diff --git a/bts/BTS_Tests.ttcn b/bts/BTS_Tests.ttcn
index 06fe43b..c2de538 100644
--- a/bts/BTS_Tests.ttcn
+++ b/bts/BTS_Tests.ttcn
@@ -2532,16 +2532,28 @@
 	var PortNumber rtpem_bind_port := mp_rtpem_bind_port;
 	f_rtpem_bind(RTPEM_CTRL, mp_rtpem_bind_ip, rtpem_bind_port);
 
-	/* Step 3: send CRCX with the configured address/port to the IUT */
-	var RSL_Message rsl_pdu := f_rsl_transceive_ret(
-		ts_RSL_IPA_CRCX(g_chan_nr, f_inet_addr(mp_rtpem_bind_ip), rtpem_bind_port),
+	/* Step 3a: send CRCX to create an RTP connection at the IUT */
+	var RSL_Message crcx_ack := f_rsl_transceive_ret(
+		/* FIXME (OS#5242): do not include Remote IP/Port IEs because
+		 * osmo-bts would respond with nonsense listen addr='0.0.0.0'. */
+		ts_RSL_IPA_CRCX(g_chan_nr, omit, omit),
 		tr_RSL_IPA_CRCX_ACK(g_chan_nr, ?, ?, ?),
 		"IPA CRCX ACK");
+	var uint16_t conn_id := crcx_ack.ies[1].body.ipa_conn_id;
 
-	/* Step 4: connect to the IUT's address/port parsed from CRCX ACK */
-	var HostName local_addr := f_inet_ntoa(rsl_pdu.ies[2].body.ipa_local_ip);
-	var PortNumber local_port := rsl_pdu.ies[3].body.ipa_local_port;
-	f_rtpem_connect(RTPEM_CTRL, local_addr, local_port);
+	/* Step 3b: send MDCX with the configured address/port to the IUT */
+	var RSL_Message mdcx_ack := f_rsl_transceive_ret(
+		ts_RSL_IPA_MDCX(g_chan_nr, conn_id,
+				remote_ip := f_inet_addr(mp_rtpem_bind_ip),
+				remote_port := rtpem_bind_port,
+				rtp_pt2 := 0),
+		tr_RSL_IPA_MDCX_ACK(g_chan_nr, conn_id, ?, ?, ?),
+		"IPA MDCX ACK");
+
+	/* Step 4: connect to the IUT's address/port parsed from MDCX ACK */
+	var HostName bts_bind_ip := f_inet_ntoa(mdcx_ack.ies[2].body.ipa_local_ip);
+	var PortNumber bts_bind_port := mdcx_ack.ies[3].body.ipa_local_port;
+	f_rtpem_connect(RTPEM_CTRL, bts_bind_ip, bts_bind_port);
 
 	/* Step 5: set the given RTP emulation mode */
 	f_rtpem_mode(RTPEM_CTRL, mode);