According to docs, one can set locking range to ro (see setLockingRange <0-15> <ro|rw|lk> <password> <device>).
That said, not sure what setLockingRange actually does and wasn’t able to find good documentation.
$ sedutil-cli --setLockingRange 0 RO passw0rd /dev/nvme0
