diff --git a/scripts/ci/check_compliance.py b/scripts/ci/check_compliance.py
index 0d8e472f6c6c2a2..515b199585efc9c 100755
--- a/scripts/ci/check_compliance.py
+++ b/scripts/ci/check_compliance.py
@@ -546,10 +546,12 @@ def check_no_undef_outside_kconfig(self, kconf):
         # so we extract the references from each line ourselves instead.
         #
         # The regex uses word boundaries (\b) to isolate the reference, and
-        # negative lookahead to automatically whitelist the following:
+        # negative lookahead and lookbehind to automatically whitelist the following:
         #
         #  - ##, for token pasting (CONFIG_FOO_##X)
         #
+        #  - prefixed with CAT( for token pasting (CAT(CONFIG_FOO_,X) or CONCAT(CONFIG_FOO, X))
+        #
         #  - $, e.g. for CMake variable expansion (CONFIG_FOO_${VAR})
         #
         #  - @, e.g. for CMakes's configure_file() (CONFIG_FOO_@VAR@)
@@ -564,7 +566,7 @@ def check_no_undef_outside_kconfig(self, kconf):
         undef_to_locs = collections.defaultdict(list)
 
         # Warning: Needs to work with both --perl-regexp and the 're' module
-        regex = r"\bCONFIG_[A-Z0-9_]+\b(?!\s*##|[$@{*])"
+        regex = r"(?<!CAT\()\bCONFIG_[A-Z0-9_]+\b(?!\s*##|[$@{*])"
 
         # Skip doc/releases, which often references removed symbols
         grep_stdout = git("grep", "--line-number", "-I", "--null",