diff --git a/scripts/ci/check_compliance.py b/scripts/ci/check_compliance.py
index e38126241af..45a4827c6b4 100755
--- a/scripts/ci/check_compliance.py
+++ b/scripts/ci/check_compliance.py
@@ -608,6 +608,7 @@ flagged.
         "BOOT_SERIAL_CDC_ACM",       # Used in (sysbuild-based) test
         "BOOT_SERIAL_ENTRANCE_GPIO", # Used in (sysbuild-based) test
         "BOOT_SERIAL_IMG_GRP_HASH",  # Used in documentation
+        "BOOT_SIGNATURE_KEY_FILE",   # MCUboot idefined setting used by sysbuild.
         "BOOT_VALIDATE_SLOT0",       # Used in (sysbuild-based) test
         "BOOT_WATCHDOG_FEED",        # Used in (sysbuild-based) test
         "BTTESTER_LOG_LEVEL",  # Used in tests/bluetooth/tester
diff --git a/share/sysbuild/CMakeLists.txt b/share/sysbuild/CMakeLists.txt
index 5a8428be54f..12a6f4f15bb 100644
--- a/share/sysbuild/CMakeLists.txt
+++ b/share/sysbuild/CMakeLists.txt
@@ -48,42 +48,11 @@ endforeach()
 set(SYSBUILD_CURRENT_MODULE_DIR)
 set(SYSBUILD_CURRENT_CMAKE_DIR)
 
-# Propagate bootloader and signing settings from this system to the MCUboot and
-# application image build systems.
-if(SB_CONFIG_BOOTLOADER_MCUBOOT)
-  set(${app_name}_CONFIG_BOOTLOADER_MCUBOOT y CACHE STRING
-      "MCUBOOT is enabled as bootloader" FORCE
-  )
-  set(${app_name}_CONFIG_MCUBOOT_SIGNATURE_KEY_FILE
-      \"${SB_CONFIG_BOOT_SIGNATURE_KEY_FILE}\" CACHE STRING
-      "Signature key file for signing" FORCE
-  )
-
-  if(SB_CONFIG_BOOT_SIGNATURE_TYPE_NONE)
-    set(${app_name}_CONFIG_MCUBOOT_GENERATE_UNSIGNED_IMAGE y CACHE STRING
-        "MCUBOOT is configured for checksum mode" FORCE
-    )
-  endif()
-
-  # Set corresponding values in mcuboot
-  set(mcuboot_CONFIG_BOOT_SIGNATURE_TYPE_${SB_CONFIG_SIGNATURE_TYPE} y CACHE STRING
-      "MCUBOOT signature type" FORCE
-  )
-  set(mcuboot_CONFIG_BOOT_SIGNATURE_KEY_FILE
-      \"${SB_CONFIG_BOOT_SIGNATURE_KEY_FILE}\" CACHE STRING
-      "Signature key file for signing" FORCE
-  )
-else()
-  set(${app_name}_CONFIG_BOOTLOADER_MCUBOOT n CACHE STRING
-      "MCUBOOT is disabled as bootloader" FORCE
-  )
-endif()
-
 # This adds the primary application to the build.
 ExternalZephyrProject_Add(
   APPLICATION ${app_name}
   SOURCE_DIR ${APP_DIR}
-  MAIN_APP
+  APP_TYPE MAIN
 )
 list(APPEND IMAGES "${app_name}")
 set(DEFAULT_IMAGE "${app_name}")
@@ -117,6 +86,7 @@ endwhile()
 
 sysbuild_module_call(PRE_CMAKE MODULES ${SYSBUILD_MODULE_NAMES} IMAGES ${IMAGES})
 foreach(image ${IMAGES})
+  include(image_config.cmake)
   ExternalZephyrProject_Cmake(APPLICATION ${image})
 endforeach()
 sysbuild_module_call(POST_CMAKE MODULES ${SYSBUILD_MODULE_NAMES} IMAGES ${IMAGES})
diff --git a/share/sysbuild/bootloader/CMakeLists.txt b/share/sysbuild/bootloader/CMakeLists.txt
index f9ba2ba2cb9..0d75ee7a407 100644
--- a/share/sysbuild/bootloader/CMakeLists.txt
+++ b/share/sysbuild/bootloader/CMakeLists.txt
@@ -4,11 +4,15 @@
 
 # Include MCUboot if enabled.
 if(SB_CONFIG_BOOTLOADER_MCUBOOT)
+  set(image mcuboot)
   ExternalZephyrProject_Add(
-    APPLICATION mcuboot
+    APPLICATION ${image}
     SOURCE_DIR ${ZEPHYR_MCUBOOT_MODULE_DIR}/boot/zephyr/
+    APP_TYPE BOOTLOADER
   )
   # MCUBoot default configuration is to perform a full chip erase.
   # Placing MCUBoot first in list to ensure it is flashed before other images.
-  set(IMAGES "mcuboot" ${IMAGES} PARENT_SCOPE)
+  set(IMAGES ${image} ${IMAGES} PARENT_SCOPE)
+
+  set_config_string(${image} CONFIG_BOOT_SIGNATURE_KEY_FILE "${SB_CONFIG_BOOT_SIGNATURE_KEY_FILE}")
 endif()
diff --git a/share/sysbuild/cmake/modules/sysbuild_extensions.cmake b/share/sysbuild/cmake/modules/sysbuild_extensions.cmake
index 30eff2fef2a..70c7aad3e58 100644
--- a/share/sysbuild/cmake/modules/sysbuild_extensions.cmake
+++ b/share/sysbuild/cmake/modules/sysbuild_extensions.cmake
@@ -106,7 +106,7 @@ endfunction()
 #   ExternalZephyrProject_Add(APPLICATION <name>
 #                             SOURCE_DIR <dir>
 #                             [BOARD <board> [BOARD_REVISION <revision>]]
-#                             [MAIN_APP]
+#                             [APP_TYPE <MAIN|BOOTLOADER>]
 #   )
 #
 # This function includes a Zephyr based build system into the multiimage
@@ -118,14 +118,17 @@ endfunction()
 # BOARD <board>:             Use <board> for application build instead user defined BOARD.
 # BOARD_REVISION <revision>: Use <revision> of <board> for application (only valid if
 #                            <board> is also supplied).
-# MAIN_APP:                  Flag indicating this application is the main application
-#                            and where user defined settings should be passed on as-is
-#                            except for multi image build flags.
-#                            For example, -DCONF_FILES=<files> will be passed on to the
-#                            MAIN_APP unmodified.
+# APP_TYPE <MAIN|BOOTLOADER>: Application type.
+#                             MAIN indicates this application is the main application
+#                             and where user defined settings should be passed on as-is
+#                             except for multi image build flags.
+#                             For example, -DCONF_FILES=<files> will be passed on to the
+#                             MAIN_APP unmodified.
+#                             BOOTLOADER indicates this app is a bootloader
 #
 function(ExternalZephyrProject_Add)
-  cmake_parse_arguments(ZBUILD "MAIN_APP" "APPLICATION;BOARD;BOARD_REVISION;SOURCE_DIR" "" ${ARGN})
+  set(app_types MAIN BOOTLOADER)
+  cmake_parse_arguments(ZBUILD "" "APPLICATION;BOARD;BOARD_REVISION;SOURCE_DIR;APP_TYPE" "" ${ARGN})
 
   if(ZBUILD_UNPARSED_ARGUMENTS)
     message(FATAL_ERROR
@@ -134,6 +137,16 @@ function(ExternalZephyrProject_Add)
     )
   endif()
 
+  if(DEFINED ZBUILD_APP_TYPE)
+    if(NOT ZBUILD_APP_TYPE IN_LIST app_types)
+      message(FATAL_ERROR
+        "ExternalZephyrProject_Add(APP_TYPE <val> ...) given unknown type: ${ZBUILD_APP_TYPE}\n"
+        "Valid types are: ${app_types}"
+      )
+    endif()
+
+  endif()
+
   set(sysbuild_image_conf_dir ${APP_DIR}/sysbuild)
   set(sysbuild_image_name_conf_dir ${APP_DIR}/sysbuild/${ZBUILD_APPLICATION})
   # User defined `-D<image>_CONF_FILE=<file.conf>` takes precedence over anything else.
@@ -202,7 +215,7 @@ function(ExternalZephyrProject_Add)
       ${EXTRA_KCONFIG_TARGETS}
       )
 
-    if(NOT ZBUILD_MAIN_APP)
+    if(NOT ZBUILD_APP_TYPE STREQUAL "MAIN")
       set(image_prefix "${ZBUILD_APPLICATION}_")
     endif()
 
@@ -213,10 +226,11 @@ function(ExternalZephyrProject_Add)
       )
   endforeach()
   include(ExternalProject)
+  set(application_binary_dir ${CMAKE_BINARY_DIR}/${ZBUILD_APPLICATION})
   ExternalProject_Add(
     ${ZBUILD_APPLICATION}
     SOURCE_DIR ${ZBUILD_SOURCE_DIR}
-    BINARY_DIR ${CMAKE_BINARY_DIR}/${ZBUILD_APPLICATION}
+    BINARY_DIR ${application_binary_dir}
     CONFIGURE_COMMAND ""
     CMAKE_ARGS -DSYSBUILD:BOOL=True
                -DSYSBUILD_CACHE:FILEPATH=${sysbuild_cache_file}
@@ -226,8 +240,15 @@ function(ExternalZephyrProject_Add)
     BUILD_ALWAYS True
     USES_TERMINAL_BUILD True
   )
+  set_property(TARGET ${ZBUILD_APPLICATION} PROPERTY APP_TYPE ${ZBUILD_APP_TYPE})
+  set_property(TARGET ${ZBUILD_APPLICATION} PROPERTY CONFIG
+               "# sysbuild controlled configuration settings\n"
+  )
   set_target_properties(${ZBUILD_APPLICATION} PROPERTIES CACHE_FILE ${sysbuild_cache_file})
-  if(ZBUILD_MAIN_APP)
+  set_target_properties(${ZBUILD_APPLICATION} PROPERTIES KCONFIG_BINARY_DIR
+                        ${application_binary_dir}/Kconfig
+  )
+  if("${ZBUILD_APP_TYPE}" STREQUAL "MAIN")
     set_target_properties(${ZBUILD_APPLICATION} PROPERTIES MAIN_APP True)
   endif()
 
@@ -335,10 +356,16 @@ function(ExternalZephyrProject_Cmake)
                    ${${ZCMAKE_APPLICATION}_CACHE_FILE} ONLY_IF_DIFFERENT
   )
 
+  set(dotconfigsysbuild ${BINARY_DIR}/zephyr/.config.sysbuild)
+  get_target_property(config_content ${ZCMAKE_APPLICATION} CONFIG)
+  string(CONFIGURE "${config_content}" config_content)
+  file(WRITE ${dotconfigsysbuild} ${config_content})
+
   execute_process(
     COMMAND ${CMAKE_COMMAND}
       -G${CMAKE_GENERATOR}
         ${CMAKE_ARGS}
+      -DFORCED_CONF_FILE:FILEPATH=${dotconfigsysbuild}
       -B${BINARY_DIR}
       -S${SOURCE_DIR}
     RESULT_VARIABLE   return_val
@@ -455,3 +482,15 @@ function(sysbuild_cache_set)
 
   set(${VARS_VAR} "${var_new}" CACHE "${var_type}" "${var_help}" FORCE)
 endfunction()
+
+function(set_config_bool image setting value)
+  if(${value})
+    set_property(TARGET ${image} APPEND_STRING PROPERTY CONFIG "${setting}=y\n")
+  else()
+    set_property(TARGET ${image} APPEND_STRING PROPERTY CONFIG "${setting}=n\n")
+  endif()
+endfunction()
+
+function(set_config_string image setting value)
+  set_property(TARGET ${image} APPEND_STRING PROPERTY CONFIG "${setting}=\"${value}\"\n")
+endfunction()
diff --git a/share/sysbuild/image_config.cmake b/share/sysbuild/image_config.cmake
new file mode 100644
index 00000000000..2ee39561886
--- /dev/null
+++ b/share/sysbuild/image_config.cmake
@@ -0,0 +1,25 @@
+# Copyright (c) 2023 Nordic Semiconductor
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# This sysbuild CMake file sets the sysbuild controlled settings as properties
+# on Zephyr images.
+
+get_target_property(image_board ${image} BOARD)
+if((NOT image_board) OR ("${image_BOARD}" STREQUAL "${BOARD}"))
+  get_target_property(${image}_APP_TYPE ${image} APP_TYPE)
+  if(NOT "${${image}_APP_TYPE}" STREQUAL "BOOTLOADER")
+    set_config_bool(${image} CONFIG_BOOTLOADER_MCUBOOT "${SB_CONFIG_BOOTLOADER_MCUBOOT}")
+    set_config_string(${image} CONFIG_MCUBOOT_SIGNATURE_KEY_FILE
+                               "${SB_CONFIG_BOOT_SIGNATURE_KEY_FILE}"
+    )
+  endif()
+
+  if(SB_CONFIG_BOOTLOADER_MCUBOOT)
+    if("${SB_CONFIG_SIGNATURE_TYPE}" STREQUAL "NONE")
+      set_config_bool(${image} CONFIG_MCUBOOT_GENERATE_UNSIGNED_IMAGE y)
+    else()
+      set_config_bool(${image} CONFIG_MCUBOOT_GENERATE_UNSIGNED_IMAGE n)
+    endif()
+  endif()
+endif()