diff --git a/.gitmodules b/.gitmodules
index 96bb4ed2cda1..2cb5aed594ad 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -85,3 +85,6 @@
 [submodule "src/sonic-mgmt-common"]
 	path = src/sonic-mgmt-common
 	url = https://github.com/Azure/sonic-mgmt-common.git
+[submodule "src/wpasupplicant/sonic-wpa-supplicant"]
+	path = src/wpasupplicant/sonic-wpa-supplicant
+	url = https://github.com/Azure/sonic-wpa-supplicant
diff --git a/rules/wpasupplicant.mk b/rules/wpasupplicant.mk
index 165dd9478944..2e6d2ea6b2f1 100644
--- a/rules/wpasupplicant.mk
+++ b/rules/wpasupplicant.mk
@@ -1,7 +1,6 @@
 # wpa package
 
-# WPASUPPLICANT_VERSION = hostap_2_9
-WPASUPPLICANT_VERSION = 2.9.0-12
+WPASUPPLICANT_VERSION = 2.9.0-14
 
 export WPASUPPLICANT_VERSION
 
diff --git a/src/wpasupplicant/Makefile b/src/wpasupplicant/Makefile
index ba72c266bfa7..13dbc58fbe50 100644
--- a/src/wpasupplicant/Makefile
+++ b/src/wpasupplicant/Makefile
@@ -6,19 +6,8 @@ MAIN_TARGET = wpasupplicant_$(WPASUPPLICANT_VERSION)_$(CONFIGURED_ARCH).deb
 DERIVED_TARGETS = wpasupplicant-dbgsym_$(WPASUPPLICANT_VERSION)_$(CONFIGURED_ARCH).deb
 
 $(addprefix $(DEST)/, $(MAIN_TARGET)): $(DEST)/% :
-	# Remove any stale files
-	rm -rf ./wpa
-
 	# Clone wpa repo
-	git clone https://github.com/Azure/sonic-wpa-supplicant.git
-	pushd ./sonic-wpa-supplicant/wpa_supplicant
-	# Reset HEAD to the commit of the proper tag
-	# NOTE: Using "git checkout <tag_name>" here detaches our HEAD,
-	# which stg doesn't like, so we use this method instead
-	# NOTE: For some reason, tags in the Debian monit repo are prefixed with "1%"
 	pushd ./sonic-wpa-supplicant
-	# git checkout wpa/$(WPASUPPLICANT_VERSION)
-	# Build source and Debian packages
 	dpkg-buildpackage -rfakeroot -b -us -uc -j$(SONIC_CONFIG_MAKE_JOBS)
 	popd
 
diff --git a/src/wpasupplicant/sonic-wpa-supplicant b/src/wpasupplicant/sonic-wpa-supplicant
new file mode 160000
index 000000000000..288cca1bf026
--- /dev/null
+++ b/src/wpasupplicant/sonic-wpa-supplicant
@@ -0,0 +1 @@
+Subproject commit 288cca1bf02679313aec1bc7ba168ced9026a003