diff --git a/include/osmocom/gprs/sm/sm_prim.h b/include/osmocom/gprs/sm/sm_prim.h
index 86a36d2..baa85ed 100644
--- a/include/osmocom/gprs/sm/sm_prim.h
+++ b/include/osmocom/gprs/sm/sm_prim.h
@@ -85,6 +85,10 @@ struct osmo_gprs_sm_smreg_prim {
 					uint8_t radio_prio;	/* TS 24.008 10.5.7.2 */
 					uint8_t qos[OSMO_GPRS_SM_QOS_MAXLEN];
 					uint8_t qos_len;
+					struct {
+						uint32_t allocated_ptmsi;
+						uint32_t allocated_tlli;
+					} gmm;
 				} acc;
 				struct {
 					uint8_t cause;
diff --git a/include/osmocom/gprs/sm/sm_private.h b/include/osmocom/gprs/sm/sm_private.h
index 163014e..99beaeb 100644
--- a/include/osmocom/gprs/sm/sm_private.h
+++ b/include/osmocom/gprs/sm/sm_private.h
@@ -127,6 +127,7 @@ struct gprs_sm_ms {
 
 	struct {
 		uint32_t ptmsi;
+		uint32_t tlli;
 		char imsi[OSMO_IMSI_BUF_SIZE];
 		char imei[GSM23003_IMEI_NUM_DIGITS + 1];
 		char imeisv[GSM23003_IMEISV_NUM_DIGITS+1];
diff --git a/src/sm/sm.c b/src/sm/sm.c
index 1f87f4e..3cddb58 100644
--- a/src/sm/sm.c
+++ b/src/sm/sm.c
@@ -128,7 +128,7 @@ struct gprs_sm_ms *gprs_sm_find_ms_by_tlli(uint32_t tlli)
 	struct gprs_sm_ms *ms;
 
 	llist_for_each_entry(ms, &g_sm_ctx->ms_list, list) {
-		if (ms->gmm.ptmsi == tlli)
+		if (ms->gmm.tlli == tlli)
 			return ms;
 	}
 	return NULL;
@@ -222,6 +222,8 @@ int gprs_sm_submit_smreg_pdp_act_cnf(const struct gprs_sm_entity *sme, enum gsm4
 		sm_prim_tx->smreg.pdp_act_cnf.acc.qos_len = sme->qos_len;
 		if (sme->qos_len)
 			memcpy(sm_prim_tx->smreg.pdp_act_cnf.acc.qos, &sme->qos, sme->qos_len);
+		sm_prim_tx->smreg.pdp_act_cnf.acc.gmm.allocated_ptmsi = sme->ms->gmm.ptmsi;
+		sm_prim_tx->smreg.pdp_act_cnf.acc.gmm.allocated_tlli = sme->ms->gmm.tlli;
 	} else {
 		sm_prim_tx->smreg.pdp_act_cnf.rej.cause = cause;
 	}
@@ -237,7 +239,7 @@ int gprs_sm_submit_snsm_act_ind(const struct gprs_sm_entity *sme)
 	int rc;
 
 	sndcp_prim_tx = osmo_gprs_sndcp_prim_alloc_snsm_activate_ind(
-				sme->ms->gmm.ptmsi,
+				sme->ms->gmm.tlli,
 				sme->nsapi,
 				sme->llc_sapi);
 	//sndcp_prim_tx->snsm.activat_ind.qos_params = ; /* TODO */
diff --git a/src/sm/sm_prim.c b/src/sm/sm_prim.c
index c0fbca4..bb5653e 100644
--- a/src/sm/sm_prim.c
+++ b/src/sm/sm_prim.c
@@ -25,6 +25,7 @@
 #include <osmocom/core/msgb.h>
 #include <osmocom/core/utils.h>
 #include <osmocom/core/logging.h>
+#include <osmocom/gsm/gsm48.h>
 
 #include <osmocom/gprs/sm/sm.h>
 #include <osmocom/gprs/sm/sm_prim.h>
@@ -466,17 +467,23 @@ static int gprs_sm_prim_handle_gmmsm_establish_cnf(struct osmo_gprs_gmm_prim *gm
 {
 	struct osmo_gprs_gmm_gmmsm_prim *gmmsm = &gmm_prim->gmmsm;
 	struct gprs_sm_entity *sme;
-	int rc, ev;
+	int rc;
 
 	sme = gprs_sm_find_sme_by_sess_id(gmmsm->sess_id);
 	if (!sme) {
 		LOGSM(LOGL_ERROR, "Rx GMMSM-ESTABLISH.cnf for non existing SM Entity\n");
 		return -EINVAL;
 	}
-
-	ev = gmmsm->establish_cnf.accepted ?
-		GPRS_SM_MS_EV_RX_GMM_ESTABLISH_CNF : GPRS_SM_MS_EV_RX_GMM_ESTABLISH_REJ;
-	rc = osmo_fsm_inst_dispatch(sme->ms_fsm.fi, ev, NULL);
+	if (gmmsm->establish_cnf.accepted) {
+		/* Update allocated PTMSI: */
+		if (gmm_prim->gmmsm.establish_cnf.acc.allocated_ptmsi != GSM_RESERVED_TMSI)
+			sme->ms->gmm.ptmsi = gmm_prim->gmmsm.establish_cnf.acc.allocated_ptmsi;
+		/* Set allocated TLLI: */
+		sme->ms->gmm.tlli = gmm_prim->gmmsm.establish_cnf.acc.allocated_tlli;
+		rc = osmo_fsm_inst_dispatch(sme->ms_fsm.fi, GPRS_SM_MS_EV_RX_GMM_ESTABLISH_CNF, NULL);
+	} else {
+		rc = osmo_fsm_inst_dispatch(sme->ms_fsm.fi, GPRS_SM_MS_EV_RX_GMM_ESTABLISH_REJ, NULL);
+	}
 
 	return rc;
 }