diff --git a/include/bluetooth/gatt.h b/include/bluetooth/gatt.h
index c0df10a1157..55c52fc3e15 100644
--- a/include/bluetooth/gatt.h
+++ b/include/bluetooth/gatt.h
@@ -138,7 +138,7 @@ struct bt_gatt_attr {
 	/** Attribute permissions */
 	uint8_t			perm;
 #if defined(CONFIG_BLUETOOTH_GATT_DYNAMIC_DB)
-	struct bt_gatt_attr	*_next;
+	sys_snode_t		node;
 #endif /* CONFIG_BLUETOOTH_GATT_DYNAMIC_DB */
 };
 
diff --git a/subsys/bluetooth/host/gatt.c b/subsys/bluetooth/host/gatt.c
index 63839d15bc1..ffa690c3481 100644
--- a/subsys/bluetooth/host/gatt.c
+++ b/subsys/bluetooth/host/gatt.c
@@ -30,19 +30,21 @@
 #include "smp.h"
 #include "gatt_internal.h"
 
-static struct bt_gatt_attr *db;
-
 #if defined(CONFIG_BLUETOOTH_GATT_CLIENT)
 static sys_slist_t subscriptions;
 #endif /* CONFIG_BLUETOOTH_GATT_CLIENT */
 
 #if !defined(CONFIG_BLUETOOTH_GATT_DYNAMIC_DB)
+static struct bt_gatt_attr *db;
 static size_t attr_count;
+#else
+static sys_slist_t db;
 #endif /* CONFIG_BLUETOOTH_GATT_DYNAMIC_DB */
 
 int bt_gatt_register(struct bt_gatt_attr *attrs, size_t count)
 {
 #if defined(CONFIG_BLUETOOTH_GATT_DYNAMIC_DB)
+	sys_slist_t list;
 	struct bt_gatt_attr *last;
 #endif /* CONFIG_BLUETOOTH_GATT_DYNAMIC_DB */
 	uint16_t handle;
@@ -55,24 +57,19 @@ int bt_gatt_register(struct bt_gatt_attr *attrs, size_t count)
 	db = attrs;
 	attr_count = count;
 #else
-	if (!db) {
-		db = attrs;
-		last = NULL;
+	sys_slist_init(&list);
+
+	if (!sys_slist_is_empty(&db)) {
 		handle = 0;
 		goto populate;
 	}
 
-	/* Fast forward to last attribute in the list */
-	for (last = db; last->_next;) {
-		last = last->_next;
-	}
-
+	last = SYS_SLIST_PEEK_TAIL_CONTAINER(&db, last, node);
 	handle = last->handle;
-	last->_next = attrs;
 
 populate:
 #endif /* CONFIG_BLUETOOTH_GATT_DYNAMIC_DB */
-	/* Populate the handles and _next pointers */
+	/* Populate the handles and append them to the list */
 	for (; attrs && count; attrs++, count--) {
 		if (!attrs->handle) {
 			/* Allocate handle if not set already */
@@ -82,25 +79,25 @@ populate:
 			handle = attrs->handle;
 		} else {
 			/* Service has conflicting handles */
-#if defined(CONFIG_BLUETOOTH_GATT_DYNAMIC_DB)
-			last->_next = NULL;
-#endif
 			BT_ERR("Unable to register handle 0x%04x",
 			       attrs->handle);
 			return -EINVAL;
 		}
 
 #if defined(CONFIG_BLUETOOTH_GATT_DYNAMIC_DB)
-		if (count > 1) {
-			attrs->_next = &attrs[1];
-		}
+		sys_slist_append(&list, &attrs->node);
 #endif
 
-		BT_DBG("attr %p next %p handle 0x%04x uuid %s perm 0x%02x",
-		       attrs, bt_gatt_attr_next(attrs), attrs->handle,
-		       bt_uuid_str(attrs->uuid), attrs->perm);
+		BT_DBG("attr %p handle 0x%04x uuid %s perm 0x%02x",
+		       attrs, attrs->handle, bt_uuid_str(attrs->uuid),
+		       attrs->perm);
 	}
 
+#if defined(CONFIG_BLUETOOTH_GATT_DYNAMIC_DB)
+	/* Merge attribute list into database */
+	sys_slist_merge_slist(&db, &list);
+#endif
+
 	return 0;
 }
 
@@ -242,9 +239,13 @@ ssize_t bt_gatt_attr_read_chrc(struct bt_conn *conn,
 void bt_gatt_foreach_attr(uint16_t start_handle, uint16_t end_handle,
 			  bt_gatt_attr_func_t func, void *user_data)
 {
-	const struct bt_gatt_attr *attr;
+	struct bt_gatt_attr *attr;
 
+#if defined(CONFIG_BLUETOOTH_GATT_DYNAMIC_DB)
+	SYS_SLIST_FOR_EACH_CONTAINER(&db, attr, node) {
+#else
 	for (attr = db; attr; attr = bt_gatt_attr_next(attr)) {
+#endif
 		/* Check if attribute handle is within range */
 		if (attr->handle < start_handle || attr->handle > end_handle) {
 			continue;
@@ -259,7 +260,8 @@ void bt_gatt_foreach_attr(uint16_t start_handle, uint16_t end_handle,
 struct bt_gatt_attr *bt_gatt_attr_next(const struct bt_gatt_attr *attr)
 {
 #if defined(CONFIG_BLUETOOTH_GATT_DYNAMIC_DB)
-	return attr->_next;
+	return SYS_SLIST_PEEK_NEXT_CONTAINER((struct bt_gatt_attr *)attr,
+					     node);
 #else
 	return ((attr < db || attr > &db[attr_count - 2]) ? NULL :
 		(struct bt_gatt_attr *)&attr[1]);