A method for preparing an electronic Subscriber Identity Module, eSIM, for provisioning , the method comprising: by a provisioning server : encrypting the eSIM with a symmetric key (Ke) before establishment of an eSIM provisioning session with a target embedded Universal Integrated Circuit Card, eUICC; determining the target eUICC to which to provision the eSIM in response to establishment of the eSIM provisioning session; accessing a pre-stored data random, DR, value associated with the target eUICC; deriving , using a key agreement protocol, a key encryption key, KEK, based at least in part on a private key associated with the provisioning server, a public key associated with the target eUICC, PK eUICC , and the pre-stored DR value; encrypting the symmetric key with the KEK; formatting an eSIM package comprising the eSIM encrypted with the symmetric key, the symmetric key encrypted with the KEK, and a public key corresponding to the private key associated with the provisioning server; establishing an eSIM provisioning session with the target eUICC; and sending the eSIM package to the target eUICC, wherein: the symmetric key is not specific to the target eUICC, and the public key associated with the target eUICC, PK eUICC , is specific to the target eUICC. by a provisioning server : encrypting the eSIM with a symmetric key (Ke) before establishment of an eSIM provisioning session with a target embedded Universal Integrated Circuit Card, eUICC; determining the target eUICC to which to provision the eSIM in response to establishment of the eSIM provisioning session; accessing a pre-stored data random, DR, value associated with the target eUICC; deriving , using a key agreement protocol, a key encryption key, KEK, based at least in part on a private key associated with the provisioning server, a public key associated with the target eUICC, PK eUICC , and the pre-stored DR value; encrypting the symmetric key with the KEK; formatting an eSIM package comprising the eSIM encrypted with the symmetric key, the symmetric key encrypted with the KEK, and a public key corresponding to the private key associated with the provisioning server; encrypting the eSIM with a symmetric key (Ke) before establishment of an eSIM provisioning session with a target embedded Universal Integrated Circuit Card, eUICC; determining the target eUICC to which to provision the eSIM in response to establishment of the eSIM provisioning session; accessing a pre-stored data random, DR, value associated with the target eUICC; deriving , using a key agreement protocol, a key encryption key, KEK, based at least in part on a private key associated with the provisioning server, a public key associated with the target eUICC, PK eUICC , and the pre-stored DR value; encrypting the symmetric key with the KEK; formatting an eSIM package comprising the eSIM encrypted with the symmetric key, the symmetric key encrypted with the KEK, and a public key corresponding to the private key associated with the provisioning server; establishing an eSIM provisioning session with the target eUICC; and sending the eSIM package to the target eUICC, wherein: the symmetric key is not specific to the target eUICC, and the public key associated with the target eUICC, PK eUICC , is specific to the target eUICC. sending the eSIM package to the target eUICC, wherein: the symmetric key is not specific to the target eUICC, and the public key associated with the target eUICC, PK eUICC , is specific to the target eUICC. the symmetric key is not specific to the target eUICC, and the public key associated with the target eUICC, PK eUICC , is specific to the target eUICC. <EOS>