diff --git a/check-routeros-update b/check-routeros-update
index 0309730..d21a7d0 100644
--- a/check-routeros-update
+++ b/check-routeros-update
@@ -12,6 +12,7 @@
 
 :global Identity;
 :global SafeUpdateNeighbor;
+:global SafeUpdateOnCap;
 :global SafeUpdatePatch;
 :global SafeUpdateUrl;
 :global SentRouterosUpdateNotification;
@@ -37,7 +38,8 @@ $WaitFullyConnected;
 
 :if ([ :len [ / system package find where name="wireless" disabled=no ] ] > 0) do={
   :if ([ / interface wireless cap get enabled ] = true && \
-      [ / caps-man manager get enabled ] = false) do={
+       [ / caps-man manager get enabled ] = false && \
+       $SafeUpdateOnCap != true) do={
     $LogPrintExit2 error $0 ("System is managed by CAPsMAN, not checking for RouterOS version.") true;
   }
 }
diff --git a/doc/check-routeros-update.md b/doc/check-routeros-update.md
index 92ff1b1..5ebdede 100644
--- a/doc/check-routeros-update.md
+++ b/doc/check-routeros-update.md
@@ -42,6 +42,7 @@ safe versions from a web server. The configuration goes to
 `global-config-overlay`, this is the parameter:
 
 * `SafeUpdateNeighbor`: install updates automatically if seen in neighbor list
+* `SafeUpdateOnCap`: check for updates even if device is managed by CAPsMAN
 * `SafeUpdatePatch`: install patch updates automatically
 * `SafeUpdateUrl`: url to check for safe update, the channel (`long-term`,
 `stable` or `testing`) is appended
diff --git a/global-config b/global-config
index f411d14..06f43e0 100644
--- a/global-config
+++ b/global-config
@@ -8,7 +8,7 @@
 
 # Make sure all configuration properties are up to date and this
 # value is in sync with value in script 'global-functions'!
-:global GlobalConfigVersion 58;
+:global GlobalConfigVersion 59;
 
 # This is used for DNS and backup file.
 :global Domain "example.com";
@@ -92,6 +92,8 @@
 :global SafeUpdatePatch false;
 # Allow to install updates automatically if seen in neighbor list.
 :global SafeUpdateNeighbor false;
+# Allow to install updates even if device is managed by CAPsMAN.
+:global SafeUpdateOnCap false;
 
 # These thresholds control when to send health notification
 # on temperature and voltage.
diff --git a/global-config-overlay b/global-config-overlay
index 202db89..0888452 100644
--- a/global-config-overlay
+++ b/global-config-overlay
@@ -8,7 +8,7 @@
 # Make sure all configuration properties are up to date and this
 # value is in sync with value in script 'global-functions'!
 # Comment or remove to disable news and change notifications.
-:global GlobalConfigVersion 58;
+:global GlobalConfigVersion 59;
 
 # Copy configuration from global-config here and modify it.
 
diff --git a/global-config.changes b/global-config.changes
index 3fe213b..0cc6b1e 100644
--- a/global-config.changes
+++ b/global-config.changes
@@ -62,6 +62,7 @@
   56="Added tags in all backup, lease and ppp-on-up scripts. These are used by 'packages-update', 'lease-script' and 'ppp-on-up' to find the scripts.";
   57="Celebrating the 1.000th commit - Hooray!";
   58="Added a cleanup script for 'hotspot-to-wpa' to purge old access list entries.";
+  59="Updating CAP with 'check-routeros-update' is now possible with opt-in.";
 };
 
 # Migration steps to be applied on script updates
diff --git a/global-functions b/global-functions
index e7080e4..d11f8e2 100644
--- a/global-functions
+++ b/global-functions
@@ -8,7 +8,7 @@
 # https://git.eworm.de/cgit/routeros-scripts/about/
 
 # expected configuration version
-:global ExpectedConfigVersion 58;
+:global ExpectedConfigVersion 59;
 
 # global variables not to be changed by user
 :global GlobalFunctionsReady false;