diff --git a/Kconfig b/Kconfig
index 66dd4112..cfea1902 100644
--- a/Kconfig
+++ b/Kconfig
@@ -1,5 +1,5 @@
 # This software is a part of Isar.
-# Copyright (C) 2023 ilbers GmbH
+# Copyright (C) 2023-2026 ilbers GmbH
 #
 # SPDX-License-Identifier: MIT
 #
@@ -14,6 +14,7 @@ config KAS_INCLUDE_MAIN
 
 config KAS_BUILD_SYSTEM
 	string
+	default "isar-privileged" if KAS_BUILD_SYSTEM_ISAR_PRIVILEGED
 	default "isar-rootless"
 
 source "kas/machine/Kconfig"
diff --git a/kas/opt/Kconfig b/kas/opt/Kconfig
index ac9b2f55..1bea49b8 100644
--- a/kas/opt/Kconfig
+++ b/kas/opt/Kconfig
@@ -115,6 +115,26 @@ config KAS_INCLUDE_USER_ISAR
 
 endmenu
 
+
+menu "Kas build system"
+
+choice
+	prompt "Kas build system"
+	default KAS_BUILD_SYSTEM_ISAR_ROOTLESS
+	help
+          Rootless build mode is using unshare syscall to avoid security issues.
+          Otherwize privileged mode with sudo permissions still can be used.
+
+config KAS_BUILD_SYSTEM_ISAR_ROOTLESS
+	bool "Rootless (--isar-rootless)"
+
+config KAS_BUILD_SYSTEM_ISAR_PRIVILEGED
+	bool "Privileged (--isar-privileged)"
+
+endchoice
+
+endmenu
+
 config KAS_IMAGE_FSTYPES
 	string "Additional image fstypes"
 	default ""