diff --git a/boot/zephyr/Kconfig b/boot/zephyr/Kconfig
index a5009e4..dacaf3a 100644
--- a/boot/zephyr/Kconfig
+++ b/boot/zephyr/Kconfig
@@ -1,4 +1,5 @@
 # Copyright (c) 2017 Linaro Limited
+# Copyright (c) 2020 Arm Limited
 #
 # SPDX-License-Identifier: Apache-2.0
 #
@@ -361,8 +362,12 @@
 	help
 	  Enables support of multi image update.
 
+choice
+	prompt "Downgrade prevention"
+	optional
+
 config MCUBOOT_DOWNGRADE_PREVENTION
-	bool "Downgrade prevention"
+	bool "SW based downgrade prevention"
 	depends on BOOT_UPGRADE_ONLY
 	help
 	  Prevent downgrades by enforcing incrementing version numbers.
@@ -371,4 +376,14 @@
 	  only protects against some attacks against version downgrades (for
 	  example, a JTAG could be used to write an older version).
 
+config MCUBOOT_HW_DOWNGRADE_PREVENTION
+	bool "HW based downgrade prevention"
+	help
+	  Prevent undesirable/malicious software downgrades. When this option is
+	  set, any upgrade must have greater or equal security counter value.
+	  Because of the acceptance of equal values it allows for software
+	  downgrade to some extent.
+
+endchoice
+
 source "Kconfig.zephyr"
diff --git a/boot/zephyr/include/mcuboot_config/mcuboot_config.h b/boot/zephyr/include/mcuboot_config/mcuboot_config.h
index 14705d3..2b998b5 100644
--- a/boot/zephyr/include/mcuboot_config/mcuboot_config.h
+++ b/boot/zephyr/include/mcuboot_config/mcuboot_config.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2018 Open Source Foundries Limited
- * Copyright (c) 2019 Arm Limited
+ * Copyright (c) 2019-2020 Arm Limited
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -93,6 +93,10 @@
 #define MCUBOOT_DOWNGRADE_PREVENTION 1
 #endif
 
+#ifdef CONFIG_MCUBOOT_HW_DOWNGRADE_PREVENTION
+#define MCUBOOT_HW_ROLLBACK_PROT
+#endif
+
 /*
  * Enabling this option uses newer flash map APIs. This saves RAM and
  * avoids deprecated API usage.