diff --git a/board/keymile/secu1/socfpga_secu.env b/board/keymile/secu1/socfpga_secu.env
new file mode 100644
index 0000000..147c417
--- /dev/null
+++ b/board/keymile/secu1/socfpga_secu.env
@@ -0,0 +1,50 @@
+altbootcmd=run bootcmd;
+bootlimit=6
+bootnum=1
+bootretry=CONFIG_BOOT_RETRY_TIME
+
+develop=tftp 0x200000 scripts/develop-secu.txt &&
+	env import -t 0x200000 ${filesize} &&
+	saveenv &&
+	reset
+
+fdt_addr=CONFIG_KM_FDT_ADDR
+load=tftpboot ${loadaddr} u-boot-with-nand-spl.sfp
+loadaddr=CONFIG_KM_KERNEL_ADDR
+newenv=nand erase 0x100000 0x40000
+release=run newenv; reset
+socfpga_legacy_reset_compat=1
+update=nand erase 0x0 0x00100000 && nand write ${loadaddr} 0x0 ${filesize}
+
+userload=ubi part nand.ubi &&
+	 ubi check rootfs$bootnum &&
+	 ubi read $fdt_addr dtb$bootnum &&
+	 ubi read $loadaddr kernel$bootnum
+
+userboot=setenv bootargs console=ttyS0,115200 ubi.fm_autoconvert=1 uio_pdrv_genirq.of_id="idq,regbank"
+			 ubi.mtd=1 ubi.block=0,rootfs$bootnum root=/dev/ubiblock0_$ubivolid ro
+			 rootfstype=squashfs init=sbin/preinit;
+		bootz ${loadaddr} - ${fdt_addr}
+
+verify=y
+
+/*
+ * FPGA Remote Update related environment
+ *
+ * Note that since those commands access the FPGA, the HPS-to-FPGA bridges
+ * MUST have been previously enabled (for example with 'bridge enable').
+ */
+rmtu_page=0xFF29000C
+rmtu_reconfig=0xFF290018
+fpga_safebase=0x0
+fpga_userbase=0x2000000
+
+_fpga_loaduser=echo "Loading FPGA USER image..." &&
+	       mw ${rmtu_page} ${fpga_userbase} &&
+	       mw ${rmtu_reconfig} 1
+
+_fpga_loadsafe=echo "Loading FPGA SAFE image..." &&
+	       mw ${rmtu_page} ${fpga_safebase} &&
+	       mw ${rmtu_reconfig} 1
+
+