diff --git a/conf/distro/cip-core-bookworm.conf b/conf/distro/cip-core-bookworm.conf
index de2e435..f05d3d3 100644
--- a/conf/distro/cip-core-bookworm.conf
+++ b/conf/distro/cip-core-bookworm.conf
@@ -12,5 +12,6 @@
 require conf/distro/debian-bookworm.conf
 require cip-core-common.inc
 
+PREFERRED_VERSION_swupdate ?= "2022.12%"
 PREFERRED_VERSION_linux-cip ?= "5.10.%"
 PREFERRED_VERSION_linux-cip-rt ?= "5.10.%"
diff --git a/conf/distro/cip-core-bullseye.conf b/conf/distro/cip-core-bullseye.conf
index 3a0550c..9c83054 100644
--- a/conf/distro/cip-core-bullseye.conf
+++ b/conf/distro/cip-core-bullseye.conf
@@ -12,5 +12,9 @@
 require conf/distro/debian-bullseye.conf
 require cip-core-common.inc
 
+DISTRO_APT_SOURCES:append:swupdate = " conf/distro/debian-bullseye-backports.list"
+DISTRO_APT_PREFERENCES:append:swupdate = " conf/distro/preferences.swupdate-bullseye-backports.conf"
+
+PREFERRED_VERSION_swupdate ?= "2022.12%"
 PREFERRED_VERSION_linux-cip ?= "5.10.%"
 PREFERRED_VERSION_linux-cip-rt ?= "5.10.%"
diff --git a/conf/distro/cip-core-buster.conf b/conf/distro/cip-core-buster.conf
index c5cb39c..4e9a4a7 100644
--- a/conf/distro/cip-core-buster.conf
+++ b/conf/distro/cip-core-buster.conf
@@ -12,5 +12,6 @@
 require conf/distro/debian-buster.conf
 require cip-core-common.inc
 
+PREFERRED_VERSION_swupdate ?= "2021.11%"
 PREFERRED_VERSION_linux-cip ?= "4.19.%"
 PREFERRED_VERSION_linux-cip-rt ?= "4.19.%"
diff --git a/conf/distro/preferences.swupdate-bullseye-backports.conf b/conf/distro/preferences.swupdate-bullseye-backports.conf
new file mode 100644
index 0000000..a2377bb
--- /dev/null
+++ b/conf/distro/preferences.swupdate-bullseye-backports.conf
@@ -0,0 +1,3 @@
+Package: dh-nodejs
+Pin: release n=bullseye-backports
+Pin-Priority: 801
diff --git a/kas/opt/swupdate.yml b/kas/opt/swupdate.yml
index 29b7dd6..1528b09 100644
--- a/kas/opt/swupdate.yml
+++ b/kas/opt/swupdate.yml
@@ -17,6 +17,7 @@ header:
 local_conf_header:
   image-option-swupdate: |
     CIP_IMAGE_OPTIONS:append = " swupdate.inc"
+    OVERRIDES .= ":swupdate"
 
   wic-swu: |
     IMAGE_TYPEDEP:wic += "squashfs"
diff --git a/recipes-core/swupdate/files/0001-d-rules-Add-option-for-suricatta_lua.patch b/recipes-core/swupdate/files/0001-d-rules-Add-option-for-suricatta_lua.patch
new file mode 100644
index 0000000..0be5a71
--- /dev/null
+++ b/recipes-core/swupdate/files/0001-d-rules-Add-option-for-suricatta_lua.patch
@@ -0,0 +1,30 @@
+From 00fc691802e671594cea1d0a5e880d255e04b7f0 Mon Sep 17 00:00:00 2001
+From: Quirin Gylstorff <quirin.gylstorff@siemens.com>
+Date: Wed, 3 May 2023 16:02:37 +0200
+Subject: [PATCH] d/rules: Add option for suricatta_lua
+
+This allows to use lua plugins as suricatta backends. It is optional
+as it overrides the default HAWKBIT backend.
+
+Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
+---
+ debian/rules | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/debian/rules b/debian/rules
+index 57da4ca7..91106fbd 100755
+--- a/debian/rules
++++ b/debian/rules
+@@ -56,6 +56,9 @@ endif
+ ifneq (,$(filter pkg.swupdate.p11,$(DEB_BUILD_PROFILES)))
+ 	echo CONFIG_PKCS11=y >> configs/debian_defconfig
+ endif
++ifneq (,$(filter pkg.swupdate.suricattalua,$(DEB_BUILD_PROFILES)))
++	echo CONFIG_SURICATTA_LUA=y >> configs/debian_defconfig
++endif
+ ifneq (,$(LUA_VERSION))
+ 	echo CONFIG_LUAPKG=\"lua$(LUA_VERSION)\" >> configs/debian_defconfig
+ 	echo CONFIG_LUASCRIPTHANDLER=y           >> configs/debian_defconfig
+-- 
+2.39.2
+
diff --git a/recipes-core/swupdate/swupdate_2022.12+dfsg-4-gbp.bb b/recipes-core/swupdate/swupdate_2022.12+dfsg-4-gbp.bb
new file mode 100644
index 0000000..f5478a3
--- /dev/null
+++ b/recipes-core/swupdate/swupdate_2022.12+dfsg-4-gbp.bb
@@ -0,0 +1,35 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2023
+#
+# Authors:
+#  Quirin Gylstorff <quirin.gylstorff@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+
+inherit dpkg-gbp
+
+require swupdate.inc
+
+DEPENDS += "libebgenv-dev"
+
+DEB_BUILD_PROFILES += "nodoc"
+DEB_BUILD_OPTIONS += "nodoc"
+
+SRC_URI = "git://salsa.debian.org/debian/swupdate.git;protocol=https;branch=debian/master"
+SRCREV ="aa9edf070567fa5b3e942c270633a8feef49dad8"
+SRC_URI += "file://0001-d-rules-Add-option-for-suricatta_lua.patch"
+
+# deactivate signing and hardware compability for simple a/b rootfs update
+DEB_BUILD_PROFILES += "pkg.swupdate.nosigning"
+DEB_BUILD_PROFILES += "pkg.swupdate.nohwcompat"
+DEB_BUILD_PROFILES:append:suricatta-lua = " pkg.swupdate.suricattalua"
+
+# Disable cross for arm and arm64 on bullseye
+ISAR_CROSS_COMPILE:bullseye = "0"
+
+# add cross build and deactivate testing for arm based builds
+DEB_BUILD_PROFILES += "cross nocheck"
+DEB_BUILD_PROFILES:append:bullseye = " pkg.swupdate.bpo"
+
