That security has to be by design, and not an afterthought, is well-understood. While there has been a lot of isolated vertical research in hardware security over the years, efforts towards integrating those ideas into a system have only recently begun. The free and open RISC-V ISA and its many open-source implementations have been an important catalyst in this direction. In this talk, we will discuss our experience and some of the progress we have made towards securing a RISC-V system-on-chip by design. In particular, we will discuss some of its building blocks such as post-quantum secure boot, memory protection unit, and PUF based key management.