diff --git a/emulator/bthost.c b/emulator/bthost.c
index d18ca49..74b5df9 100644
--- a/emulator/bthost.c
+++ b/emulator/bthost.c
@@ -110,6 +110,7 @@ struct bthost {
 	struct l2cap_pending_req *l2reqs;
 	uint8_t pin[16];
 	uint8_t pin_len;
+	uint8_t io_capability;
 };
 
 struct bthost *bthost_create(void)
@@ -776,7 +777,7 @@ static void evt_io_cap_request(struct bthost *bthost, const void *data,
 		return;
 
 	memcpy(cp.bdaddr, ev->bdaddr, 6);
-	cp.capability = 0x03;
+	cp.capability = bthost->io_capability;
 	cp.oob_data = 0x00;
 	cp.authentication = 0x00;
 
@@ -1503,6 +1504,11 @@ void bthost_set_pin_code(struct bthost *bthost, const uint8_t *pin,
 	bthost->pin_len = pin_len;
 }
 
+void bthost_set_io_capability(struct bthost *bthost, uint8_t io_capability)
+{
+	bthost->io_capability = io_capability;
+}
+
 void bthost_start(struct bthost *bthost)
 {
 	if (!bthost)
diff --git a/emulator/bthost.h b/emulator/bthost.h
index 36b8c92..a3ecb1a 100644
--- a/emulator/bthost.h
+++ b/emulator/bthost.h
@@ -84,6 +84,7 @@ void bthost_add_l2cap_server(struct bthost *bthost, uint16_t psm,
 
 void bthost_set_pin_code(struct bthost *bthost, const uint8_t *pin,
 							uint8_t pin_len);
+void bthost_set_io_capability(struct bthost *bthost, uint8_t io_capability);
 
 void bthost_start(struct bthost *bthost);
 void bthost_stop(struct bthost *bthost);