diff --git a/fiori-ext/app/extension.cds b/fiori-ext/app/extension.cds
index 2ea9ff58..2d34b9ea 100644
--- a/fiori-ext/app/extension.cds
+++ b/fiori-ext/app/extension.cds
@@ -1,5 +1,4 @@
-using { sap.capire.orders, OrdersService, sap.common } from '@capire/fiori/';
-// using { sap.common } from '@sap/cds/common'; //> TODO this creates duplicated definitions
+using { sap.capire.orders, OrdersService, sap.common } from '@capire/fiori';
 
 namespace Z_bookshop.extension;
 
@@ -12,7 +11,6 @@ entity Z_SalesRegion: common.CodeList {
   key regionCode : String(11);
 }
 
-
 // --- UI ---
 
 annotate orders.Orders : Z_priority with @title : 'Priority';
diff --git a/fiori/app/_router/package.json b/fiori/app/_router/package.json
new file mode 100644
index 00000000..ae94f3a1
--- /dev/null
+++ b/fiori/app/_router/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "approuter",
+  "dependencies": {
+    "@sap/approuter": "^11.0.0"
+  },
+  "engines": {
+    "node": "^16"
+  },
+  "scripts": {
+    "start": "node node_modules/@sap/approuter/approuter.js"
+  }
+}
\ No newline at end of file
diff --git a/fiori/app/_router/xs-app.json b/fiori/app/_router/xs-app.json
new file mode 100644
index 00000000..ea603849
--- /dev/null
+++ b/fiori/app/_router/xs-app.json
@@ -0,0 +1,24 @@
+{
+  "authenticationMethod": "route",
+  "routes": [
+    {
+      "source": "^/app/(.*)$",
+      "target": "$1",
+      "localDir": ".",
+      "authenticationType": "xsuaa",
+      "cacheControl": "no-cache, no-store, must-revalidate"
+    },
+    {
+      "source": "^/-/cds/.*",
+      "destination": "mtx-api",
+      "authenticationType": "none"
+    },
+    {
+      "source": "^/(.*)$",
+      "target": "$1",
+      "destination": "srv-api",
+      "authenticationType": "xsuaa",
+      "csrfProtection": false
+    }
+  ]
+}
\ No newline at end of file
diff --git a/fiori/mta.yaml b/fiori/mta.yaml
new file mode 100644
index 00000000..e266b0e9
--- /dev/null
+++ b/fiori/mta.yaml
@@ -0,0 +1,98 @@
+---
+_schema-version: '3.1'
+ID: capire.fiori
+version: 1.0.0
+description: "fiori"
+parameters:
+  enable-parallel-deployments: true
+build-parameters:
+  before-all:
+    - builder: custom
+      commands:
+        - npx -p @sap/cds-dk cds build --production
+
+modules:
+  - name: fiori-srv
+    type: nodejs
+    path: gen/srv
+    parameters:
+      buildpack: nodejs_buildpack
+    build-parameters:
+      builder: npm
+    provides:
+      - name: srv-api # required by consumers of CAP services (e.g. approuter)
+        properties:
+          srv-url: ${default-url}
+      - name: mtx-api # potentially required by approuter
+        properties:
+          mtx-url: ${default-url}
+    requires:
+      - name: fiori-db
+      - name: fiori-registry
+      - name: fiori-auth
+      - name: app-api
+        properties:
+          SUBSCRIPTION_URL: ~{app-protocol}://\${tenant_subdomain}-~{app-uri}
+
+  - name: fiori
+    type: approuter.nodejs
+    path: app/_router # from cds.env.folders. Consider also cds.env.build.target -> gen/app
+    parameters:
+      keep-existing-routes: true
+      disk-quota: 256M
+      memory: 256M
+    properties:
+      TENANT_HOST_PATTERN: "^(.*)-${default-uri}"
+    requires:
+      - name: srv-api
+        group: destinations
+        properties:
+          name: srv-api # must be used in xs-app.json as well
+          url: ~{srv-url}
+          forwardAuthToken: true
+      - name: mtx-api
+        group: destinations
+        properties:
+          name: mtx-api # must be used in xs-app.json as well
+          url: ~{mtx-url}
+      - name: fiori-auth
+    provides:
+      - name: app-api
+        properties:
+          app-protocol: ${protocol}
+          app-uri: ${default-uri}
+
+resources:
+  - name: fiori-db
+    type: org.cloudfoundry.managed-service
+    parameters:
+      service: service-manager
+      service-plan: container
+  - name: fiori-registry
+    type: org.cloudfoundry.managed-service
+    requires:
+      - name: mtx-api
+    parameters:
+      service: saas-registry
+      service-plan: application
+      config:
+        xsappname: fiori-${org}-${space}
+        appName: fiori-${org}-${space}
+        displayName: fiori
+        description: A simple CAP project.
+        category: 'Category'
+        appUrls:
+          getDependencies: ~{mtx-api/mtx-url}/-/cds/saas-provisioning/dependencies
+          onSubscription: ~{mtx-api/mtx-url}/-/cds/saas-provisioning/tenant/{tenantId}
+          onSubscriptionAsync: false
+          onUnSubscriptionAsync: false
+          callbackTimeoutMillis: 300000
+  - name: fiori-auth
+    type: org.cloudfoundry.managed-service
+    parameters:
+      service: xsuaa
+      service-plan: application
+      path: ./xs-security.json
+      config:
+        xsappname: fiori-${org}-${space}
+        tenant-mode: shared
diff --git a/fiori/package.json b/fiori/package.json
index ba109d48..fd43c34b 100644
--- a/fiori/package.json
+++ b/fiori/package.json
@@ -6,13 +6,18 @@
     "@sap/cds": ">=5",
     "@sap/cds-mtxs": "^1",
     "@sap/cds-odata-v2-adapter-proxy": "^1.9.0",
+    "@sap/xssec": "^3",
     "express": "^4.17.1",
+    "hdb": "^0.19.5",
     "passport": ">=0.4.1"
   },
   "scripts": {
     "start": "cds run --in-memory?",
     "watch": "cds watch"
   },
+  "engines": {
+    "node": "^16"
+  },
   "cds": {
     "requires": {
       "ReviewsService": {
@@ -49,17 +54,33 @@
       "toggles": true,
       "extensibility": true,
       "cds.xt.ExtensibilityService": {
+        "element-prefix": ["Z_"],
         "extension-allowlist": [
           {
-            "for": ["sap.capire.orders.Orders"],
+            "for": [
+              "sap.capire.orders.Orders"
+            ],
             "kind": "entity",
             "new-fields": 2
           },
           {
-            "for": ["OrdersService"],
+            "for": [
+              "OrdersService"
+            ],
             "new-entities": 2
           }
         ]
+      },
+      "[production]": {
+        "auth": {
+          "kind": "xsuaa"
+        },
+        "db": {
+          "kind": "hana-mt"
+        }
+      },
+      "approuter": {
+        "kind": "cloudfoundry"
       }
     },
     "hana": {
diff --git a/fiori/srv/index.cds b/fiori/srv/index.cds
new file mode 100644
index 00000000..10022694
--- /dev/null
+++ b/fiori/srv/index.cds
@@ -0,0 +1 @@
+using from '@capire/bookstore';
diff --git a/fiori/xs-security.json b/fiori/xs-security.json
new file mode 100644
index 00000000..e1914c8e
--- /dev/null
+++ b/fiori/xs-security.json
@@ -0,0 +1,51 @@
+{
+  "scopes": [
+    {
+      "name": "$XSAPPNAME.admin",
+      "description": "admin"
+    },
+    {
+      "name": "$XSAPPNAME.mtcallback",
+      "description": "Subscription via SaaS Registry",
+      "grant-as-authority-to-apps": [
+        "$XSAPPNAME(application,sap-provisioning,tenant-onboarding)"
+      ]
+    },
+    {
+      "name": "$XSAPPNAME.cds.Subscriber",
+      "description": "Subscribe to applications"
+    },
+    {
+      "name": "$XSAPPNAME.cds.ExtensionDeveloper",
+      "description": "Extend CAP applications via extension projects"
+    },
+    {
+      "name": "$XSAPPNAME.cds.UIFlexDeveloper",
+      "description": "Extend CAP applications via UIFlex extensibility"
+    }
+  ],
+  "attributes": [],
+  "role-templates": [
+    {
+      "name": "admin",
+      "description": "admin",
+      "scope-references": [
+        "$XSAPPNAME.admin"
+      ]
+    },
+    {
+      "name": "ExtensionDeveloper",
+      "description": "Extension development including UIFlex extensibility",
+      "scope-references": [
+        "$XSAPPNAME.cds.ExtensionDeveloper",
+        "$XSAPPNAME.cds.UIFlexDeveloper"
+      ]
+    }
+  ],
+  "authorities-inheritance": false,
+  "authorities": [
+    "$XSAPPNAME.cds.Subscriber",
+    "$XSAPPNAME.cds.ExtensionDeveloper",
+    "$XSAPPNAME.cds.UIFlexDeveloper"
+  ]
+}
\ No newline at end of file