diff --git a/include/osmo-bts/cbch.h b/include/osmo-bts/cbch.h
index 6bba5fa22..d5521f06d 100644
--- a/include/osmo-bts/cbch.h
+++ b/include/osmo-bts/cbch.h
@@ -21,3 +21,5 @@ int bts_process_smscb_cmd(struct gsm_bts *bts, struct rsl_ie_cb_cmd_type cmd_typ
 /* call-back from bts model specific code when it wants to obtain a CBCH
  * block for a given gsm_time.  outbuf must have 23 bytes of space. */
 int bts_cbch_get(struct gsm_bts *bts, uint8_t *outbuf, struct gsm_time *g_time);
+
+void bts_cbch_reset(struct gsm_bts *bts);
diff --git a/src/common/cbch.c b/src/common/cbch.c
index ebea60bef..addd68c98 100644
--- a/src/common/cbch.c
+++ b/src/common/cbch.c
@@ -322,3 +322,22 @@ int bts_cbch_get(struct gsm_bts *bts, uint8_t *outbuf, struct gsm_time *g_time)
 
 	return rc;
 }
+
+static void bts_smscb_state_reset(struct bts_smscb_state *bts_ss)
+{
+	struct smscb_msg *scm, *tmp;
+	llist_for_each_entry_safe(scm, tmp, &bts_ss->queue, list) {
+		llist_del(&scm->list);
+		talloc_free(scm);
+	}
+	bts_ss->queue_len = 0;
+	rate_ctr_group_reset(bts_ss->ctrs);
+	TALLOC_FREE(bts_ss->cur_msg);
+	TALLOC_FREE(bts_ss->default_msg);
+}
+
+void bts_cbch_reset(struct gsm_bts *bts)
+{
+	bts_smscb_state_reset(&bts->smscb_basic);
+	bts_smscb_state_reset(&bts->smscb_extended);
+}
diff --git a/src/common/nm_bts_fsm.c b/src/common/nm_bts_fsm.c
index c9dcd4c6a..063ffe840 100644
--- a/src/common/nm_bts_fsm.c
+++ b/src/common/nm_bts_fsm.c
@@ -35,6 +35,7 @@
 #include <osmo-bts/rsl.h>
 #include <osmo-bts/nm_common_fsm.h>
 #include <osmo-bts/phy_link.h>
+#include <osmo-bts/cbch.h>
 
 #define X(s) (1 << (s))
 
@@ -60,6 +61,7 @@ static void st_op_disabled_notinstalled_on_enter(struct osmo_fsm_inst *fi, uint3
 	/* Reset state: */
 	bts->si_valid = 0;
 	TALLOC_FREE(bts->mo.nm_attr);
+	bts_cbch_reset(bts);
 
 	bts->mo.setattr_success = false;
 	bts->mo.opstart_success = false;