diff --git a/lib/sles4sap_publiccloud.pm b/lib/sles4sap_publiccloud.pm
index 5dd983cd449f..0ed32a6ecb29 100644
--- a/lib/sles4sap_publiccloud.pm
+++ b/lib/sles4sap_publiccloud.pm
@@ -17,23 +17,22 @@ use strict;
 use JSON;
 use warnings FATAL => 'all';
 use Exporter 'import';
-use Scalar::Util 'looks_like_number';
+use Scalar::Util qw(looks_like_number);
 use List::MoreUtils qw(uniq);
 use Carp qw(croak);
 use YAML::PP;
 use testapi;
 use utils qw(file_content_replace);
 use serial_terminal qw(serial_term_prompt);
-use version_utils qw(check_version);
+use version_utils qw(check_version is_sle);
 use hacluster;
 use qesapdeployment;
 use publiccloud::utils;
 use publiccloud::provider;
-use publiccloud::ssh_interactive 'select_host_console';
+use publiccloud::ssh_interactive qw(select_host_console);
 use publiccloud::instance;
 use sles4sap;
 use saputils;
-use version_utils 'is_sle';
 
 our @EXPORT = qw(
   run_cmd
@@ -901,6 +900,13 @@ sub delete_network_peering {
 
 =item B<ptf_container> - name of the container for PTF files (optional)
 
+=item B<ltss> - name and reg_code for LTSS extension to register.
+                This argument is a two element comma separated list string.
+                Like: 'SLES-LTSS-Extended-Security/12.5/x86_64,123456789'
+                First string before the comma has to be a valid SCC extension name, later used by Ansible
+                as argument for SUSEConnect or registercloudguest argument.
+                Second string has to be valid registration code for the particular LTSS extension.
+
 =back
 =cut
 
@@ -921,14 +927,19 @@ sub create_playbook_section_list {
     my @playbook_list;
 
     unless ($args{registration} eq 'noreg') {
-        # Add registration module as first element
-        my $reg_code = '-e reg_code=' . get_required_var('SCC_REGCODE_SLES4SAP') . " -e email_address=''";
-        if ($args{registration} eq 'suseconnect') {
-            push @playbook_list, "registration.yaml $reg_code -e use_suseconnect=true";
-        }
-        else {
-            push @playbook_list, "registration.yaml $reg_code";
+        my @reg_args = ('registration.yaml');
+        push @reg_args, '-e reg_code=' . get_required_var('SCC_REGCODE_SLES4SAP') . " -e email_address=''";
+        push @reg_args, '-e use_suseconnect=true' if ($args{registration} eq 'suseconnect');
+        if ($args{ltss}) {
+            my @ltss_args = split(/,/, $args{ltss});
+            die "Missing reg_code for '$ltss_args[0]'" if scalar @ltss_args != 2;
+            push @reg_args, "-e sles_modules='[{" .
+              "\"key\":\"$ltss_args[0]\"," .
+              "\"value\":\"$ltss_args[1]\"}]'";
         }
+        # Add registration module as first element
+        push @playbook_list, join(' ', @reg_args);
+
         # Add "fully patch system" module after registration module and before test start/configuration modules.
         # Temporary moved inside noreg condition to avoid test without Ansible to fails.
         # To be properly addressed in the caller and fully-patch-system can be placed back out of the if.
diff --git a/t/12_sles4sap_publicccloud.t b/t/12_sles4sap_publicccloud.t
index e167a387c21b..2365b8970b41 100644
--- a/t/12_sles4sap_publicccloud.t
+++ b/t/12_sles4sap_publicccloud.t
@@ -611,6 +611,17 @@ subtest '[create_playbook_section_list]' => sub {
 };
 
 
+subtest '[create_playbook_section_list] ltss' => sub {
+    set_var('SCC_REGCODE_SLES4SAP', 'Magellano');
+    set_var('USE_SAPCONF', 'Colombo');
+    my $ansible_playbooks = create_playbook_section_list(ltss => 'XuFu,Jofuku');
+    set_var('SCC_REGCODE_SLES4SAP', undef);
+    set_var('USE_SAPCONF', undef);
+    note("\n  -->  " . join("\n  -->  ", @$ansible_playbooks));
+    ok((any { /.*registration\.yaml.*sles_modules=.*key.*XuFu.*value.*Jofuku/ } @$ansible_playbooks), 'registration playbook is called with reg code from SCC_REGCODE_LTSS');
+};
+
+
 subtest '[create_playbook_section_list] ha_enabled => 0' => sub {
     set_var('SCC_REGCODE_SLES4SAP', 'Magellano');
     set_var('USE_SAPCONF', 'Colombo');
diff --git a/tests/sles4sap/publiccloud/qesap_terraform.pm b/tests/sles4sap/publiccloud/qesap_terraform.pm
index 3379ad57b611..680361857336 100644
--- a/tests/sles4sap/publiccloud/qesap_terraform.pm
+++ b/tests/sles4sap/publiccloud/qesap_terraform.pm
@@ -34,6 +34,7 @@ use publiccloud::utils qw(is_azure is_gce get_ssh_private_key_path);
 use sles4sap_publiccloud;
 use qesapdeployment;
 use serial_terminal 'select_serial_terminal';
+use registration qw(get_addon_fullname scc_version %ADDONS_REGCODE);
 
 our $ha_enabled = set_var_output('HA_CLUSTER', '0') =~ /false|0/i ? 0 : 1;
 
@@ -175,6 +176,22 @@ sub run {
             $playbook_configs{spn_application_password} = get_var('AZURE_SPN_APP_PASSWORD', get_required_var('_SECRET_AZURE_SPN_APP_PASSWORD'));
         }
     }
+
+    my @addons = grep { defined $_ && $_ } split(/,/, get_var('SCC_ADDONS'));
+    # This implementation has a known limitation
+    # if SCC_ADDONS has two or more elements (like "ltss,ltss_es")
+    # only the last one will be added to the playbook argument.
+    foreach my $addon (@addons) {
+        my $name;
+        # Keep the code simple by only support ltss addons,
+        # it simplify version calculation.
+        $name = get_addon_fullname($addon) if ($addon =~ 'ltss');
+        if ($name) {
+            record_info($name, "Register '$name' with code '$ADDONS_REGCODE{$name}'");
+            $playbook_configs{ltss} = join(',', join('/', $name, scc_version(), 'x86_64'), $ADDONS_REGCODE{$name});
+            $playbook_configs{registration} = 'suseconnect' if ($os_image_name =~ 'byos');
+        }
+    }
     $ansible_playbooks = create_playbook_section_list(%playbook_configs);
 
     my $ansible_hana_vars = create_hana_vars_section($ha_enabled);