diff --git a/meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-security/optee/optee-client/tee-supplicant b/meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-security/optee/optee-client/tee-supplicant
new file mode 100644
index 000000000..80c817279
--- /dev/null
+++ b/meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-security/optee/optee-client/tee-supplicant
@@ -0,0 +1 @@
+OPTARGS="--fs-parent-path=/mnt/data/tee"
diff --git a/meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-security/optee/optee-client_4.0.bb b/meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-security/optee/optee-client_4.0.bb
index 56cd5d197..682613298 100755
--- a/meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-security/optee/optee-client_4.0.bb
+++ b/meta-digi-arm/dynamic-layers/stm-st-stm32mp/recipes-security/optee/optee-client_4.0.bb
@@ -10,6 +10,7 @@ SRC_URI = "git://github.com/OP-TEE/optee_client.git;protocol=https;branch=master
            file://tee-supplicant.service \
            file://create-tee-supplicant-env \
            file://optee-udev.rules \
+           ${@oe.utils.vartrue('TRUSTFENCE_FILE_BASED_ENCRYPT', 'file://tee-supplicant', '', d)} \
     "
 
 SRCREV = "acb0885c117e73cb6c5c9b1dd9054cb3f93507ee"
@@ -43,6 +44,10 @@ do_install:append() {
 
         install -D -p -m0644 ${WORKDIR}/tee-supplicant.service ${D}${systemd_system_unitdir}/tee-supplicant.service
         install -D -p -m0755 ${WORKDIR}/create-tee-supplicant-env ${D}${sbindir}/
+        if ${@oe.utils.vartrue('TRUSTFENCE_FILE_BASED_ENCRYPT', 'true', 'false',d)}; then
+            install -d ${D}${sysconfdir}/default/
+            install -m 0644 ${WORKDIR}/tee-supplicant ${D}${sysconfdir}/default/tee-supplicant
+        fi
     fi
     install -d ${D}${sysconfdir}/udev/rules.d
     install -m 0644 ${WORKDIR}/optee-udev.rules ${D}${sysconfdir}/udev/rules.d/optee.rules