diff --git a/src/libmsc/msc_a.c b/src/libmsc/msc_a.c
index a79cf6a..583f9e7 100644
--- a/src/libmsc/msc_a.c
+++ b/src/libmsc/msc_a.c
@@ -1404,6 +1404,7 @@
 int msc_a_ran_dec_from_msc_i(struct msc_a *msc_a, struct msc_a_ran_dec_data *d)
 {
 	struct vlr_subscr *vsub = msc_a_vsub(msc_a);
+	struct gsm_network *net = msc_a_net(msc_a);
 	const struct ran_msg *msg = d->ran_dec;
 	int rc = -99;
 
@@ -1459,7 +1460,25 @@
 			msc_a->geran_encr.alg_id = msg->cipher_mode_complete.alg_id;
 			LOG_MSC_A(msc_a, LOGL_DEBUG, "Cipher Mode Complete: chosen encryption algorithm: A5/%u\n",
 				  msc_a->geran_encr.alg_id - 1);
-		};
+		}
+
+		if (msc_a->c.ran->type == OSMO_RAT_UTRAN_IU) {
+			int16_t utran_encryption;
+
+			/* utran: ensure chosen ciphering mode is allowed
+			 * If the IE is missing (utran_encryption == -1), parse it as no encryption */
+			utran_encryption = msg->cipher_mode_complete.utran_encryption;
+			if (utran_encryption == -1)
+				utran_encryption = 0;
+			if ((net->uea_encryption_mask & (1 << utran_encryption)) == 0) {
+				/* cipher disallowed */
+				LOG_MSC_A(msc_a, LOGL_ERROR, "Cipher Mode Complete: RNC chosen forbidden ciphering UEA%d\n",
+					  msg->cipher_mode_complete.utran_encryption);
+				vlr_subscr_rx_ciph_res(vsub, VLR_CIPH_REJECT);
+				rc = 0;
+				break;
+			}
+		}
 		vlr_subscr_rx_ciph_res(vsub, VLR_CIPH_COMPL);
 		rc = 0;
 
diff --git a/src/libmsc/ran_msg_iu.c b/src/libmsc/ran_msg_iu.c
index 7b3dd1c..81147cf 100644
--- a/src/libmsc/ran_msg_iu.c
+++ b/src/libmsc/ran_msg_iu.c
@@ -211,12 +211,20 @@
 		ranap_free_rab_setupormodifieditemies(&setup_ies);
 }
 
-static void ran_iu_decode_security_mode_complete(struct ran_dec *ran_iu_decode)
+static void ran_iu_decode_security_mode_complete(struct ran_dec *ran_iu_decode,  const RANAP_SecurityModeCompleteIEs_t *ies)
 {
 	struct ran_msg ran_dec_msg = {
 		.msg_type = RAN_MSG_CIPHER_MODE_COMPLETE,
 		.msg_name = "RANAP SecurityModeControl successfulOutcome",
+		.cipher_mode_complete = {
+			.utran_integrity = ies->chosenIntegrityProtectionAlgorithm,
+			.utran_encryption = -1,
+		},
 	};
+
+	if (ies->presenceMask & SECURITYMODECOMPLETEIES_RANAP_CHOSENENCRYPTIONALGORITHM_PRESENT)
+		ran_dec_msg.cipher_mode_complete.utran_encryption = ies->chosenEncryptionAlgorithm;
+
 	ran_decoded(ran_iu_decode, &ran_dec_msg);
 }
 
@@ -272,7 +280,7 @@
 	case RANAP_ProcedureCode_id_SecurityModeControl:
 		switch (message->direction) {
 		case RANAP_RANAP_PDU_PR_successfulOutcome:
-			ran_iu_decode_security_mode_complete(ran_iu_decode);
+			ran_iu_decode_security_mode_complete(ran_iu_decode, &message->msg.securityModeCompleteIEs);
 			return;
 		case RANAP_RANAP_PDU_PR_unsuccessfulOutcome:
 			ran_iu_decode_security_mode_reject(ran_iu_decode);