diff --git a/roles/network/tasks/hostapd.yml b/roles/network/tasks/hostapd.yml
index 537f58980..07e534b66 100644
--- a/roles/network/tasks/hostapd.yml
+++ b/roles/network/tasks/hostapd.yml
@@ -19,18 +19,6 @@
     host_channel: "{{ current_client_channel.stdout }}"
   when: current_client_channel.stdout is defined and current_client_channel.stdout != "" and current_client_channel.stdout|int <= 13
 
-- name: Create /etc/hostapd/hostapd.conf and backup .iiab from template
-  template:
-    owner: root
-    group: root
-    mode: 0644
-    src: "{{ item.src }}"
-    dest: "{{ item.dest }}"
-  with_items:
-    - { src: 'hostapd/hostapd.conf.j2', dest: '/etc/hostapd/hostapd.conf' }
-    - { src: 'hostapd/hostapd.conf.j2', dest: '/etc/hostapd/hostapd.conf.iiab' }
-  when: can_be_ap
-
 - name: Generate new random mac address for ap0
   shell: tr -dc A-F0-9 < /dev/urandom | head -c 10 | sed -r 's/(..)/\1:/g;s/:$//;s/^/02:/'
   register: ap0_mac
@@ -64,7 +52,7 @@
 
 - name: Create /usr/bin/iiab-hotspot-on from template
   template:
-    src: network/iiab-hotspot-on
+    src: hostapd/iiab-hotspot-on
     dest: /usr/bin/iiab-hotspot-on
     owner: root
     group: root
@@ -72,7 +60,7 @@
 
 - name: Create /usr/bin/iiab-hotspot-off from template
   template:
-    src: network/iiab-hotspot-off
+    src: hostapd/iiab-hotspot-off
     dest: /usr/bin/iiab-hotspot-off
     owner: root
     group: root
diff --git a/roles/network/tasks/restart.yml b/roles/network/tasks/restart.yml
index d286e987c..0dda30a6f 100644
--- a/roles/network/tasks/restart.yml
+++ b/roles/network/tasks/restart.yml
@@ -6,6 +6,25 @@
     - wpa_supplicant
   when: wifi_up_down and hostapd_enabled
 
+- name: Create /etc/hostapd/hostapd.conf and backup .iiab from template if needed
+  template:
+    owner: root
+    group: root
+    mode: 0644
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+  with_items:
+    - { src: 'hostapd/hostapd.conf.j2', dest: '/etc/hostapd/hostapd.conf' }
+    - { src: 'hostapd/hostapd.conf.j2', dest: '/etc/hostapd/hostapd.conf.iiab' }
+  when: can_be_ap
+
+- name: Restart hostapd when WiFi is present but not when using WiFi as gateway with wifi_up_down False
+  systemd:
+    name: hostapd
+    state: restarted
+    daemon_reload: yes
+  when: hostapd_enabled and (wifi_up_down or not no_net_restart)
+
 - name: Reload netplan for Wifi gateway on Ubuntu 18+
   shell: netplan apply
   when: wifi_up_down and is_ubuntu and netplan.stdout.find("yaml") != -1
diff --git a/roles/network/tasks/rpi_debian.yml b/roles/network/tasks/rpi_debian.yml
index 1887a7d15..9c245a5f6 100644
--- a/roles/network/tasks/rpi_debian.yml
+++ b/roles/network/tasks/rpi_debian.yml
@@ -21,16 +21,21 @@
     src: network/dhcpcd.conf.j2
 
 - name: New Raspbian requires country code -- check for it
-  shell: grep country /etc/wpa_supplicant/wpa_supplicant.conf
+  shell: grep country /etc/wpa_supplicant/wpa_supplicant.conf | awk -F = '{print $2}'
   register: country_code
   ignore_errors: True
 
+- name: Set country code for hostapd to value found in /etc/wpa_supplicant/wpa_supplicant.conf
+  set_fact:
+    host_country_code: "{{ country_code.stdout }}"
+  when: country_code is defined and country_code.stdout | length > 0
+
 - name: Put country code ({{ host_country_code }}) in /etc/wpa_supplicant/wpa_supplicant.conf if nec
   lineinfile: 
     path: /etc/wpa_supplicant/wpa_supplicant.conf
     regexp: "^country.*"
     line: country={{ host_country_code }}
-  when: country_code is defined and country_code.stdout == ""
+  when: country_code is defined and country_code.stdout | length == 0
 
 - name: Enable the WiFi with rfkill
   shell: rfkill unblock 0
@@ -60,9 +65,7 @@
   systemd:
     name: iiab-clone-wifi
     state: started
-  when: discovered_wireless_iface != "none"
-  # Whereas sysd-netd-debian.yml uses...
-  # when: wifi_up_down and discovered_wireless_iface != "none"
+  when: wifi_up_down and discovered_wireless_iface != "none"
 
 - name: Restart the networking service if appropriate
   systemd:
@@ -71,12 +74,6 @@
     state: restarted
   when: iiab_wired_lan_iface is defined
 
-- name: Restart hostapd when WiFi is present but not when using WiFi as gateway with wifi_up_down False
-  systemd:
-    name: hostapd
-    state: restarted
-  when: hostapd_enabled and (wifi_up_down or not no_net_restart)
-
 #- name: Stop wpa_supplicant on Raspbian
 #  shell: killall wpa_supplicant
 
diff --git a/roles/network/tasks/sysd-netd-debian.yml b/roles/network/tasks/sysd-netd-debian.yml
index 4b3048256..c32b966a1 100644
--- a/roles/network/tasks/sysd-netd-debian.yml
+++ b/roles/network/tasks/sysd-netd-debian.yml
@@ -70,9 +70,3 @@
     state: restarted
     enabled: yes
     masked: no
-
-- name: Restart hostapd when WiFi is present but not when using WiFi as gateway with wifi_up_down False
-  systemd:
-    name: hostapd
-    state: restarted
-  when: hostapd_enabled and (wifi_up_down or not no_net_restart)
diff --git a/roles/network/templates/hostapd/50-hostapd b/roles/network/templates/hostapd/50-hostapd
index 37a363b72..5b13b14b5 100644
--- a/roles/network/templates/hostapd/50-hostapd
+++ b/roles/network/templates/hostapd/50-hostapd
@@ -1,4 +1,14 @@
 if [ "$interface" = "br0" ] && [ $if_up = "true" ]; then
+    WPA=$(grep country /etc/wpa_supplicant/wpa_supplicant.conf | awk -F = '{print $2}')
+    AP=$(grep country_code /etc/hostapd/hostapd.conf | awk -F = '{print $2}')
+    if ! [ "$WPA" = "$AP" ]; then
+        sed -i -e "s/^country_code.*/country_code=$WPA /" /etc/hostapd/hostapd.conf
+        echo "50-iiab set country_code $WPA"
+        syslog info "50-iiab set country_code $WPA"
+        echo "THIS MACHINE SHOULD BE REBOOTED"
+        syslog info "THIS MACHINE SHOULD BE REBOOTED 50-iiab country_code"
+#        systemctl restart hostapd
+    fi
     syslog info "50-iiab IF_UP br0 restarting dnsmasq - kicking ap0"
     ip link set ap0 up
     systemctl --no-block restart dnsmasq
@@ -10,8 +20,9 @@ if [ "$interface" = "wlan0" ]; then
         syslog info "50-iiab CARRIER change wlan0"
         # wpa_supplicant wants MHz for frequency= while hostapd wants channel..... whatever
         # FREQ=`iw wlan0 info|grep channel|cut -d' ' -f9`
-        FREQ=`iw wlan0 info|grep channel|cut -d' ' -f2`
+        FREQ=$(iw wlan0 info|grep channel|cut -d' ' -f2)
         FREQ2=""
+
         for result in $FREQ; do
             echo "frequency is $result for carrier"
             if [ $result -lt 13 ]; then
@@ -22,14 +33,14 @@ if [ "$interface" = "wlan0" ]; then
         done
         echo "Using $FREQ2 for carrier"
         syslog info "50-iiab set channel $FREQ2"
-        HOSTAPD=`grep channel /etc/hostapd/hostapd.conf | awk -F = '{print $2}'`
+        HOSTAPD=$(grep channel /etc/hostapd/hostapd.conf | awk -F = '{print $2}')
         echo "Hostapd set for $HOSTAPD"
         if [ $FREQ2 -ne $HOSTAPD ] && [ ! -z $FREQ2 ]; then
             echo "Editing Hostapd for channel $FREQ2"
             cp /etc/hostapd/hostapd.conf.iiab /etc/hostapd/hostapd.conf
             sed -i -e "s/^channel.*/channel=$FREQ /" /etc/hostapd/hostapd.conf
             echo "THIS MACHINE SHOULD BE REBOOTED"
-            syslog info "THIS MACHINE SHOULD BE REBOOTED"
+            syslog info "THIS MACHINE SHOULD BE REBOOTED 50-iiab channel"
 #            systemctl restart hostapd
         fi
     fi
diff --git a/roles/network/templates/network/iiab-hotspot-off b/roles/network/templates/hostapd/iiab-hotspot-off
similarity index 100%
rename from roles/network/templates/network/iiab-hotspot-off
rename to roles/network/templates/hostapd/iiab-hotspot-off
diff --git a/roles/network/templates/network/iiab-hotspot-on b/roles/network/templates/hostapd/iiab-hotspot-on
similarity index 81%
rename from roles/network/templates/network/iiab-hotspot-on
rename to roles/network/templates/hostapd/iiab-hotspot-on
index d92cb5f21..41b5357a7 100755
--- a/roles/network/templates/network/iiab-hotspot-on
+++ b/roles/network/templates/hostapd/iiab-hotspot-on
@@ -1,4 +1,10 @@
 #!/bin/bash
+{% if not can_be_ap %}
+echo -e "\nUH-OH: Your Wi-Fi firmware doesn't support AP mode, according to 'iw list'\n"
+echo -e "If you add Wi-Fi hardware, run 'cd /opt/iiab/iiab' then 'sudo ./iiab-network'\n"
+echo -e "For details, see: https://github.com/iiab/iiab/pull/3179\n"
+exit 1
+{% else %}
 sed -i -e "s/^HOSTAPD_ENABLED.*/HOSTAPD_ENABLED=True/" {{ iiab_env_file }}
 {% if wifi_up_down %}
 systemctl enable iiab-clone-wifi.service
@@ -38,3 +44,4 @@ exit 0
 {% endif %}
 #wifi_up_down
 {% endif %}
+{% endif %}
diff --git a/vars/default_vars.yml b/vars/default_vars.yml
index 3dcce06d0..7851b6cac 100644
--- a/vars/default_vars.yml
+++ b/vars/default_vars.yml
@@ -106,7 +106,17 @@ lan_netmask: 255.255.224.0
 # YOU'LL PREVENT OLDER LAPTOPS/PHONES/TABLETS (WHICH REQUIRE 2.4 GHz) FROM
 # CONNECTING TO YOUR IIAB'S INTERNAL HOTSPOT.  See "wifi_up_down: True" below.
 #
-# Raspberry Pi OS requires WiFi country -- SET THIS IN /etc/iiab/local_vars.yml
+# Raspberry Pi OS requires WiFi country since March 2018.
+#
+# If you're running Raspberry Pi OS, you may have already set the country code
+# in /etc/wpa_supplicant/wpa_supplicant.conf e.g. if you ran raspi-config or used
+# the Wi-Fi widget in the top-right of its graphical desktop.
+#
+# If so, this detected value will be considered authoritative, and will be used
+# to populate /etc/hostapd/hostapd.conf
+#
+# Finally, if IIAB does not detect a country code from your OS, the following
+# fallback variable will be used instead: (to populate /etc/hostapd/hostapd.conf)
 host_country_code: US
 host_ssid: Internet in a Box
 host_wifi_mode: g
diff --git a/vars/local_vars_large.yml b/vars/local_vars_large.yml
index 6478638c3..9681208c9 100644
--- a/vars/local_vars_large.yml
+++ b/vars/local_vars_large.yml
@@ -54,7 +54,17 @@ iiab_domain: lan
 # YOU'LL PREVENT OLDER LAPTOPS/PHONES/TABLETS (WHICH REQUIRE 2.4 GHz) FROM
 # CONNECTING TO YOUR IIAB'S INTERNAL HOTSPOT.  See "wifi_up_down: True" below.
 #
-# Raspberry Pi OS requires WiFi country since March 2018.  Please set it here:
+# Raspberry Pi OS requires WiFi country since March 2018.
+#
+# If you're running Raspberry Pi OS, you may have already set the country code
+# in /etc/wpa_supplicant/wpa_supplicant.conf e.g. if you ran raspi-config or used
+# the Wi-Fi widget in the top-right of its graphical desktop.
+#
+# If so, this detected value will be considered authoritative, and will be used
+# to populate /etc/hostapd/hostapd.conf
+#
+# Finally, if IIAB does not detect a country code from your OS, the following
+# fallback variable will be used instead: (to populate /etc/hostapd/hostapd.conf)
 host_country_code: US
 host_ssid: Internet in a Box
 host_wifi_mode: g
diff --git a/vars/local_vars_medium.yml b/vars/local_vars_medium.yml
index 6c56bf89e..5c2f667d9 100644
--- a/vars/local_vars_medium.yml
+++ b/vars/local_vars_medium.yml
@@ -54,7 +54,17 @@ iiab_domain: lan
 # YOU'LL PREVENT OLDER LAPTOPS/PHONES/TABLETS (WHICH REQUIRE 2.4 GHz) FROM
 # CONNECTING TO YOUR IIAB'S INTERNAL HOTSPOT.  See "wifi_up_down: True" below.
 #
-# Raspberry Pi OS requires WiFi country since March 2018.  Please set it here:
+# Raspberry Pi OS requires WiFi country since March 2018.
+#
+# If you're running Raspberry Pi OS, you may have already set the country code
+# in /etc/wpa_supplicant/wpa_supplicant.conf e.g. if you ran raspi-config or used
+# the Wi-Fi widget in the top-right of its graphical desktop.
+#
+# If so, this detected value will be considered authoritative, and will be used
+# to populate /etc/hostapd/hostapd.conf
+#
+# Finally, if IIAB does not detect a country code from your OS, the following
+# fallback variable will be used instead: (to populate /etc/hostapd/hostapd.conf)
 host_country_code: US
 host_ssid: Internet in a Box
 host_wifi_mode: g
diff --git a/vars/local_vars_small.yml b/vars/local_vars_small.yml
index a3c7ed0bc..8098f8bfb 100644
--- a/vars/local_vars_small.yml
+++ b/vars/local_vars_small.yml
@@ -54,7 +54,17 @@ iiab_domain: lan
 # YOU'LL PREVENT OLDER LAPTOPS/PHONES/TABLETS (WHICH REQUIRE 2.4 GHz) FROM
 # CONNECTING TO YOUR IIAB'S INTERNAL HOTSPOT.  See "wifi_up_down: True" below.
 #
-# Raspberry Pi OS requires WiFi country since March 2018.  Please set it here:
+# Raspberry Pi OS requires WiFi country since March 2018.
+#
+# If you're running Raspberry Pi OS, you may have already set the country code
+# in /etc/wpa_supplicant/wpa_supplicant.conf e.g. if you ran raspi-config or used
+# the Wi-Fi widget in the top-right of its graphical desktop.
+#
+# If so, this detected value will be considered authoritative, and will be used
+# to populate /etc/hostapd/hostapd.conf
+#
+# Finally, if IIAB does not detect a country code from your OS, the following
+# fallback variable will be used instead: (to populate /etc/hostapd/hostapd.conf)
 host_country_code: US
 host_ssid: Internet in a Box
 host_wifi_mode: g
diff --git a/vars/local_vars_unittest.yml b/vars/local_vars_unittest.yml
index 585277444..0fcc6aaa4 100644
--- a/vars/local_vars_unittest.yml
+++ b/vars/local_vars_unittest.yml
@@ -54,7 +54,17 @@ iiab_domain: lan
 # YOU'LL PREVENT OLDER LAPTOPS/PHONES/TABLETS (WHICH REQUIRE 2.4 GHz) FROM
 # CONNECTING TO YOUR IIAB'S INTERNAL HOTSPOT.  See "wifi_up_down: True" below.
 #
-# Raspberry Pi OS requires WiFi country since March 2018.  Please set it here:
+# Raspberry Pi OS requires WiFi country since March 2018.
+#
+# If you're running Raspberry Pi OS, you may have already set the country code
+# in /etc/wpa_supplicant/wpa_supplicant.conf e.g. if you ran raspi-config or used
+# the Wi-Fi widget in the top-right of its graphical desktop.
+#
+# If so, this detected value will be considered authoritative, and will be used
+# to populate /etc/hostapd/hostapd.conf
+#
+# Finally, if IIAB does not detect a country code from your OS, the following
+# fallback variable will be used instead: (to populate /etc/hostapd/hostapd.conf)
 host_country_code: US
 host_ssid: unittest
 host_wifi_mode: g