A user equipment (UE) may receive a quality of service (QoS) flow for a multicast or broadcast service that is secured with a multicast-broadcast key. The UE may transmit a data session establishment request to a service management function (SMF) for the multicast or broadcast service. The UE may receive at least one multicast-broadcast key for the PDU session. The UE may determine a radio bearer (RB) configuration for the multicast or broadcast service. The UE may receive one or more QoS flow packets for the multicast or broadcast service over the RB. The UE may decode the one or more QoS flow packets using the at least one multicast-broadcast key, or a key derived from the at least one multicast-broadcast key. Decoding may include decrypting, verifying the integrity, or a combination thereof.