diff --git a/tools/binman/etype/nxp_imx8mcst.py b/tools/binman/etype/nxp_imx8mcst.py
index a10f61aa01f..29a7451678d 100644
--- a/tools/binman/etype/nxp_imx8mcst.py
+++ b/tools/binman/etype/nxp_imx8mcst.py
@@ -20,8 +20,9 @@ from binman import elf
 from dtoc import fdt_util
 from u_boot_pylib import tools
 
-MAGIC_NXP_IMX_IVT = 0x412000d1
-MAGIC_FITIMAGE    = 0xedfe0dd0
+MAGIC_NXP_IMX_IVT  = 0x412000d1
+MAGIC_NXP_IMX_FCFB = 0x42464346
+MAGIC_FITIMAGE     = 0xedfe0dd0
 
 KEY_NAME = 'sha256_4096_65537_v3_usr_crt'
 
@@ -112,6 +113,9 @@ class Entry_nxp_imx8mcst(Entry_mkimage):
         # - If it is mkimage'd imx8mimage, then extract to be signed data size
         #   from imx8mimage header, and calculate CSF blob offset right past
         #   the SPL from this information.
+        # - If it is mkimage'd imx8mimage wrapped in FCFB, then extract to be
+        #   signed data size from imx8mimage header past the FCFB header, and
+        #   calculate CSF blob offset right past the SPL from this information.
         # - If it is fitImage, then pad the image to 4k, add generated IVT and
         #   sign the whole payload, then append CSF blob at the end right past
         #   the IVT.
@@ -125,6 +129,17 @@ class Entry_nxp_imx8mcst(Entry_mkimage):
             signsize = struct.unpack('<I', data[24:28])[0] - signbase
             # Remove mkimage generated padding from the end of data
             data = data[:signsize]
+        elif signtype == MAGIC_NXP_IMX_FCFB: # SPL/imx8mimage with FCFB
+            # Sign the payload including FCFB and imx8mimage headers
+            # (extra 0x1000 and 0x40 bytes before the payload)
+            signbase -= 0x1040
+            # Pull the end address from IVT offset 24 Bytes and subtract
+            # the start address to get amount of data to sign. The IVT
+            # itself is at offset 4096 Bytes, so the total end address
+            # offset in the image is 4120 Bytes.
+            signsize = struct.unpack('<I', data[4120:4124])[0] - signbase
+            # Remove mkimage generated padding from the end of data
+            data = data[:signsize]
         elif signtype == MAGIC_FITIMAGE: # fitImage
             # Align fitImage to 4k
             signsize = tools.align(len(data), 0x1000)
diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py
index 04f9a66f007..a0e8bde7901 100644
--- a/tools/binman/ftest.py
+++ b/tools/binman/ftest.py
@@ -8044,6 +8044,24 @@ fdt         fdtmap                Extract the devicetree blob from the fdtmap
         err = stderr.getvalue()
         self.assertRegex(err, "Image 'image'.*missing bintools.*: cst")
 
+    def testNxpImx8mCSTFCFB(self):
+        """Test CST signing with FCFB-format input (normal auth, no unlock)"""
+        # Create fake FCFB blob: magic(4) + padding(4116)
+        ivt_data = struct.pack('<I', 0x42464346)
+        ivt_data += b'\x00' * 4116
+        # Create fake IVT blob: magic(4) + padding(20) + signsize_addr(4)
+        # + padding(36) = 64 bytes
+        ivt_data += struct.pack('<I', 0x412000d1)
+        ivt_data += b'\x00' * 20
+        ivt_data += struct.pack('<I', 0)
+        ivt_data += b'\x00' * 36
+        self._MakeInputFile('imx8m-ivt.bin', ivt_data)
+        with terminal.capture() as (_, stderr):
+            self._DoTestFile('vendor/nxp_imx8_csf.dts',
+                             force_missing_bintools='cst')
+        err = stderr.getvalue()
+        self.assertRegex(err, "Image 'image'.*missing bintools.*: cst")
+
     def testNxpImx8mCSTFastAuth(self):
         """Test CST signing with fast-auth mode, unlock, and FIT format"""
         # FIT magic covers the FIT-signing path; fast-auth/unlock cover the