diff --git a/util/otbn_build.py b/util/otbn_build.py
index 93f8f2f..51256c8 100755
--- a/util/otbn_build.py
+++ b/util/otbn_build.py
@@ -170,15 +170,27 @@
         out_elf = out_dir / (app_name + '.elf')
         call_otbn_ld(obj_files, out_elf, linker_script = args.linker_script)
 
+        # Use objcopy to create an ELF that can be linked into a RISC-V binary
+        # (to run on Ibex). This should set flags for all sections to look like
+        # rodata (since they're not executable on Ibex, nor does it make sense
+        # for Ibex code to manipulate OTBN data sections "in place"). We name
+        # them with a .otbn prefix, so end up with e.g. .rodata.otbn.text and
+        # .rodata.otbn.data.
+        #
+        # Symbols that are exposed by the binary (including those giving the
+        # start and end of imem and dmem) will be relocated as part of the
+        # link, so they'll give addresses in the Ibex address space. So that
+        # the RISC-V binary can link multiple OTBN applications, we give them
+        # an application-specific prefix. (Note: This prefix is used in
+        # sw/device/lib/runtime/otbn.h: so needs to be kept in sync with that).
+        sym_pfx = '_otbn_app_{}_'.format(app_name)
         out_embedded_obj = out_dir / (app_name + '.rv32embed.o')
-        args = [
-            '-O',
-            'elf32-littleriscv',
-            '--prefix-symbols',
-            '_otbn_app_' + app_name + '_',
-            out_elf,
-            out_embedded_obj,
-        ]
+        args = (['-O', 'elf32-littleriscv',
+                 '--prefix-sections=.rodata.otbn',
+                 '--set-section-flags=*=alloc,load,readonly',
+                 '--prefix-symbols', sym_pfx] +
+                [out_elf,
+                 out_embedded_obj])
 
         call_rv32_objcopy(args)
     except subprocess.CalledProcessError as e: