diff --git a/openwrt/openwrt-add-ipv6-remote-management.sh b/openwrt/openwrt-add-ipv6-remote-management.sh
new file mode 100755
index 0000000..97edbf9
--- /dev/null
+++ b/openwrt/openwrt-add-ipv6-remote-management.sh
@@ -0,0 +1,80 @@
+#!/bin/sh
+# 2025-10-27
+# Add 1 (!) IPv6 address for remotely accessing a device
+# Not intended to be shared, just for the router/device itself
+
+values_yaml=~/vcs/k8s-config/apps/prod/bird-router/values.yaml
+
+if [ $# -lt 2 ]; then
+    echo "$0 host ipv6-address [private-key]"
+    echo "    host: where to find the OpenWRT device"
+    echo "    ipv4-address: which ipv4 address to use"
+    echo "    private-key: Use this wireguard key instead of generating one"
+    echo ""
+    echo "f.i.: $0 fe80::9683:c4ff:fe0f:%eth0 2a0a:e5c1:b00:100::42"
+    exit 1
+fi
+
+my_ip=$1; shift
+my_wireguard_ip=$1; shift
+
+if [ $# -eq 1 ]; then
+    private_key=$1; shift
+else
+    private_key=$(wg genkey)
+fi
+public_key=$(echo $private_key | wg pubkey)
+
+case $my_wireguard_ip in
+    2a0a:e5c1:b00:*)
+        vpn_endpoint_host="vpn-2a0ae5c1b00.ungleich.ch"
+        vpn_endpoint_pubkey="6XKJ4en+FqQg9rrHBDE8tf1q6NMuruHG4R34jdX2nTE="
+    ;;
+    *)
+        echo "Unknown VPN host for IP $my_wireguard_ip" >&2
+        exit 1
+        ;;
+esac
+
+interface="ipv6ra"
+
+cat <<EOF | ssh -t "root@${my_ip}"
+set -x
+
+opkg update
+opkg install libustream-openssl ca-bundle ca-certificates
+opkg install wireguard
+opkg install luci-app-wireguard
+
+uci set network.${interface}=interface
+uci set network.${interface}.proto='wireguard'
+uci set network.${interface}.private_key='${private_key}'
+uci set network.${interface}.addresses='${my_wireguard_ip}/128'
+
+if ! uci get network.@wireguard_${interface}[0]; then
+   uci add network wireguard_${interface}
+fi
+
+uci set network.@wireguard_${interface}[0]=wireguard_${interface}
+uci set network.@wireguard_${interface}[0].persistent_keepalive='25'
+uci set network.@wireguard_${interface}[0].public_key="${vpn_endpoint_pubkey}"
+uci set network.@wireguard_${interface}[0].description="IPv6 RA"
+uci set network.@wireguard_${interface}[0].allowed_ips='::/0'
+uci set network.@wireguard_${interface}[0].endpoint_host="${vpn_endpoint_host}"
+uci set network.@wireguard_${interface}[0].endpoint_port='51820'
+uci set network.@wireguard_${interface}[0].route_allowed_ips='1'
+
+# add to correct firewall zone
+current_networks=\$(uci get firewall.@zone[1].network)
+
+if ! echo \$current_networks | grep -q ${interface}; then
+   uci set firewall.@zone[1].network="\${current_networks} ${interface}"
+fi
+
+# commit
+uci commit
+
+EOF
+
+echo "Host ${my_ip} uses ip ${my_wireguard_ip}"
+echo "Public key = ${public_key}:"