diff --git a/api/system-current.txt b/api/system-current.txt
index fa62d4419f8de..c90112fecf679 100755
--- a/api/system-current.txt
+++ b/api/system-current.txt
@@ -59,6 +59,7 @@ package android {
     field public static final String CHANGE_APP_IDLE_STATE = "android.permission.CHANGE_APP_IDLE_STATE";
     field public static final String CHANGE_DEVICE_IDLE_TEMP_WHITELIST = "android.permission.CHANGE_DEVICE_IDLE_TEMP_WHITELIST";
     field public static final String CLEAR_APP_USER_DATA = "android.permission.CLEAR_APP_USER_DATA";
+    field public static final String COMPANION_APPROVE_WIFI_CONNECTIONS = "android.permission.COMPANION_APPROVE_WIFI_CONNECTIONS";
     field public static final String CONFIGURE_DISPLAY_BRIGHTNESS = "android.permission.CONFIGURE_DISPLAY_BRIGHTNESS";
     field public static final String CONFIGURE_WIFI_DISPLAY = "android.permission.CONFIGURE_WIFI_DISPLAY";
     field @Deprecated public static final String CONNECTIVITY_INTERNAL = "android.permission.CONNECTIVITY_INTERNAL";
@@ -1717,7 +1718,7 @@ package android.bluetooth.le {
 package android.companion {
 
   public final class CompanionDeviceManager {
-    method @RequiresPermission("android.permission.MANAGE_COMPANION_DEVICES") public boolean isDeviceAssociated(@NonNull String, @NonNull android.net.MacAddress, @NonNull android.os.UserHandle);
+    method @RequiresPermission("android.permission.MANAGE_COMPANION_DEVICES") public boolean isDeviceAssociatedForWifiConnection(@NonNull String, @NonNull android.net.MacAddress, @NonNull android.os.UserHandle);
   }
 
 }
diff --git a/api/test-current.txt b/api/test-current.txt
index ca245077ce30d..06755636fbddc 100644
--- a/api/test-current.txt
+++ b/api/test-current.txt
@@ -704,7 +704,7 @@ package android.bluetooth {
 package android.companion {
 
   public final class CompanionDeviceManager {
-    method @RequiresPermission("android.permission.MANAGE_COMPANION_DEVICES") public boolean isDeviceAssociated(@NonNull String, @NonNull android.net.MacAddress, @NonNull android.os.UserHandle);
+    method @RequiresPermission("android.permission.MANAGE_COMPANION_DEVICES") public boolean isDeviceAssociatedForWifiConnection(@NonNull String, @NonNull android.net.MacAddress, @NonNull android.os.UserHandle);
   }
 
 }
diff --git a/core/java/android/companion/CompanionDeviceManager.java b/core/java/android/companion/CompanionDeviceManager.java
index 3107c63027756..d4b5b1aab5329 100644
--- a/core/java/android/companion/CompanionDeviceManager.java
+++ b/core/java/android/companion/CompanionDeviceManager.java
@@ -269,7 +269,7 @@ public final class CompanionDeviceManager {
     @SystemApi
     @TestApi
     @RequiresPermission(android.Manifest.permission.MANAGE_COMPANION_DEVICES)
-    public boolean isDeviceAssociated(
+    public boolean isDeviceAssociatedForWifiConnection(
             @NonNull String packageName,
             @NonNull MacAddress macAddress,
             @NonNull UserHandle user) {
@@ -280,7 +280,7 @@ public final class CompanionDeviceManager {
         Objects.requireNonNull(macAddress, "mac address cannot be null");
         Objects.requireNonNull(user, "user cannot be null");
         try {
-            return mService.isDeviceAssociated(
+            return mService.isDeviceAssociatedForWifiConnection(
                     packageName, macAddress.toString(), user.getIdentifier());
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
diff --git a/core/java/android/companion/ICompanionDeviceManager.aidl b/core/java/android/companion/ICompanionDeviceManager.aidl
index 2e1ff0be85773..b323f58aa8270 100644
--- a/core/java/android/companion/ICompanionDeviceManager.aidl
+++ b/core/java/android/companion/ICompanionDeviceManager.aidl
@@ -40,5 +40,6 @@ interface ICompanionDeviceManager {
     boolean hasNotificationAccess(in ComponentName component);
     PendingIntent requestNotificationAccess(in ComponentName component);
 
-    boolean isDeviceAssociated(in String packageName, in String macAddress, int userId);
+    boolean isDeviceAssociatedForWifiConnection(in String packageName, in String macAddress,
+        int userId);
 }
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index bf610948d8220..82a28459a30e3 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -2535,6 +2535,14 @@
                 android:description="@string/permdesc_useDataInBackground"
                 android:protectionLevel="normal" />
 
+    <!-- Allows a companion app to associate to Wi-Fi.
+         <p>Only for use by a single pre-approved app.
+         @hide
+         @SystemApi
+    -->
+    <permission android:name="android.permission.COMPANION_APPROVE_WIFI_CONNECTIONS"
+                android:protectionLevel="signature|privileged" />
+
 
     <!-- ================================== -->
     <!-- Permissions affecting the system wallpaper -->
diff --git a/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java b/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java
index e976811a30941..434a97ee0bc5d 100644
--- a/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java
+++ b/services/companion/java/com/android/server/companion/CompanionDeviceManagerService.java
@@ -361,13 +361,18 @@ public class CompanionDeviceManagerService extends SystemService implements Bind
         }
 
         @Override
-        public boolean isDeviceAssociated(String packageName, String macAddress, int userId) {
+        public boolean isDeviceAssociatedForWifiConnection(String packageName, String macAddress,
+                int userId) {
             getContext().enforceCallingOrSelfPermission(
                     android.Manifest.permission.MANAGE_COMPANION_DEVICES, "isDeviceAssociated");
 
+            boolean bypassMacPermission = getContext().getPackageManager().checkPermission(
+                    android.Manifest.permission.COMPANION_APPROVE_WIFI_CONNECTIONS, packageName)
+                    == PackageManager.PERMISSION_GRANTED;
+
             return CollectionUtils.any(
                     readAllAssociations(userId, packageName),
-                    a -> Objects.equals(a.deviceAddress, macAddress));
+                    a -> bypassMacPermission || Objects.equals(a.deviceAddress, macAddress));
         }
 
         private void checkCanCallNotificationApi(String callingPackage) throws RemoteException {