diff --git a/daemon/call.c b/daemon/call.c
index 0b8cb1847..f4be027d9 100644
--- a/daemon/call.c
+++ b/daemon/call.c
@@ -1023,8 +1023,7 @@ static void __fill_stream(struct packet_stream *ps, const struct endpoint *epp,
 
 	if (PS_ISSET(ps, FILLED) && !MEDIA_ISSET(media, DTLS)) {
 		/* we reset crypto params whenever the endpoint changes */
-		// XXX fix WRT SSRC handling
-		crypto_reset(&ps->crypto);
+		call_stream_crypto_reset(ps);
 		dtls_shutdown(ps);
 	}
 
@@ -1036,6 +1035,20 @@ static void __fill_stream(struct packet_stream *ps, const struct endpoint *epp,
 		PS_SET(ps, PIERCE_NAT);
 }
 
+void call_stream_crypto_reset(struct packet_stream *ps) {
+	crypto_reset(&ps->crypto);
+
+	mutex_lock(&ps->in_lock);
+	if (ps->ssrc_in)
+		ps->ssrc_in->srtp_index = 0;
+	mutex_unlock(&ps->in_lock);
+
+	mutex_lock(&ps->out_lock);
+	if (ps->ssrc_out)
+		ps->ssrc_out->srtp_index = 0;
+	mutex_unlock(&ps->out_lock);
+}
+
 /* called with call locked in R or W, but ps not locked */
 enum call_stream_state call_stream_state_machine(struct packet_stream *ps) {
 	struct call_media *media = ps->media;
diff --git a/daemon/dtls.c b/daemon/dtls.c
index 455657dab..7f18be268 100644
--- a/daemon/dtls.c
+++ b/daemon/dtls.c
@@ -816,7 +816,7 @@ void dtls_shutdown(struct packet_stream *ps) {
 		ps->dtls_cert = NULL;
 	}
 
-	crypto_reset(&ps->crypto);
+	call_stream_crypto_reset(ps);
 }
 
 void dtls_connection_cleanup(struct dtls_connection *c) {
diff --git a/include/call.h b/include/call.h
index 0522fc40c..abd7567e4 100644
--- a/include/call.h
+++ b/include/call.h
@@ -541,6 +541,7 @@ void add_total_calls_duration_in_interval(struct timeval *interval_tv);
 void payload_type_free(struct rtp_payload_type *p);
 void __rtp_stats_update(GHashTable *dst, GHashTable *src);
 int __init_stream(struct packet_stream *ps);
+void call_stream_crypto_reset(struct packet_stream *ps);
 
 const struct rtp_payload_type *__rtp_stats_codec(struct call_media *m);
 
diff --git a/include/crypto.h b/include/crypto.h
index cfad951e8..5a60e6631 100644
--- a/include/crypto.h
+++ b/include/crypto.h
@@ -158,7 +158,6 @@ INLINE void crypto_cleanup(struct crypto_context *c) {
 	c->params.crypto_suite = NULL;
 }
 INLINE void crypto_reset(struct crypto_context *c) {
-	// XXX reset details from ssrc_ctx?
 	crypto_cleanup(c);
 }
 INLINE void crypto_params_copy(struct crypto_params *o, const struct crypto_params *i, int copy_sp) {