diff --git a/devices/hi3518ev200_lite_baolian-11r6w25-hx20y/br-ext-chip-hisilicon/board/hi3516cv200/hi3518ev200.generic.config b/devices/hi3518ev200_lite_baolian-11r6w25-hx20y/br-ext-chip-hisilicon/board/hi3516cv200/hi3518ev200.generic.config
index 559730985..5f4d63f80 100644
--- a/devices/hi3518ev200_lite_baolian-11r6w25-hx20y/br-ext-chip-hisilicon/board/hi3516cv200/hi3518ev200.generic.config
+++ b/devices/hi3518ev200_lite_baolian-11r6w25-hx20y/br-ext-chip-hisilicon/board/hi3516cv200/hi3518ev200.generic.config
@@ -761,7 +761,7 @@ CONFIG_CFG80211=m
 CONFIG_CFG80211_DEFAULT_PS=y
 # CONFIG_CFG80211_INTERNAL_REGDB is not set
 CONFIG_CFG80211_CRDA_SUPPORT=y
-# CONFIG_CFG80211_WEXT is not set
+CONFIG_CFG80211_WEXT=y
 # CONFIG_LIB80211 is not set
 CONFIG_MAC80211=m
 CONFIG_MAC80211_HAS_RC=y
diff --git a/devices/hi3518ev200_lite_baolian-11r6w25-hx20y/general/overlay/usr/bin/pelco b/devices/hi3518ev200_lite_baolian-11r6w25-hx20y/general/overlay/usr/bin/pelco
new file mode 100755
index 000000000..1bc762f56
--- /dev/null
+++ b/devices/hi3518ev200_lite_baolian-11r6w25-hx20y/general/overlay/usr/bin/pelco
@@ -0,0 +1,75 @@
+#!/bin/sh
+#
+# Pan and tilt the mount on the RS-485 header (pins 4 and 5): Pelco-D, 9600 8N1,
+# address 1. A move carries on until `pelco stop`.
+#
+#   pelco left|right|up|down [speed 0-63]
+#   pelco stop
+#
+# The 4.9 kernel here leaves UART1 disabled, and its pl011 driver could not turn
+# the RS-485 transceiver round anyway, so this drives the UART's registers. It
+# is the sequence that moved the mount on the camera in #2675. gpio 47 is the
+# transceiver's direction: high to send, low to leave the bus alone.
+
+UART=0x20090000
+
+case "$1" in
+	stop) cmd=0 pan=0 tilt=0 ;;
+	right | left | up | down)
+		speed=${2:-32}
+		# By shape, not by -gt: ash reads a leading zero as octal, and 08 would
+		# then fail in the checksum with the transceiver already in send.
+		case "$speed" in
+			[0-9] | [1-5][0-9] | 6[0-3]) ;;
+			*)
+				echo "pelco: speed is 0 to 63" >&2
+				exit 1
+				;;
+		esac
+		case "$1" in
+			right) cmd=2 pan=$speed tilt=0 ;;
+			left) cmd=4 pan=$speed tilt=0 ;;
+			up) cmd=8 pan=0 tilt=$speed ;;
+			down) cmd=16 pan=0 tilt=$speed ;;
+		esac
+		;;
+	*)
+		echo "usage: pelco left|right|up|down [speed 0-63] | pelco stop" >&2
+		exit 1
+		;;
+esac
+
+set -e
+
+devmem 0x200f00c0 32 3 # GPIO6_0 -> UART1_RXD
+devmem 0x200f00c8 32 3 # GPIO6_2 -> UART1_TXD
+devmem 0x200f00bc 32 0 # GPIO5_7 as a GPIO
+devmem 0x200300e4 32 $(($(devmem 0x200300e4) | 1 << 16))
+
+# UART1 shares the console's clock and the console runs at 115200, so 9600 is
+# twelve times its divisor, whichever clock the bootloader chose.
+div=$((($(devmem 0x20080024) * 64 + $(devmem 0x20080028)) * 12))
+devmem $((UART + 0x30)) 32 0
+devmem $((UART + 0x24)) 32 $((div / 64))
+devmem $((UART + 0x28)) 32 $((div % 64))
+devmem $((UART + 0x2c)) 32 0x70  # 8N1, FIFO on
+devmem $((UART + 0x30)) 32 0x301 # UART, TX and RX on
+
+sum=$(((1 + cmd + pan + tilt) % 256))
+
+# Whatever happens next, the transceiver goes back to listening: left in send it
+# holds the bus against everything else.
+trap 'gpio clear 47 >/dev/null' EXIT
+gpio set 47 >/dev/null
+for b in 255 1 0 "$cmd" "$pan" "$tilt" "$sum"; do
+	devmem "$UART" 32 "$b"
+done
+# Seven bytes take 7 ms at 9600, far fewer polls than this: devmem forks.
+n=0
+while [ $(($(devmem $((UART + 0x18))) & 8)) -ne 0 ]; do
+	n=$((n + 1))
+	if [ "$n" -ge 100 ]; then
+		echo "pelco: UART1 still busy, the command may not have gone out" >&2
+		exit 1
+	fi
+done
diff --git a/devices/hi3518ev200_lite_baolian-11r6w25-hx20y/general/overlay/usr/share/openipc/muxes.sh b/devices/hi3518ev200_lite_baolian-11r6w25-hx20y/general/overlay/usr/share/openipc/muxes.sh
index 9c802dd19..eac090a41 100644
--- a/devices/hi3518ev200_lite_baolian-11r6w25-hx20y/general/overlay/usr/share/openipc/muxes.sh
+++ b/devices/hi3518ev200_lite_baolian-11r6w25-hx20y/general/overlay/usr/share/openipc/muxes.sh
@@ -3,6 +3,14 @@
 ### focus coil on GPIO0_6, a pad that boots as FLASH_TRIG ###
 devmem 0x200f0008 32 0
 
+### night lamps: IR, not white ###
+# GPIO7_7 boots as SAR_ADC_CH1. It only picks which lamps may light, high for
+# IR and low for white; the camera's own light sensor switches them on and off
+# (#2675). White lights that sensor up and flashes every few seconds, so IR is
+# the default. `gpio clear 63` selects white until the next boot.
+devmem 0x200f00fc 32 1
+gpio set 63 >/dev/null
+
 ### home the lens, then park it at wide, focused at a few metres ###
 # A stepper has no idea where it is after a power cut, so this runs on every
 # boot: zoom to its tele stop, focus to its near stop, then out by the counts