A method is provided for secure firmware provisioning of a device. In the method, an integrated circuit (IC) is manufactured by a first entity for use in the device. The IC is provided to a second entity for manufacturing the device using the IC. The IC has a unique identifier (UID) and secret key derivation data (KDD). A secure memory is provided to a third entity. The secure memory has a first key pair, and the secure memory is used with a firmware provisioning toolchain of the second entity. During manufacturing of the device by the second entity, the secure memory is enabled to verify the IC by verifying the UID. The secure memory stores a firmware decryption key, and is enabled to encrypt the firmware decryption key. The encrypted firmware decryption key is then provided to the IC, and the IC decrypts the encrypted firmware decryption key for use by the IC in decrypting the firmware.