diff --git a/debian-live-config/config/package-lists/wrolpi.list.chroot b/debian-live-config/config/package-lists/wrolpi.list.chroot
index 73c9c9ce..51a129cc 100644
--- a/debian-live-config/config/package-lists/wrolpi.list.chroot
+++ b/debian-live-config/config/package-lists/wrolpi.list.chroot
@@ -13,6 +13,7 @@ chromium
 chromium-driver
 cpufrequtils
 curl
+dnsmasq-base
 dosfstools
 ethtool
 exfat-fuse
@@ -36,6 +37,7 @@ hostapd
 htop
 iotop
 iperf3
+iw
 kiwix
 kiwix-tools
 libboost-all-dev
@@ -76,6 +78,7 @@ python3-doc
 python3-full
 python3-pip
 python3-venv
+rfkill
 rsync
 samba
 smartmontools
diff --git a/scripts/upgrade.sh b/scripts/upgrade.sh
index df602aca..db79a8cd 100755
--- a/scripts/upgrade.sh
+++ b/scripts/upgrade.sh
@@ -163,6 +163,16 @@ if ! command -v gnome-disks &>/dev/null; then
     -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold gnome-disk-utility
 fi
 
+# Install dnsmasq-base if not already installed (NetworkManager needs it for the hotspot's
+# DHCP; it is only a Recommends of network-manager, so ISOs built with --apt-recommends
+# false shipped without it).  iw and rfkill are WiFi diagnostic tools.
+if ! command -v dnsmasq &>/dev/null; then
+  echo "Installing dnsmasq-base, iw, rfkill..."
+  apt-get update
+  DEBIAN_FRONTEND=noninteractive apt-get install -y \
+    -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold dnsmasq-base iw rfkill
+fi
+
 # Clean up stale landing page (Controller now serves port 80 directly).
 rm -f /var/www/landing.html