factory image write-protect

Hi all,

My project includes remote programming for the fpga+nios updates and flash device we use is EPCS128.

My question is how should I implement write-protect for the flash to protect factory image from unintended writing.

Usually, the factory image is stored from address x"0" in the flash and I checked the EPCS128 datasheet and found out their sector protect bits only cover the higher address sectors.

I guess what i want to do is quite common so i wonder how usually people do to get it?

Thanks.