Plant manager, not a security person, but we lost a board out of a remote pump house last year and I had to clean up after it, so this is what we do now.
One credential per device, never shared. If two boards ever run the same token, the second login takes over the first one’s session and you spend a week chasing « flapping » devices. Tokens and the PSK go into NVS at the bench, like Aoife says, so the binary carries no secrets. Flash encryption on production boards once you’ve practised on a couple of spares.
On the Hermetry side, the profile has an Allowed networks field. Put the public address range your cabinet routers use in it. A token dumped from a stolen board is then refused from anywhere else (CONNACK 5, and the reason shows on the device’s Log tab). That one setting made our IT people much calmer.
When a board goes missing, revoke its credential (the API has DELETE on the device’s credentials) or just delete the device, and the old token stops working at once, with every open session cut. Admins also get a notice when a device logs in from a network it hasn’t used before, so watch for those.
For the PSK, put the sensors on their own SSID or VLAN on the router so a leaked PSK only gets you onto a network with nothing else on it.
Most of this is on the device credentials page.