diff --git a/.clang-format b/.clang-format
index 4aac13c8b7..6a8388bc91 100644
--- a/.clang-format
+++ b/.clang-format
@@ -34,6 +34,10 @@ PointerAlignment: Right
 PointerBindsToType: false
 IncludeBlocks: Regroup
 IncludeCategories:
+  - Regex:           '^<(urcu\.h|urcu/urcu-|urcu-)'
+    Priority:        2
+  - Regex:           '^<urcu/'
+    Priority:        3
   - Regex:           '^<isc/'
     Priority:        5
   - Regex:           '^<(pk11|pkcs11)/'
@@ -59,9 +63,9 @@ IncludeCategories:
   - Regex:           '^<tests/'
     Priority:        100
   - Regex:           '<openssl/'
-    Priority:        1
+    Priority:        4
   - Regex:           '<(mysql|protobuf-c)/'
-    Priority:        1
+    Priority:        4
   - Regex:           '.*'
     Priority:        0
 IndentExternBlock: NoIndent
@@ -74,3 +78,4 @@ PenaltyBreakString: 80
 PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
+ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe' ]
diff --git a/.clang-format.headers b/.clang-format.headers
index 88abddd2c8..4b4d091fa2 100644
--- a/.clang-format.headers
+++ b/.clang-format.headers
@@ -34,24 +34,40 @@ PointerAlignment: Right
 PointerBindsToType: false
 IncludeBlocks: Regroup
 IncludeCategories:
-  - Regex:           '^<isc/'
+  - Regex:           '^<(urcu/urcu-|urcu-)'
     Priority:        2
-  - Regex:           '^<dns/'
+  - Regex:           '^<urcu/'
     Priority:        3
-  - Regex:           '^<iscccc/'
-    Priority:        4
-  - Regex:           '^<isccfg/'
+  - Regex:           '^<isc/'
     Priority:        5
+  - Regex:           '^<(pk11|pkcs11)/'
+    Priority:        10
+  - Regex:           '^<dns/'
+    Priority:        15
+  - Regex:           '^<dst/'
+    Priority:        20
+  - Regex:           '^<isccc/'
+    Priority:        25
+  - Regex:           '^<isccfg/'
+    Priority:        30
   - Regex:           '^<ns/'
-    Priority:        6
-  - Regex:           '^(<[^/]*)/)'
-    Priority:        8
+    Priority:        35
+  - Regex:           '^<irs/'
+    Priority:        40
+  - Regex:           '^<(dig|named|rndc|confgen|dlz)/'
+    Priority:        50
+  - Regex:           '^<dlz_'
+    Priority:        55
+  - Regex:           '^".*"'
+    Priority:        99
   - Regex:           '^<tests/'
-    Priority:        10
-  - Regex:           '<[[:alnum:].]+>'
-    Priority:        1
-  - Regex:           '".*"'
-    Priority:        9
+    Priority:        100
+  - Regex:           '<openssl/'
+    Priority:        4
+  - Regex:           '<(mysql|protobuf-c)/'
+    Priority:        4
+  - Regex:           '.*'
+    Priority:        0
 IndentExternBlock: NoIndent
 KeepEmptyLinesAtTheStartOfBlocks: false
 MaxEmptyLinesToKeep: 1
diff --git a/configure.ac b/configure.ac
index b38a82663d..e0e893b50b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -611,6 +611,9 @@ AC_CHECK_DECLS([UV_UDP_LINUX_RECVERR], [], [], [[#include <uv.h>]])
 
 AX_RESTORE_FLAGS([libuv])
 
+# userspace-rcu (QSBR variant)
+PKG_CHECK_MODULES([LIBURCU], [liburcu-qsbr liburcu-cds])
+
 # [pairwise: --enable-doh --with-libnghttp2=auto, --enable-doh --with-libnghttp2=yes, --disable-doh]
 AC_ARG_ENABLE([doh],
 	      [AS_HELP_STRING([--disable-doh], [disable DNS over HTTPS, removes dependency on libnghttp2 (default is --enable-doh)])],
diff --git a/doc/arm/build.inc.rst b/doc/arm/build.inc.rst
index 93a08ecadc..f47ca5d651 100644
--- a/doc/arm/build.inc.rst
+++ b/doc/arm/build.inc.rst
@@ -56,6 +56,7 @@ Required Libraries
 To build BIND 9, the following packages must be installed:
 
 - ``libcrypto``, ``libssl``
+- ``liburcu``
 - ``libuv``
 - ``perl``
 - ``pkg-config`` / ``pkgconfig`` / ``pkgconf``
@@ -73,6 +74,9 @@ in a nonstandard location, specify the prefix using
 PKCS#11 hardware service module for cryptographic operations,
 ``engine_pkcs11`` from the OpenSC project must be compiled and used.
 
+The Userspace RCU library ``liburcu`` (https://liburcu.org/) is used
+for lock-free data structures and concurrent safe memory reclamation.
+
 On Linux, process capabilities are managed in user space using the
 ``libcap`` library
 (https://git.kernel.org/pub/scm/libs/libcap/libcap.git/), which can be
diff --git a/lib/isc/Makefile.am b/lib/isc/Makefile.am
index 8e88e69311..e822b73452 100644
--- a/lib/isc/Makefile.am
+++ b/lib/isc/Makefile.am
@@ -212,6 +212,7 @@ endif USE_ISC_RWLOCK
 libisc_la_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
 	$(LIBISC_CFLAGS)	\
+	$(LIBURCU_CFLAGS)	\
 	$(LIBUV_CFLAGS)		\
 	$(OPENSSL_CFLAGS)	\
 	$(ZLIB_CFLAGS)
@@ -221,6 +222,7 @@ libisc_la_LDFLAGS =		\
 	-release "$(PACKAGE_VERSION)"
 
 libisc_la_LIBADD =		\
+	$(LIBURCU_LIBS)		\
 	$(LIBUV_LIBS)		\
 	$(OPENSSL_LIBS)		\
 	$(ZLIB_LIBS)