diff --git a/utils/cryptsetup/Makefile b/utils/cryptsetup/Makefile
index c17f27595b..bdb249fdd4 100644
--- a/utils/cryptsetup/Makefile
+++ b/utils/cryptsetup/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=cryptsetup
-PKG_VERSION:=2.3.6
+PKG_VERSION:=2.4.1
 PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_SOURCE_URL:=@KERNEL/linux/utils/cryptsetup/v2.3
-PKG_HASH:=b296b7a21ea576c2b180611ccb19d06aec8dddaedf7c704b0c6a81210c25635f
+PKG_SOURCE_URL:=@KERNEL/linux/utils/cryptsetup/v2.4
+PKG_HASH:=a356a727a83a464ade566e95239622a22dbe4e0f482b198fdb04ab0d3a5a9c5f
 
 PKG_MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
 PKG_LICENSE:=GPL-2.0-or-later LGPL-2.1-or-later
@@ -22,6 +22,8 @@ PKG_LICENSE_FILES:=COPYING COPYING.LGPL
 PKG_INSTALL:=1
 PKG_BUILD_PARALLEL:=1
 
+PKG_BUILD_DEPENDS:=!USE_GLIBC:argp-standalone
+
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/nls.mk
 
@@ -30,7 +32,8 @@ define Package/cryptsetup
   CATEGORY:=Utilities
   SUBMENU:=Encryption
   TITLE:=Cryptsetup
-  DEPENDS:=$(ICONV_DEPENDS) $(INTL_DEPENDS) +libblkid +libuuid +libpopt +lvm2 +libdevmapper +libjson-c +@KERNEL_DIRECT_IO +kmod-crypto-user
+  DEPENDS:=$(ICONV_DEPENDS) $(INTL_DEPENDS) +libblkid +libuuid +libpopt +lvm2 \
+           +libdevmapper +libjson-c +@KERNEL_DIRECT_IO +kmod-crypto-user
   URL:=https://gitlab.com/cryptsetup/cryptsetup/
 endef
 
@@ -38,6 +41,19 @@ define Package/cryptsetup/description
   Cryptsetup is utility used to conveniently setup disk encryption based on DMCrypt kernel module.
 endef
 
+define Package/cryptsetup-ssh
+  SECTION:=utils
+  CATEGORY:=Utilities
+  SUBMENU:=Encryption
+  TITLE:=Cryptsetup SSH token
+  DEPENDS:=+cryptsetup +PACKAGE_cryptsetup-ssh:libssh
+  URL:=https://gitlab.com/cryptsetup/cryptsetup/
+endef
+
+define Package/cryptsetup-ssh/description
+  Experimental SSH token support for cryptsetup.
+endef
+
 CONFIGURE_ARGS += \
 	--disable-cryptsetup-reencrypt \
 	--disable-integritysetup \
@@ -49,6 +65,16 @@ CONFIGURE_ARGS += \
 	--with-luks2-lock-path=/var/run/cryptsetup \
 	--with-crypto_backend=kernel
 
+ifeq ($(CONFIG_PACKAGE_cryptsetup-ssh),)
+CONFIGURE_ARGS += --disable-ssh-token
+endif
+
+CONFIGURE_VARS += \
+	LIBSSH_CFLAGS="-I$(STAGING_DIR)/usr/include" \
+	LIBSSH_LIBS="-L$(STAGING_DIR)/usr/lib -lssh"
+
+TARGET_LDFLAGS += -Wl,--gc-sections $(if $(INTL_FULL),-lintl)
+
 define Build/InstallDev
 	$(INSTALL_DIR) $(1)/usr/include
 	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/include/libcryptsetup.h $(1)/usr/include
@@ -65,4 +91,12 @@ define Package/cryptsetup/install
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/cryptsetup $(1)/usr/sbin
 endef
 
+define Package/cryptsetup-ssh/install
+	$(INSTALL_DIR) $(1)/usr/lib/cryptsetup
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/cryptsetup/* $(1)/usr/lib/cryptsetup
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/cryptsetup-ssh $(1)/usr/sbin
+endef
+
 $(eval $(call BuildPackage,cryptsetup))
+$(eval $(call BuildPackage,cryptsetup-ssh))