diff --git a/.vscode/tasks.json b/.vscode/tasks.json
index 0c989f9..2d8a120 100644
--- a/.vscode/tasks.json
+++ b/.vscode/tasks.json
@@ -24,6 +24,18 @@
                 "${workspaceFolder}\\tools\\flash_preserve_settings.ps1"
             ],
             "problemMatcher": []
+        },
+        {
+            "label": "Flash + Lock (full erase + APPROTECT)",
+            "type": "shell",
+            "command": "powershell",
+            "args": [
+                "-ExecutionPolicy",
+                "Bypass",
+                "-File",
+                "${workspaceFolder}\\tools\\flash_full_erase_lock.ps1"
+            ],
+            "problemMatcher": []
         }
     ]
 }
diff --git a/tools/flash_full_erase_lock.ps1 b/tools/flash_full_erase_lock.ps1
new file mode 100644
index 0000000..ecd915c
--- /dev/null
+++ b/tools/flash_full_erase_lock.ps1
@@ -0,0 +1,35 @@
+param(
+    [string]$Hex = "build\merged.hex"
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+$RepoRoot = Split-Path -Parent $PSScriptRoot
+$HexPath = Join-Path $RepoRoot $Hex
+
+if (-not (Test-Path -LiteralPath $HexPath)) {
+    throw "Hex file not found: $HexPath. Build the project first."
+}
+
+Write-Host "[FLASH] FULL ERASE + APPROTECT LOCK mode (production)"
+Write-Host "[FLASH] This wipes application flash, NVS/settings, and BLE bonds."
+Write-Host "[FLASH] After locking, SWD debug read/write is disabled permanently."
+Write-Host "[FLASH] To unlock later you MUST run 'nrfjprog --recover', which mass-erases the chip."
+Write-Host "[FLASH] DFU(SMP) over BLE still works after locking."
+Write-Host "[FLASH] Programming: $HexPath"
+
+# 1) 전체 지우고 서명된 펌웨어 프로그램
+Write-Host "[FLASH] Step 1/3: chip erase + program + verify"
+nrfjprog --program $HexPath --chiperase --verify --reset
+
+# 2) UICR.APPROTECT 잠금 (SWD 디버그 포트 차단)
+Write-Host "[FLASH] Step 2/3: enabling APPROTECT (readback protection)"
+nrfjprog --rbp ALL
+
+# 3) APPROTECT는 파워사이클/핀리셋 후 실제 적용됨
+Write-Host "[FLASH] Step 3/3: pin reset to apply protection"
+nrfjprog --pinreset
+
+Write-Host "[FLASH] Done. POWER-CYCLE the device to fully latch APPROTECT."
+Write-Host "[FLASH] Verify lock: 'nrfjprog --memrd 0x0' should now FAIL."