diff --git a/meta/classes-recipe/kernel-fitimage.bbclass b/meta/classes-recipe/kernel-fitimage.bbclass
index 18ab17bd2c..ebe159ea03 100644
--- a/meta/classes-recipe/kernel-fitimage.bbclass
+++ b/meta/classes-recipe/kernel-fitimage.bbclass
@@ -84,6 +84,9 @@ FIT_KEY_SIGN_PKCS ?= "-x509"
 # Sign individual images as well
 FIT_SIGN_INDIVIDUAL ?= "0"
 
+# Preprocess individual fitImage binaries (kernel, dtb etc.) with an overridable `preprocess_binary` function
+FIT_PREPROCESS_BINARY ?= "0"
+
 FIT_CONF_PREFIX ?= "conf-"
 FIT_CONF_PREFIX[doc] = "Prefix to use for FIT configuration node name"
 
@@ -553,6 +556,10 @@ EOF
 EOF
 }
 
+preprocess_binary() {
+	bbfatal "Provide an implementation for 'preprocess_binary' to preprocess fitImage binaries or unset FIT_PREPROCESS_BINARY"
+}
+
 #
 # Assemble fitImage
 #
@@ -581,7 +588,14 @@ fitimage_assemble() {
 	fitimage_emit_section_maint $1 imagestart
 
 	uboot_prep_kimage
-	fitimage_emit_section_kernel $1 $kernelcount linux.bin "$linux_comp"
+	BINARY_PATH="linux.bin"
+	if [ "x${FIT_PREPROCESS_BINARY}" = "x1" ]; then
+		PROCESSED_BINARY="${BINARY_PATH}.processed"
+		preprocess_binary $BINARY_PATH $PROCESSED_BINARY
+		fitimage_emit_section_kernel $1 $kernelcount $PROCESSED_BINARY "$linux_comp"
+	else
+		fitimage_emit_section_kernel $1 $kernelcount $BINARY_PATH "$linux_comp"
+	fi
 
 	#
 	# Step 2: Prepare a DTB image section
@@ -622,7 +636,14 @@ fitimage_assemble() {
 
 			DTBS="$DTBS $DTB"
 			DTB=$(echo $DTB | tr '/' '_')
-			fitimage_emit_section_dtb $1 $DTB $DTB_PATH
+			BINARY_PATH="$DTB_PATH"
+			if [ "x${FIT_PREPROCESS_BINARY}" = "x1" ]; then
+				PROCESSED_BINARY="${BINARY_PATH}.processed"
+				preprocess_binary $BINARY_PATH $PROCESSED_BINARY
+				fitimage_emit_section_dtb $1 $DTB $PROCESSED_BINARY
+			else
+				fitimage_emit_section_dtb $1 $DTB $BINARY_PATH
+			fi
 		done
 	fi
 
@@ -646,7 +667,14 @@ fitimage_assemble() {
 			[ $(symlink_points_below $DTB "${EXTERNAL_KERNEL_DEVICETREE}") ] && continue
 
 			DTB=$(echo $DTB | tr '/' '_')
-			fitimage_emit_section_dtb $1 $DTB "${EXTERNAL_KERNEL_DEVICETREE}/$DTB"
+			BINARY_PATH="${EXTERNAL_KERNEL_DEVICETREE}/$DTB"
+			if [ "x${FIT_PREPROCESS_BINARY}" = "x1" ]; then
+				PROCESSED_BINARY="${BINARY_PATH}.processed"
+				preprocess_binary $BINARY_PATH $PROCESSED_BINARY
+				fitimage_emit_section_dtb $1 $DTB $PROCESSED_BINARY
+			else
+				fitimage_emit_section_dtb $1 $DTB $BINARY_PATH
+			fi
 		done
 	fi
 
@@ -662,7 +690,14 @@ fitimage_assemble() {
 		if [ -e "${STAGING_DIR_HOST}/boot/${UBOOT_ENV_BINARY}" ]; then
 			cp ${STAGING_DIR_HOST}/boot/${UBOOT_ENV_BINARY} ${B}
 			bootscr_id="${UBOOT_ENV_BINARY}"
-			fitimage_emit_section_boot_script $1 "$bootscr_id" ${UBOOT_ENV_BINARY}
+			BINARY_PATH="${UBOOT_ENV_BINARY}"
+			if [ "x${FIT_PREPROCESS_BINARY}" = "x1" ]; then
+				PROCESSED_BINARY="${BINARY_PATH}.processed"
+				preprocess_binary $BINARY_PATH $PROCESSED_BINARY
+				fitimage_emit_section_boot_script $1 "$bootscr_id" $PROCESSED_BINARY
+			else
+				fitimage_emit_section_boot_script $1 "$bootscr_id" $BINARY_PATH
+			fi
 		else
 			bbwarn "${STAGING_DIR_HOST}/boot/${UBOOT_ENV_BINARY} not found."
 		fi
@@ -673,7 +708,14 @@ fitimage_assemble() {
 	#
 	if [ -e ${KERNEL_OUTPUT_DIR}/setup.bin ]; then
 		setupcount=1
-		fitimage_emit_section_setup $1 $setupcount ${KERNEL_OUTPUT_DIR}/setup.bin
+		BINARY_PATH="${KERNEL_OUTPUT_DIR}/setup.bin"
+		if [ "x${FIT_PREPROCESS_BINARY}" = "x1" ]; then
+			PROCESSED_BINARY="${BINARY_PATH}.processed"
+			preprocess_binary $BINARY_PATH $PROCESSED_BINARY
+			fitimage_emit_section_setup $1 $setupcount $PROCESSED_BINARY
+		else
+			fitimage_emit_section_setup $1 $setupcount $BINARY_PATH
+		fi
 	fi
 
 	#