diff --git a/openbsc/src/gprs/gprs_gmm.c b/openbsc/src/gprs/gprs_gmm.c
index 7d00bd5..14043ce 100644
--- a/openbsc/src/gprs/gprs_gmm.c
+++ b/openbsc/src/gprs/gprs_gmm.c
@@ -612,6 +612,9 @@
 
 	ctx->is_authenticated = 1;
 
+	if (ctx->ran_type == MM_CTX_T_UTRAN_Iu)
+		ctx->iu.new_key = 1;
+
 	/* FIXME: enable LLC cipheirng */
 
 	/* Check if we can let the mobile station enter */
@@ -690,6 +693,9 @@
 /* Check if we can already authorize a subscriber */
 static int gsm48_gmm_authorize(struct sgsn_mm_ctx *ctx)
 {
+#ifdef BUILD_IU
+	int rc;
+#endif
 #ifndef PTMSI_ALLOC
 	struct sgsn_signal_data sig_data;
 #endif
@@ -743,6 +749,13 @@
 	}
 
 	/* The MS is authorized */
+#ifdef BUILD_IU
+	if (ctx->ran_type == MM_CTX_T_UTRAN_Iu && !ctx->iu.ue_ctx->integrity_active) {
+		rc = iu_tx_sec_mode_cmd(ctx->iu.ue_ctx, &ctx->auth_triplet, 0, ctx->iu.new_key);
+		ctx->iu.new_key = 0;
+		return rc;
+	}
+#endif
 
 	switch (ctx->pending_req) {
 	case 0:
diff --git a/openbsc/src/gprs/gprs_sgsn.c b/openbsc/src/gprs/gprs_sgsn.c
index 19b0a1b..dd7e008 100644
--- a/openbsc/src/gprs/gprs_sgsn.c
+++ b/openbsc/src/gprs/gprs_sgsn.c
@@ -244,6 +244,7 @@
 
 	ctx->ran_type = MM_CTX_T_UTRAN_Iu;
 	ctx->iu.ue_ctx = uectx;
+	ctx->iu.new_key = 1;
 	ctx->mm_state = GMM_DEREGISTERED;
 	ctx->auth_triplet.key_seq = GSM_KEY_SEQ_INVAL;
 	ctx->ctrg = rate_ctr_group_alloc(ctx, &mmctx_ctrg_desc, 0);