diff --git a/firmware/src/provisioning.cpp b/firmware/src/provisioning.cpp
new file mode 100644
index 0000000..8e8d4c6
--- /dev/null
+++ b/firmware/src/provisioning.cpp
@@ -0,0 +1,24 @@
+// firmware/src/provisioning.cpp
+#include "provisioning.h"
+#include "config.h"
+#include <WiFiManager.h>
+
+bool provisioning_run(uint32_t timeout_ms) {
+    WiFiManager wm;
+    wm.setConfigPortalTimeout(timeout_ms / 1000);
+    wm.setTitle("DoorCounter Setup");
+    wm.setCustomHeadElement(
+        "<style>"
+        "body{font-family:sans-serif;max-width:400px;margin:40px auto;padding:0 16px}"
+        "h1{font-size:1.2em;color:#333}"
+        "p{color:#666;font-size:.9em}"
+        "</style>"
+    );
+
+    bool connected = wm.startConfigPortal("DoorCounter-Setup");
+
+    if (connected) {
+        config_save_wifi(wm.getWiFiSSID(), wm.getWiFiPass());
+    }
+    return connected;
+}
diff --git a/firmware/src/provisioning.h b/firmware/src/provisioning.h
new file mode 100644
index 0000000..b20628c
--- /dev/null
+++ b/firmware/src/provisioning.h
@@ -0,0 +1,7 @@
+// firmware/src/provisioning.h
+#pragma once
+#include <stdint.h>
+
+// Start WiFi captive portal AP and block until user submits credentials
+// or timeout_ms elapses. Returns true if WiFi credentials were saved.
+bool provisioning_run(uint32_t timeout_ms = 5 * 60 * 1000);