diff --git a/tests/bsim/bluetooth/host/att/compile.sh b/tests/bsim/bluetooth/host/att/compile.sh
index b3da250ba1b..59d232be3a4 100755
--- a/tests/bsim/bluetooth/host/att/compile.sh
+++ b/tests/bsim/bluetooth/host/att/compile.sh
@@ -23,6 +23,8 @@ app=tests/bsim/bluetooth/host/att/retry_on_sec_err/server compile
 app=tests/bsim/bluetooth/host/att/sequential/dut compile
 app=tests/bsim/bluetooth/host/att/sequential/tester compile
 app=tests/bsim/bluetooth/host/att/pipeline/dut compile
+app=tests/bsim/bluetooth/host/att/pipeline/dut \
+    conf_file='prj.conf;rx_tx_prio_invert.extra.conf' compile
 app=tests/bsim/bluetooth/host/att/pipeline/tester compile
 app=tests/bsim/bluetooth/host/att/long_read compile
 app=tests/bsim/bluetooth/host/att/open_close compile
diff --git a/tests/bsim/bluetooth/host/att/pipeline/dut/Kconfig b/tests/bsim/bluetooth/host/att/pipeline/dut/Kconfig
new file mode 100644
index 00000000000..71d844b76ee
--- /dev/null
+++ b/tests/bsim/bluetooth/host/att/pipeline/dut/Kconfig
@@ -0,0 +1,14 @@
+# Copyright 2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+# This file adds prompts to allow setting the symbols in a
+# configuration file (e.g. 'prj.conf'), as needed for some of
+# the test variants.
+
+config BT_HCI_TX_PRIO
+	prompt ""
+
+config BT_RX_PRIO
+	prompt ""
+
+source "Kconfig.zephyr"
diff --git a/tests/bsim/bluetooth/host/att/pipeline/dut/rx_tx_prio_invert.extra.conf b/tests/bsim/bluetooth/host/att/pipeline/dut/rx_tx_prio_invert.extra.conf
new file mode 100644
index 00000000000..555da337bf5
--- /dev/null
+++ b/tests/bsim/bluetooth/host/att/pipeline/dut/rx_tx_prio_invert.extra.conf
@@ -0,0 +1,2 @@
+CONFIG_BT_HCI_TX_PRIO=8
+CONFIG_BT_RX_PRIO=7
diff --git a/tests/bsim/bluetooth/host/att/pipeline/test_scripts/_compile.sh b/tests/bsim/bluetooth/host/att/pipeline/test_scripts/_compile.sh
index ff0f485b17d..06d5d718a9d 100755
--- a/tests/bsim/bluetooth/host/att/pipeline/test_scripts/_compile.sh
+++ b/tests/bsim/bluetooth/host/att/pipeline/test_scripts/_compile.sh
@@ -8,6 +8,7 @@ INCR_BUILD=1
 source ${ZEPHYR_BASE}/tests/bsim/compile.source
 
 app="$(guess_test_relpath)"/dut compile
+app="$(guess_test_relpath)"/dut conf_file='prj.conf;rx_tx_prio_invert.extra.conf' compile
 app="$(guess_test_relpath)"/tester compile
 
 wait_for_background_jobs
diff --git a/tests/bsim/bluetooth/host/att/pipeline/test_scripts/run_test_shall_not_pipeline_variant_rx_tx_prio_invert.sh b/tests/bsim/bluetooth/host/att/pipeline/test_scripts/run_test_shall_not_pipeline_variant_rx_tx_prio_invert.sh
new file mode 100755
index 00000000000..d271c9c04fa
--- /dev/null
+++ b/tests/bsim/bluetooth/host/att/pipeline/test_scripts/run_test_shall_not_pipeline_variant_rx_tx_prio_invert.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Copyright 2023-2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+#  Test purpose:
+#
+#  Basic check that the DUT GATT client does not pipeline ATT
+#  requests.
+#
+#  Sending a new request on a bearer before the response to the
+#  previous request has been received ('pipelining') is a
+#  protocol violation.
+#
+#  Test variant 'rx_tx_prio_invert':
+#
+#  - The priority of the RX and TX threads is inverted compared
+#    to the default configuration. The result shall be the same.
+#
+#  Test procedure:
+#
+#  - DUT is excercised by calling `gatt_write` in a loop.
+#  - Tester does not immediately respond but delays the response
+#    a bit to ensure the LL has time to transport any extra
+#    requests, exposing a bug.
+#  - Tester verifies there is no such extra request while it's
+#    delaying the response. Detecting an extra request proves a
+#    protocol violation.
+
+source ${ZEPHYR_BASE}/tests/bsim/sh_common.source
+
+dut_exe="bs_${BOARD_TS}_tests_bsim_bluetooth_host_att_pipeline_dut_prj_conf"
+dut_exe+="_rx_tx_prio_invert_extra_conf"
+tester_exe="bs_${BOARD_TS}_tests_bsim_bluetooth_host_att_pipeline_tester_prj_conf"
+
+simulation_id="att_pipeline_test_shall_not_pipeline_variant_rx_tx_prio_invert"
+verbosity_level=2
+sim_length_us=100e6
+
+cd ${BSIM_OUT_PATH}/bin
+
+Execute ./bs_2G4_phy_v1 \
+    -v=${verbosity_level} -s="${simulation_id}" -D=2 -sim_length=${sim_length_us} $@
+
+Execute "./$tester_exe" \
+    -v=${verbosity_level} -s="${simulation_id}" -d=1 -testid=tester_1 -RealEncryption=1 -rs=100
+
+Execute "./$dut_exe" \
+    -v=${verbosity_level} -s="${simulation_id}" -d=0 -testid=dut_1 -RealEncryption=1
+
+wait_for_background_jobs
diff --git a/tests/bsim/bluetooth/host/att/pipeline/test_scripts/run_test_tolerate_pipeline_variant_rx_tx_prio_invert.sh b/tests/bsim/bluetooth/host/att/pipeline/test_scripts/run_test_tolerate_pipeline_variant_rx_tx_prio_invert.sh
new file mode 100755
index 00000000000..bc7928e349f
--- /dev/null
+++ b/tests/bsim/bluetooth/host/att/pipeline/test_scripts/run_test_tolerate_pipeline_variant_rx_tx_prio_invert.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Copyright 2023-2024 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+#  Test purpose:
+#
+#  Check that DUT GATT server gracefully handles a pipelining
+#  client.
+#
+#  The DUT GATT server must remain available to a well-behaved
+#  peer while a bad peer tries to spam ATT requests.
+#
+#  Test variant 'rx_tx_prio_invert':
+#
+#  - The priority of the RX and TX threads is inverted compared
+#    to the default configuration. The result shall be the same.
+#
+#  Test procedure:
+#
+#  - The well-behaved peer performs a discovery procedure
+#    repeatedly.
+#  - The bad peer spams ATT requests as fast as possible.
+#  - The connection with the well-behaved peer shall remain
+#    responsive.
+#  - Either: The DUT may disconnect the bad peer ACL after
+#    receiving a protocol violation occurs. The bad peer shall
+#    be able to reconnect and continue the bad behavior.
+#  - Or: The DUT may process and respond to the pipelined
+#    requests, preserving their ordering.
+
+source ${ZEPHYR_BASE}/tests/bsim/sh_common.source
+
+dut_exe="bs_${BOARD_TS}_tests_bsim_bluetooth_host_att_pipeline_dut_prj_conf"
+dut_exe+="_rx_tx_prio_invert_extra_conf"
+tester_exe="bs_${BOARD_TS}_tests_bsim_bluetooth_host_att_pipeline_tester_prj_conf"
+
+simulation_id="att_pipeline_test_tolerate_pipeline_variant_rx_tx_prio_invert"
+verbosity_level=2
+sim_length_us=100e6
+
+cd ${BSIM_OUT_PATH}/bin
+
+Execute ./bs_2G4_phy_v1 \
+    -v=${verbosity_level} -s="${simulation_id}" -D=3 -sim_length=${sim_length_us} $@
+
+Execute "./$tester_exe" \
+    -v=${verbosity_level} -s="${simulation_id}" -d=2 -testid=tester -RealEncryption=1 -rs=100
+
+Execute "./$dut_exe" \
+    -v=${verbosity_level} -s="${simulation_id}" -d=1 -testid=dut -RealEncryption=1 -rs=2000
+
+Execute "./$dut_exe" \
+    -v=${verbosity_level} -s="${simulation_id}" -d=0 -testid=dut -RealEncryption=1
+
+wait_for_background_jobs