OPTIGA Trust M Express ships with Infineon-issued X.509 device certificates pre-loaded at factory, enabling AWS IoT Core and Azure IoT Hub just-in-time registration (JITR) without OEM-operated provisioning infrastructure. The secure element’s Common Criteria EAL6+ certified hardware ensures private keys can never be extracted by software, firmware, or physical probing attacks. Runtime binding between OPTIGA and host MCU using a shared secret prevents clone attacks where an attacker transplants the secure element to an unauthorised device. Cryptographic operations execute in under 200 ms for ECC P-256 sign, fast enough for real-time device authentication in industrial protocols. Arduino, ESP-IDF, Mbed TLS, and Zephyr integration libraries provided.