diff --git a/radius-client/tasks/main.yml b/radius-client/tasks/main.yml
index bf2ae310fa051bd91438e7dba8db38fbfa364f6f..7675c3b26c5d05c7137da2526c1fe6b2cf0deab8 100644
--- a/radius-client/tasks/main.yml
+++ b/radius-client/tasks/main.yml
@@ -42,6 +42,38 @@
   tags:
     - 8021x
 
+- name: ensure a script allows waiting for a connection
+  template:
+    src: wpa_wait.sh.j2
+    dest: /usr/local/bin/wpa_wait.sh
+    owner: root
+    group: root
+    mode: 0755
+  tags:
+    - 8021x
+
+- name: ensure we can override networkd service settings
+  file:
+    state: directory
+    path: /etc/systemd/system/systemd-networkd.service.d
+    owner: root
+    group: root
+    mode: 0644
+  tags:
+    - 8021x
+
+- name: ensure systemd-networkd waits for wpa_supplicant to authenticate
+  template:
+    src: networkd-override.conf.j2
+    dest: /etc/systemd/system/systemd-networkd.service.d/override.conf
+    owner: root
+    group: root
+    mode: 0644
+  notify:
+    - reload systemd service files
+  tags:
+    - 8021x
+
 - meta: flush_handlers
 
 - name: ensure wpasupplicant is enabled and running
diff --git a/radius-client/templates/networkd-override.conf.j2 b/radius-client/templates/networkd-override.conf.j2
new file mode 100644
index 0000000000000000000000000000000000000000..f61ae973a164f9b26fc37636efcac9330385ba2b
--- /dev/null
+++ b/radius-client/templates/networkd-override.conf.j2
@@ -0,0 +1,2 @@
+[Service]
+ExecStartPre=/usr/local/bin/wpa_wait.sh
diff --git a/radius-client/templates/wpa_wait.sh.j2 b/radius-client/templates/wpa_wait.sh.j2
new file mode 100755
index 0000000000000000000000000000000000000000..13a3a0f829daa90be9a4a46d654e77e02162b78c
--- /dev/null
+++ b/radius-client/templates/wpa_wait.sh.j2
@@ -0,0 +1,5 @@
+#!/bin/bash
+journalctl -u wpa_supplicant-wired@{{ ansible_default_ipv4.interface }} -b | tail -n1 | grep CONNECTED
+while [ $? == 1 ]; do
+	journalctl -u wpa_supplicant-wired@{{ ansible_default_ipv4.interface }} -b | tail -n1 | grep CONNECTED
+done