diff --git a/hotspot-to-wpa b/hotspot-to-wpa
new file mode 100644
index 0000000..d1e7cee
--- /dev/null
+++ b/hotspot-to-wpa
@@ -0,0 +1,20 @@
+#!rsc
+# RouterOS script: hotspot-to-wpa
+# Copyright (c) 2019 Christian Hesse <mail@eworm.de>
+#
+# add private WPA passphrase after hotspot login
+
+:local MacAddress $"mac-address";
+:local UserName $username;
+:local Date [ / system clock get date ];
+:local PassWord [ / ip hotspot user get [ find where name=$UserName ] password ];
+
+:local PlaceBefore [ / caps-man access-list find where comment="--- hotspot-to-wpa above ---" disabled ];
+:if ([ :len $PlaceBefore ] = 0) do={
+  :log error "Missing disabled access-list entry with comment '--- hotspot-to-wpa above ---'";
+  :error "Error: See log for details.";
+}
+
+/ caps-man access-list remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
+/ caps-man access-list add comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
+  mac-address=$MacAddress private-passphrase=$PassWord ssid-regexp="-wpa\$" place-before=$PlaceBefore;