diff --git a/src/gprs_pcu.c b/src/gprs_pcu.c
index df439ef..37563ec 100644
--- a/src/gprs_pcu.c
+++ b/src/gprs_pcu.c
@@ -31,6 +31,7 @@
 
 static struct osmo_tdef T_defs_pcu[] = {
 	{ .T=3190,  .default_val=5,   .unit=OSMO_TDEF_S,  .desc="Return to packet idle mode after Packet DL Assignment on CCCH (s)", .val=0},
+	{ .T=3141,  .default_val=10, .unit=OSMO_TDEF_S, .desc="Timeout for contention resolution procedure (s)", .val=0 },
 	{ .T=PCU_TDEF_NEIGH_RESOLVE_TO,    .default_val=1000,  .unit=OSMO_TDEF_MS,   .desc="[ARFCN+BSIC]->[RAC+CI] resolution timeout (ms)", .val=0 },
 	{ .T=PCU_TDEF_SI_RESOLVE_TO,	   .default_val=1000,  .unit=OSMO_TDEF_MS,   .desc="RIM RAN-INFO response timeout (ms)",	    .val=0 },
 	{ .T=PCU_TDEF_NEIGH_CACHE_ALIVE,   .default_val=5,  .unit=OSMO_TDEF_S,   .desc="[ARFCN+BSIC]->[RAC+CI] resolution cache entry storage timeout (s)", .val=0 },
diff --git a/src/tbf.cpp b/src/tbf.cpp
index 672146f..fddede6 100644
--- a/src/tbf.cpp
+++ b/src/tbf.cpp
@@ -92,6 +92,7 @@
 
 static const struct value_string tbf_timers_names[] = {
 	OSMO_VALUE_STRING(T0),
+	OSMO_VALUE_STRING(T3141),
 	OSMO_VALUE_STRING(T3169),
 	OSMO_VALUE_STRING(T3191),
 	OSMO_VALUE_STRING(T3193),
@@ -436,7 +437,7 @@
 		return osmo_timer_pending(&Tarr[t]);
 
 	/* we don't start with T0 because it's internal timer which requires special handling */
-	for (i = T3169; i < T_MAX; i++)
+	for (i = T3141; i < T_MAX; i++)
 		if (osmo_timer_pending(&Tarr[i]))
 			return true;
 
@@ -469,6 +470,11 @@
 
 #define T_CBACK(t, diag) static void cb_##t(void *_tbf) { tbf_timeout_free((struct gprs_rlcmac_tbf *)_tbf, t, diag); }
 
+/* 3GPP TS 44.018 sec 3.5.2.1.5: On the network side, if timer T3141 elapses
+ * before a successful contention resolution procedure is completed, the newly
+ * allocated temporary block flow is released as specified in 3GPP TS 44.060 and
+ * the packet access is forgotten.*/
+T_CBACK(T3141, true)
 T_CBACK(T3169, true)
 T_CBACK(T3191, true)
 T_CBACK(T3193, false)
@@ -518,6 +524,9 @@
 	case T0:
 		Tarr[t].cb = tbf_timer_cb;
 		break;
+	case T3141:
+		Tarr[t].cb = cb_T3141;
+		break;
 	case T3169:
 		Tarr[t].cb = cb_T3169;
 		break;
@@ -869,7 +878,7 @@
 		gprs_rlcmac_ul_tbf *ul_tbf = as_ul_tbf(this);
 
 		/* be sure to check first, if contention resolution is done,
-		 * otherwise we cannot send the assignment yet */
+		 * otherwise we cannot send the assignment yet (3GPP TS 44.060 sec 7.1.3.1) */
 		if (!ul_tbf->m_contention_resolution_done) {
 			LOGPTBF(this, LOGL_DEBUG,
 				"Cannot assign DL TBF now, because contention resolution is not finished.\n");
diff --git a/src/tbf.h b/src/tbf.h
index ca6de0f..17f5b18 100644
--- a/src/tbf.h
+++ b/src/tbf.h
@@ -126,6 +126,9 @@
 	/* internal assign/reject timer */
 	T0,
 
+	/* Wait contention resolution success on UL TBFs assigned over CCCH */
+	T3141,
+
 	/* Wait for reuse of USF and TFI(s) after the MS uplink assignment for this TBF is invalid. */
 	T3169,
 
diff --git a/src/tbf_dl.cpp b/src/tbf_dl.cpp
index fc53c84..27dc4cf 100644
--- a/src/tbf_dl.cpp
+++ b/src/tbf_dl.cpp
@@ -239,6 +239,10 @@
 
 	ul_tbf = ms_ul_tbf(ms);
 
+	/* 3GPP TS 44.060 sec 7.1.3.1 Initiation of the Packet resource request procedure:
+	* "Furthermore, the mobile station shall not respond to PACKET DOWNLINK ASSIGNMENT
+	* or MULTIPLE TBF DOWNLINK ASSIGNMENT messages before contention resolution is
+	* completed on the mobile station side." */
 	if (ul_tbf && ul_tbf->m_contention_resolution_done
 	 && !ul_tbf->m_final_ack_sent) {
 		use_trx = ul_tbf->trx->trx_no;
diff --git a/src/tbf_ul.cpp b/src/tbf_ul.cpp
index 686eea5..7486b47 100644
--- a/src/tbf_ul.cpp
+++ b/src/tbf_ul.cpp
@@ -173,6 +173,7 @@
 	}
 	TBF_SET_STATE(tbf, GPRS_RLCMAC_FLOW);
 	TBF_ASS_TYPE_SET(tbf, GPRS_RLCMAC_FLAG_CCCH);
+	tbf->contention_resolution_start();
 	OSMO_ASSERT(tbf->ms());
 
 	return tbf;
@@ -300,6 +301,37 @@
 	return false;
 }
 
+void gprs_rlcmac_ul_tbf::contention_resolution_start()
+{
+	/* 3GPP TS 44.018 sec 11.1.2 Timers on the network side: "This timer is
+	 * started when a temporary block flow is allocated with an IMMEDIATE
+	 * ASSIGNMENT or an IMMEDIATE PACKET ASSIGNMENT or an EC IMMEDIATE
+	 * ASSIGNMENT TYPE 1 message during a packet access procedure. It is
+	 * stopped when the mobile station has correctly seized the temporary
+	 * block flow."
+	 * In our code base, it means we want to do contention resolution
+	 * timeout only for one-phase packet access, since two-phase is handled
+	 * through SBA structs, which are freed by the PDCH UL Controller if the
+	 * single allocated block is lost. */
+	T_START(this, T3141, 3141, "Contention resolution (UL-TBF, CCCH)", true);
+}
+void gprs_rlcmac_ul_tbf::contention_resolution_success()
+{
+	if (m_contention_resolution_done)
+		return;
+
+	/* 3GPP TS 44.060 sec 7a.2.1 Contention Resolution */
+	/* 3GPP TS 44.018 3.5.2.1.4 Packet access completion: The one phase
+	   packet access procedure is completed at a successful contention
+	   resolution. The mobile station has entered the packet transfer mode.
+	   Timer T3141 is stopped on the network side */
+	t_stop(T3141, "Contention resolution success (UL-TBF, CCCH)");
+
+	/* now we must set this flag, so we are allowed to assign downlink
+	 * TBF on PACCH. it is only allowed when TLLI is acknowledged. */
+	m_contention_resolution_done = 1;
+}
+
 struct msgb *gprs_rlcmac_ul_tbf::create_ul_ack(uint32_t fn, uint8_t ts)
 {
 	int final = (state_is(GPRS_RLCMAC_FINISHED));
@@ -333,9 +365,15 @@
 	bitvec_pack(ack_vec, msgb_put(msg, 23));
 	bitvec_free(ack_vec);
 
-	/* now we must set this flag, so we are allowed to assign downlink
-	 * TBF on PACCH. it is only allowed when TLLI is acknowledged. */
-	m_contention_resolution_done = 1;
+	/* TS 44.060 7a.2.1.1: "The contention resolution is completed on
+	 * the network side when the network receives an RLC data block that
+	 * comprises the TLLI value that identifies the mobile station and the
+	 * TFI value associated with the TBF."
+	 * However, it's handier for us to mark contention resolution success
+	 * here since according to spec upon rx UL ACK is the time at which MS
+	 * realizes contention resolution succeeds. */
+	if (ms_tlli(ms()) != GSM_RESERVED_TMSI)
+		contention_resolution_success();
 
 	if (final) {
 		set_polling(new_poll_fn, ts, PDCH_ULC_POLL_UL_ACK);
diff --git a/src/tbf_ul.h b/src/tbf_ul.h
index 0b9be28..9396633 100644
--- a/src/tbf_ul.h
+++ b/src/tbf_ul.h
@@ -87,6 +87,8 @@
 	void set_window_size();
 	void update_coding_scheme_counter_ul(enum CodingScheme cs);
         void usf_timeout();
+	void contention_resolution_start();
+	void contention_resolution_success();
 
 	/* Please note that all variables here will be reset when changing
 	 * from WAIT RELEASE back to FLOW state (re-use of TBF).