A method of coordinating a change in cryptographic key sets from a first cryptographic key set to a second cryptographic key set between a radio access network (RAN) node and a wireless device (WD) served by the RAN node. The RAN node includes a user plane (UP) component and a control plane (CP) component. The method includes transmitting, from the UP component to the wireless device (WD), a key change indicator indicative of changeover to the second cryptographic key set, the key change indicator included in one of a data protocol data unit (PDU) and a control PDU; and subsequently cryptographically encoding PDUs for transmission to the WD and cryptographically decoding PDUs received from the WD in accordance with the second cryptographic key set.