diff --git a/conf/distro/cml-base.conf b/conf/distro/cml-base.conf
index 8f232fd..e5d8070 100644
--- a/conf/distro/cml-base.conf
+++ b/conf/distro/cml-base.conf
@@ -15,4 +15,9 @@ INITRAMFS_MAXSIZE = '${@oe.utils.vartrue('DEVELOPMENT_BUILD', "350000", "75000",
 # have it defined.
 CI_CONSOLE_REDIRECT ??= "n"
 
+# PKCS#11 backend in scd + softhsm2 module in the image. Only the dedicated CI
+# 'pkcs11' buildtype sets this to "y". Weak default so builds that do not go
+# through the local.conf template still have it defined.
+GYROIDOS_PKCS11 ??= "n"
+
 PACKAGECONFIG:remove:pn-gdb = "python"
diff --git a/conf/templates/default/local.conf.sample b/conf/templates/default/local.conf.sample
index 137fb58..3b80e8e 100644
--- a/conf/templates/default/local.conf.sample
+++ b/conf/templates/default/local.conf.sample
@@ -22,6 +22,7 @@ GYROIDOS_BNSE = "##GYROIDOS_BNSE##"
 GYROIDOS_A_B_UPDATE = "##GYROIDOS_A_B_UPDATE##"
 GYROIDOS_SANITIZERS = "##GYROIDOS_SANITIZERS##"
 GYROIDOS_PLAIN_DATAPART = "##GYROIDOS_PLAIN_DATAPART##"
+GYROIDOS_PKCS11 = "##GYROIDOS_PKCS11##"
 
 USER_CLASSES ?= "buildstats"
 
diff --git a/images/gyroidos-cml-initramfs.bb b/images/gyroidos-cml-initramfs.bb
index bddb552..b50d577 100644
--- a/images/gyroidos-cml-initramfs.bb
+++ b/images/gyroidos-cml-initramfs.bb
@@ -22,6 +22,11 @@ PACKAGE_INSTALL = "\
 	pv \
 "
 
+# PKCS#11 module scd dlopens at runtime; shipped only in the 'pkcs11' image.
+# oe.utils.conditional (not vartrue) so an unreplaced "##GYROIDOS_PKCS11##"
+# placeholder degrades to the else-branch instead of failing every parse.
+PACKAGE_INSTALL:append = '${@oe.utils.conditional('GYROIDOS_PKCS11', 'y', ' softhsm', '', d)}'
+
 # Install additional packages for debugging purposes if DEVELOPMENT_BUILD is set
 DEBUG_PACKAGES = "\
 	base-passwd \
diff --git a/images/gyroidos-cml.bb b/images/gyroidos-cml.bb
index 3a4855f..805ecd0 100644
--- a/images/gyroidos-cml.bb
+++ b/images/gyroidos-cml.bb
@@ -25,6 +25,10 @@ prepare_device_conf () {
             bbwarn "Setting for signed_configs already specified, leaving unchanged..."
         fi
     fi
+
+    if [ "y" = "${GYROIDOS_PKCS11}" ]; then
+        echo 'scd_env: "SOFTHSM2_CONF=/data/cml/tokens/softhsm2.conf"' >> ${WORKDIR}/device.conf
+    fi
 }
 #IMAGE_PREPROCESS_COMMAND:append = " prepare_device_conf;"
 
@@ -39,6 +43,25 @@ do_rootfs:prepend () {
 	do_sign_guestos
 }
 
+# PKCS#11 (softhsm2) runtime state on the data partition, 'pkcs11' image only.
+# Ships just the module-dir symlink, the softhsm2 config and an empty tokendir:
+# scd initializes its own token (label = container UUID) and wrapping key per
+# container at first pairing, so no token or key is provisioned at build time.
+# The symlink is mandatory — /data is mounted noexec, a module copied there
+# would fail dlopen; the .so itself lives in the initramfs root.
+install_pkcs11_data () {
+	if [ "y" = "${GYROIDOS_PKCS11}" ]; then
+		install -d ${IMAGE_ROOTFS}/userdata/cml/pkcs11
+		ln -sf /usr/lib/softhsm/libsofthsm2.so ${IMAGE_ROOTFS}/userdata/cml/pkcs11/libsofthsm2.so
+		install -d ${IMAGE_ROOTFS}/userdata/cml/tokens/softhsm
+		echo "directories.tokendir = /data/cml/tokens/softhsm" > ${IMAGE_ROOTFS}/userdata/cml/tokens/softhsm2.conf
+	fi
+}
+
+do_rootfs:append () {
+	install_pkcs11_data
+}
+
 GUESTS_OUT = "${B}/cml_updates"
 CLEAN_GUEST_OUT = ""
 OS_NAME = "kernel"
diff --git a/recipes-gyroidos/cmld/cmld_git.bb b/recipes-gyroidos/cmld/cmld_git.bb
index 28752e7..a8be132 100644
--- a/recipes-gyroidos/cmld/cmld_git.bb
+++ b/recipes-gyroidos/cmld/cmld_git.bb
@@ -12,6 +12,7 @@ DEPENDS = "protobuf-c-native protobuf-c protobuf-c-text e2fsprogs openssl ibmtss
 EXTRA_OEMAKE = "GYROIDOS_HARDWARE=${GYROIDOS_HARDWARE}"
 EXTRA_OEMAKE += "SCHSM=${GYROIDOS_SCHSM}"
 EXTRA_OEMAKE += "BNSE=${GYROIDOS_BNSE}"
+EXTRA_OEMAKE += "PKCS11=${GYROIDOS_PKCS11}"
 EXTRA_OEMAKE += "A_B_UPDATE=${GYROIDOS_A_B_UPDATE}"
 EXTRA_OEMAKE += "SANITIZERS=${GYROIDOS_SANITIZERS}"
 EXTRA_OEMAKE += "DEVELOPMENT_BUILD=${DEVELOPMENT_BUILD}"