diff --git a/include/openbsc/mgcp_internal.h b/include/openbsc/mgcp_internal.h
index b58eb9b..b2c2408 100644
--- a/include/openbsc/mgcp_internal.h
+++ b/include/openbsc/mgcp_internal.h
@@ -64,6 +64,7 @@
 	uint32_t stats_jitter;
 	int32_t stats_transit;
 	int stats_cycles;
+	bool patched_first_rtp_payload; /* FIXME: drop this, see OS#2459 */
 };
 
 struct mgcp_rtp_codec {
diff --git a/src/libmgcp/mgcp_network.c b/src/libmgcp/mgcp_network.c
index c9fe179..399dc8f 100644
--- a/src/libmgcp/mgcp_network.c
+++ b/src/libmgcp/mgcp_network.c
@@ -667,6 +667,19 @@
 			forward_data(rtp_end->rtp.fd, &endp->taps[tap_idx],
 				     buf, len);
 
+			/* FIXME: HACK HACK HACK. See OS#2459.
+			 * The ip.access nano3G needs the first RTP payload's first two bytes to read hex
+			 * 'e400', or it will reject the RAB assignment. It seems to not harm other femto
+			 * cells (as long as we patch only the first RTP payload in each stream).
+			 */
+			if (tap_idx == MGCP_TAP_BTS_OUT
+			    && !rtp_state->patched_first_rtp_payload) {
+				uint8_t *data = (uint8_t*)&buf[12];
+				data[0] = 0xe4;
+				data[1] = 0x00;
+				rtp_state->patched_first_rtp_payload = true;
+			}
+
 			rc = mgcp_udp_send(rtp_end->rtp.fd,
 					   &rtp_end->addr,
 					   rtp_end->rtp_port, buf, len);