A user equipment (UE) may update multicast-broadcast key for securing a data session for a multicast or broadcast service. The UE may receive a multicast-broadcast key for the for a multicast or broadcast service carried by a radio bearer (RB) associated with the data session. The UE may receive packets for the multicast or broadcast service. The UE may decode the packets using the multicast-broadcast key, or a key derived from the multicast-broadcast key. The UE may receive an updated multicast-broadcast key for the multicast or broadcast service. The UE may decode the packets for the multicast or broadcast service received on the RB using the updated multicast-broadcast key, or a key derived from the updated multicast-broadcast key.