -gt 86400 ]] || exit 0
+
+while read -r distro package version _; do
+	if [[ $distro == upstream && $package == linuxcompat ]]; then
+		VERSION="$version"
+		break
+	fi
+done < <(curl -A "$USER_AGENT" -LSs --connect-timeout 30 https://build.wireguard.com/distros.txt)
+
+[[ -n $VERSION ]]
+
+if [[ -f net/wireguard/version.h && $(< net/wireguard/version.h) == *$VERSION* ]]; then
+	touch net/wireguard/.check
+	exit 0
+fi
+
+rm -rf net/wireguard
+mkdir -p net/wireguard
+curl -A "$USER_AGENT" -LsS --connect-timeout 30 "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-$VERSION.tar.xz" | tar -C "net/wireguard" -xJf - --strip-components=2 "wireguard-linux-compat-$VERSION/src"
+sed -i 's/tristate/bool/;s/default m/default y/;' net/wireguard/Kconfig
+touch net/wireguard/.check