diff --git a/common/u-boot_setup-mediatek.sh b/common/u-boot_setup-mediatek.sh
new file mode 100755
index 00000000..af30a145
--- /dev/null
+++ b/common/u-boot_setup-mediatek.sh
@@ -0,0 +1,73 @@
+#!/bin/bash
+
+maskrom() {
+    pushd "$SCRIPT_DIR"
+    aiot-bootrom
+    popd
+}
+
+update_bootloader() {
+    local DEVICE=$1
+
+    dd conv=notrunc,fsync if="$SCRIPT_DIR/u-boot.bin.sd.bin" of=$DEVICE bs=1 count=444
+    dd conv=notrunc,fsync if="$SCRIPT_DIR/u-boot.bin.sd.bin" of=$DEVICE bs=512 skip=1 seek=1
+    sync "$DEVICE"
+}
+
+update_emmc_boot() {
+    if [[ -f "/sys/class/block/$(basename "$1")/force_ro" ]]
+    then
+        echo 0 > "/sys/class/block/$(basename "$1")/force_ro"
+    fi
+    update_bootloader "$@"
+}
+
+maskrom_update_bootloader() {
+    fastboot flash mmc0boot1 "$SCRIPT_DIR/u-boot.bin"
+    fastboot erase mmc0boot2
+}
+
+maskrom_erase_bootloader() {
+    fastboot erase mmc0boot1
+    fastboot erase mmc0boot2
+}
+
+# https://stackoverflow.com/a/28776166
+is_sourced() {
+    if [ -n "$ZSH_VERSION" ]
+    then 
+        case $ZSH_EVAL_CONTEXT in
+            *:file:*)
+                return 0
+                ;;
+        esac
+    else  # Add additional POSIX-compatible shell names here, if needed.
+        case ${0##*/} in
+            dash|-dash|bash|-bash|ksh|-ksh|sh|-sh)
+                return 0
+                ;;
+        esac
+    fi
+    return 1  # NOT sourced.
+}
+
+if ! is_sourced
+then
+
+    set -euo pipefail
+    shopt -s nullglob
+
+    SCRIPT_DIR="$(dirname "$(realpath "$0")")"
+
+    ACTION="$1"
+    shift
+
+    if [[ $(type -t $ACTION) == function ]]
+    then
+        $ACTION "$@"
+    else
+        echo "Unsupported action: '$ACTION'" >&2
+        exit 100
+    fi
+
+fi
diff --git a/container/Dockerfile b/container/Dockerfile
index a641b327..e7cc5b94 100644
--- a/container/Dockerfile
+++ b/container/Dockerfile
@@ -1,8 +1,8 @@
 # syntax=docker/dockerfile:1
 
-# This appears to be required for local Podman image
-# But breaks GitHub CI for image building
-# ARG TARGETARCH
+# Podman appears does not support ${TARGETARCH} in FROM
+# as such you need to comment out every FROM except the first one
+# so you won't rebuild previous layers
 
 FROM debian:bullseye as base-arm64
 RUN apt-get update && \
@@ -12,6 +12,7 @@ RUN apt-get update && \
         build-essential gcc-arm-none-eabi git ruby sudo apt-utils \
         python3 python2 python-is-python2 curl debhelper \
         python3-distutils python3-pkg-resources python3-setuptools python3-pyelftools python3-ply python3-git \
+        python3-cryptography \
         cpio bc flex fakeroot bison rsync kmod swig device-tree-compiler u-boot-tools \
         python2-dev python3-dev libssl-dev uuid-dev libgnutls28-dev
 
@@ -19,7 +20,8 @@ FROM base-arm64 as base-amd64
 RUN dpkg --add-architecture arm64 && \
     apt-get update && \
     apt-get full-upgrade --no-install-recommends -y \
-        crossbuild-essential-arm64 libc6:arm64 libssl-dev:arm64
+        crossbuild-essential-arm64 libc6:arm64 libssl-dev:arm64 \
+        python3-cryptography:arm64
 
 FROM base-${TARGETARCH} as output
 RUN gem install fpm && \
diff --git a/lib/u-boot.sh b/lib/u-boot.sh
index 9c2b75dd..b3a7b1c6 100644
--- a/lib/u-boot.sh
+++ b/lib/u-boot.sh
@@ -25,6 +25,11 @@ bsp_reset() {
     RKMINILOADER=
     UBOOT_BASE_ADDR=
     USE_ATF="false"
+
+    BSP_MTK_LK_PROJECT=
+    BSP_MTK_LIBDRAM_BOARD_NAME=
+    BSP_OPTEE_DRAM_SIZE=
+    BSP_UFS_BOOT="false"
 }
 
 bsp_version() {
@@ -113,6 +118,43 @@ bsp_prepare() {
                 fi
             fi
             ;;
+        mediatek)
+            make -C "$SCRIPT_DIR/.src/mtk-optee" -j$(nproc) \
+                CROSS_COMPILE_core=$CROSS_COMPILE \
+                CROSS_COMPILE_ta_arm64=$CROSS_COMPILE \
+                PLATFORM=mediatek \
+                CFG_DRAM_SIZE=$BSP_OPTEE_DRAM_SIZE \
+                CFG_TZDRAM_START=0x43200000 \
+                CFG_TZDRAM_SIZE=0x00a00000 \
+                SOC_PLATFORM=$BSP_BL31_OVERRIDE \
+                CFG_TEE_CORE_LOG_LEVEL=3 CFG_UART_ENABLE=y \
+                CFG_ARM64_core=y \
+                ta-targets=ta_arm64
+                #CONSOLE_BAUDRATE=115200
+
+            local atf_extra_option=()
+            if "$BSP_UFS_BOOT"
+            then
+                atf_extra_option+=("STORAGE_UFS=1")
+            fi
+
+            make -C "$SCRIPT_DIR/.src/mtk-atf" -j$(nproc) CROSS_COMPILE=$CROSS_COMPILE \
+                E=0 "${atf_extra_option[@]}" \
+                PLAT=$BSP_BL31_OVERRIDE \
+                TFA_PLATFORM=$BSP_BL31_OVERRIDE \
+                TFA_SPD=opteed \
+                LIBDRAM=$SCRIPT_DIR/.src/libdram-prebuilt/$BSP_MTK_LIBDRAM_BOARD_NAME/libdram.a \
+                LIBBASE=$SCRIPT_DIR/.src/libbase-prebuilt/$BSP_BL31_OVERRIDE/libbase.a \
+                NEED_BL32=yes CFLAGS+=-DNEED_BL32\
+                BL32=$SCRIPT_DIR/.src/mtk-optee/out/arm-plat-mediatek/core/tee.bin
+                #NEED_BL33=yes \
+                #BL33=$SCRIPT_DIR/.src/u-boot/u-boot.bin
+
+            BSP_MAKE_EXTRA+=("BL31=$SCRIPT_DIR/.src/mtk-atf/build/$BSP_BL31_OVERRIDE/release/bl31/bl31.elf")
+            ;;
+        *)
+            error $EXIT_UNSUPPORTED_OPTION "$soc_family"
+            ;;
     esac
 }
 
@@ -214,6 +256,24 @@ bsp_preparedeb() {
             rkpack_rkboot
             cp "$TARGET_DIR/idbloader-spi"*".img" "$TARGET_DIR/idbloader.img" "$SCRIPT_DIR/.root/usr/lib/u-boot/$BSP_BOARD_OVERRIDE/"
             ;;
+        mediatek)
+            cp "$SCRIPT_DIR/.src/mtk-atf/build/$BSP_BL31_OVERRIDE/release/bl2.bin" "$SCRIPT_DIR/.root/usr/lib/u-boot/$BSP_BOARD_OVERRIDE/"
+            truncate -s%4 "$SCRIPT_DIR/.root/usr/lib/u-boot/$BSP_BOARD_OVERRIDE/bl2.bin"
+
+            local media="emmc"
+            if "$BSP_UFS_BOOT"
+            then
+                media="ufs"
+            fi
+            "$TARGET_DIR/tools/mkimage" -T mtk_image -a 0x201000 -e 0x201000 -n "media=$media;arm64=1" \
+                -d "$SCRIPT_DIR/.root/usr/lib/u-boot/$BSP_BOARD_OVERRIDE/bl2.bin" \
+                "$SCRIPT_DIR/.root/usr/lib/u-boot/$BSP_BOARD_OVERRIDE/bl2.img"
+            rm "$SCRIPT_DIR/.root/usr/lib/u-boot/$BSP_BOARD_OVERRIDE/bl2.bin"
+
+            cp "$SCRIPT_DIR/.src/lk-prebuilt/$BSP_MTK_LK_PROJECT/lk.bin" "$SCRIPT_DIR/.root/usr/lib/u-boot/$BSP_BOARD_OVERRIDE/"
+
+            cp "$TARGET_DIR/u-boot.bin" "$TARGET_DIR/u-boot-mtk.bin" "$SCRIPT_DIR/.root/usr/lib/u-boot/$BSP_BOARD_OVERRIDE/"
+            ;;
         *)
             error $EXIT_UNSUPPORTED_OPTION "$soc_family"
             ;;
diff --git a/lib/utils.sh b/lib/utils.sh
index afd7e1a6..bdb1bcd3 100644
--- a/lib/utils.sh
+++ b/lib/utils.sh
@@ -286,10 +286,13 @@ apply_kconfig() {
 get_soc_family() {
     case "$1" in
         rk*)
-            echo rockchip
+            echo "rockchip"
             ;;
         s905y2|a311d)
-            echo amlogic
+            echo "amlogic"
+            ;;
+        mt*)
+            echo "mediatek"
             ;;
         *)
             error $EXIT_UNSUPPORTED_OPTION "$1"
@@ -324,6 +327,7 @@ bsp_build() {
     
     if ! $NO_CONFIG
     then
+        echo "Initialize .config with $BSP_DEFCONFIG"
         bsp_make "${BSP_MAKE_DEFINES[@]}" $BSP_DEFCONFIG 2>&1 | tee -a "$SCRIPT_DIR/.src/build.log"
         for d in $(find -L "$SCRIPT_DIR/$TARGET/$FORK" -mindepth 1 -type d | sort)
         do
diff --git a/u-boot/.mediatek/0001-firmware/mtk.sh b/u-boot/.mediatek/0001-firmware/mtk.sh
new file mode 100644
index 00000000..fa724e27
--- /dev/null
+++ b/u-boot/.mediatek/0001-firmware/mtk.sh
@@ -0,0 +1,9 @@
+custom_source_action() {
+    # mtk-v2.6
+    git_source "https://gitlab.com/mediatek/aiot/bsp/trusted-firmware-a.git" "11a3e271252e3f7583046615c1e8b3b33533d636" "mtk-atf"
+    # mtk-v3.19
+    git_source "https://gitlab.com/mediatek/aiot/bsp/optee-os.git" "8b7fb28b69f45208500847af1975da26a225c02a" "mtk-optee"
+    git_source "https://gitlab.com/mediatek/aiot/rity/lk-prebuilt.git" "c76361b2704e12d41fb9082aae03f9b68aa9e9a4"
+    git_source "https://gitlab.com/mediatek/aiot/rity/libdram-prebuilt.git" "df294e73ab8064cbb8da3f3987f4d8829dd9fa73"
+    git_source "https://gitlab.com/mediatek/aiot/bsp/libbase-prebuilt.git" "6a47bf6b96e1f51776ea397703d381e34a1596c4"
+}
\ No newline at end of file
diff --git a/u-boot/.mediatek/fork.conf b/u-boot/.mediatek/fork.conf
new file mode 100644
index 00000000..afff80c5
--- /dev/null
+++ b/u-boot/.mediatek/fork.conf
@@ -0,0 +1,23 @@
+BSP_GIT="https://gitlab.com/mediatek/aiot/bsp/u-boot.git"
+BSP_BRANCH="mtk-v2022.10"
+USE_ATF="true"
+SUPPORTED_BOARDS=("radxa-nio-12l" "radxa-nio-12l-ufs")
+
+bsp_mt8395() {
+    BSP_SOC="mt8395"
+    BSP_BL31_OVERRIDE="mt8195"
+    BSP_OPTEE_DRAM_SIZE="0x200000000"
+}
+
+bsp_radxa-nio-12l() {
+    bsp_mt8395
+    BSP_MTK_LK_PROJECT="mt8395-demo"
+    BSP_MTK_LIBDRAM_BOARD_NAME="mt8395-demo"
+}
+
+bsp_radxa-nio-12l-ufs() {
+    bsp_mt8395
+    BSP_MTK_LK_PROJECT="mt8395-evk-ufs"
+    BSP_MTK_LIBDRAM_BOARD_NAME="genio-1200-evk-ufs"
+    BSP_UFS_BOOT="true"
+}