Techniques are disclosed relating to handover between cellular base stations. In some embodiments that use dual-connectivity handover, disclosed techniques may facilitate synchronization of a security configuration switch. In some embodiments, the base station and/or mobile device determine activation sequence numbers for the security configuration switch (e.g., by estimating when a path switch will occur). In some embodiments, the security configuration switch is implicitly detected based in deciphering failure. In some embodiments, the security configuration switch is explicitly signaled and is checked based on deciphering failure. In some embodiments that use make before break handover techniques, a source base station may be retained after the path switch.