A method for preparing an electronic Subscriber Identity Module, eSIM, for provisioning, the method comprising: by a provisioning server: encrypting the eSIM with a symmetric key (Ke) before establishment of an eSIM provisioning session with a target embedded Universal Integrated Circuit Card, eUICC; determining the target eUICC to which to provision the eSIM in response to establishment of the eSIM provisioning session; accessing a pre-stored data random, DR, value associated with the target eUICC; deriving, using a key agreement protocol, a key encryption key, KEK, based at least in part on a private key associated with the provisioning server, a public key associated with the target eUICC, PK eUICC, and the pre-stored DR value; encrypting the symmetric key with the KEK; formatting an eSIM package comprising the eSIM encrypted with the symmetric key, the symmetric key encrypted with the KEK, and a public key corresponding to the private key associated with the provisioning server; establishing an eSIM provisioning session with the target eUICC; and sending the eSIM package to the target eUICC, wherein: the symmetric key is not specific to the target eUICC, and the public key associated with the target eUICC, PK eUICC, is specific to the target eUICC. by a provisioning server: encrypting the eSIM with a symmetric key (Ke) before establishment of an eSIM provisioning session with a target embedded Universal Integrated Circuit Card, eUICC; determining the target eUICC to which to provision the eSIM in response to establishment of the eSIM provisioning session; accessing a pre-stored data random, DR, value associated with the target eUICC; deriving, using a key agreement protocol, a key encryption key, KEK, based at least in part on a private key associated with the provisioning server, a public key associated with the target eUICC, PK eUICC, and the pre-stored DR value; encrypting the symmetric key with the KEK; formatting an eSIM package comprising the eSIM encrypted with the symmetric key, the symmetric key encrypted with the KEK, and a public key corresponding to the private key associated with the provisioning server; encrypting the eSIM with a symmetric key (Ke) before establishment of an eSIM provisioning session with a target embedded Universal Integrated Circuit Card, eUICC; determining the target eUICC to which to provision the eSIM in response to establishment of the eSIM provisioning session; accessing a pre-stored data random, DR, value associated with the target eUICC; deriving, using a key agreement protocol, a key encryption key, KEK, based at least in part on a private key associated with the provisioning server, a public key associated with the target eUICC, PK eUICC, and the pre-stored DR value; encrypting the symmetric key with the KEK; formatting an eSIM package comprising the eSIM encrypted with the symmetric key, the symmetric key encrypted with the KEK, and a public key corresponding to the private key associated with the provisioning server; establishing an eSIM provisioning session with the target eUICC; and sending the eSIM package to the target eUICC, wherein: the symmetric key is not specific to the target eUICC, and the public key associated with the target eUICC, PK eUICC, is specific to the target eUICC. sending the eSIM package to the target eUICC, wherein: the symmetric key is not specific to the target eUICC, and the public key associated with the target eUICC, PK eUICC, is specific to the target eUICC. the symmetric key is not specific to the target eUICC, and the public key associated with the target eUICC, PK eUICC, is specific to the target eUICC.