diff --git a/project/ble_peripheral/ble_app_bladder_patch/command/handlers/cmd_info.c b/project/ble_peripheral/ble_app_bladder_patch/command/handlers/cmd_info.c
index 2039635..6fab2bb 100644
--- a/project/ble_peripheral/ble_app_bladder_patch/command/handlers/cmd_info.c
+++ b/project/ble_peripheral/ble_app_bladder_patch/command/handlers/cmd_info.c
@@ -138,11 +138,18 @@ int Cmd_mrs(const ParsedCmd *cmd)
  *============================================================================*/
 int Cmd_mpz(const ParsedCmd *cmd)
 {
+    if (m_config.factory_provisioned != 0)
+    {
+        dr_ble_return_1("rpz:", 0xFFFF);
+        return 1;
+    }
+
     char passkey[7] = {0};
     dr_get_ascii(cmd, 0, passkey, 6);
 
     memcpy(m_static_passkey, passkey, 6);
     memcpy(m_config.static_passkey, m_static_passkey, 6);
+    m_config.factory_provisioned = 1;
     config_save();
 
     ascii_format_data(ble_bin_buffer, "rpz:", passkey, 6);
diff --git a/project/ble_peripheral/ble_app_bladder_patch/hal/fds/fstorage.c b/project/ble_peripheral/ble_app_bladder_patch/hal/fds/fstorage.c
index 0ff98af..a70db4a 100644
--- a/project/ble_peripheral/ble_app_bladder_patch/hal/fds/fstorage.c
+++ b/project/ble_peripheral/ble_app_bladder_patch/hal/fds/fstorage.c
@@ -112,6 +112,9 @@ void fds_default_value_set(void)
     m_config.piezo_num_samples = 100;    /* 100 samples */
     m_config.piezo_cycles      = 7;      /* 7 cycles */
     m_config.piezo_averaging   = 3;      /* 3x averaging */
+
+    /* Factory provisioning — default: not provisioned */
+    m_config.factory_provisioned = 0;
 }
 
 
diff --git a/project/ble_peripheral/ble_app_bladder_patch/hal/fds/fstorage.h b/project/ble_peripheral/ble_app_bladder_patch/hal/fds/fstorage.h
index ac321d2..a05d9e0 100644
--- a/project/ble_peripheral/ble_app_bladder_patch/hal/fds/fstorage.h
+++ b/project/ble_peripheral/ble_app_bladder_patch/hal/fds/fstorage.h
@@ -5,7 +5,7 @@
  * via the Nordic FDS library. Replaces external EEPROM and coexists safely
  * with the SoftDevice.
  *
- * config_data_t (48 bytes, packed):
+ * config_data_t (49 bytes, packed):
  *   magic_number  (4B) : format validation (0x20231226)
  *   hw_no         (12B): hardware version string
  *   serial_no     (12B): serial number (also used as BLE device name)
@@ -14,6 +14,7 @@
  *   reset_status  (1B) : reset cause code
  *   life_cycle    (4B) : device usage count
  *   piezo_*       (8B) : piezo measurement parameters
+ *   factory_provisioned(1B): passkey provisioning lock flag
  *
  * API:
  *   fs_storage_init() : initialise FDS (once at boot)
@@ -65,7 +66,10 @@ typedef struct
     uint16_t    piezo_averaging;    /* 2B  - averages per channel (1..10) */
     uint16_t    piezo_delay_us;     /* 2B  - delay from TX pulse to ADC start (us) (0..30) */
     uint16_t    piezo_num_samples;  /* 2B  - ADC sample count (80..140) */
-} config_data_t;  /* Total: 48 bytes */
+
+    /* Factory provisioning lock */
+    uint8_t     factory_provisioned; /* 1B  - 0=passkey not set, 1=passkey set (locked) */
+} config_data_t;  /* Total: 49 bytes */
 
 extern config_data_t m_config;